@soropass/core 0.1.0

package/dist/connect.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/internal/encoding.ts","../src/ceremonies/random.ts","../src/ceremonies/browserClient.ts","../src/ceremonies/connect.ts"],"names":[],"mappings":";;;AAoBO,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EACzB,IAAA;AAAA,EACS,IAAA,GAAO,UAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAoB,OAAA,EAAkB,OAAA,EAA+B;AAC/E,IAAA,KAAA,CAAM,OAAA,IAAW,MAAM,OAAO,CAAA;AAC9B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAGZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,SAAA,CAAS,SAAS,CAAA;AAAA,EAChD;AACF,CAAA;;;ACjBO,SAAS,iBAAiB,KAAA,EAAwC;AACvE,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,SAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,KAAM,CAAC,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAC,CAAA;AACzD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;ACdO,SAAS,YAAY,MAAA,EAAyC;AACnE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,OAAO,SAAA,EAAW,eAAA,KAAoB,UAAA,EAAY;AACpD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAM,CAAC,CAAA;AAClD,EAAA,SAAA,CAAU,gBAAgB,GAAG,CAAA;AAC7B,EAAA,OAAO,GAAA;AACT;;;ACAA,SAAS,WAAW,KAAA,EAA0B;AAC5C,EAAA,IAAI,KAAA,YAAiB,UAAU,OAAO,KAAA;AACtC,EAAA,MAAM,IAAA,GACJ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,MAAA,IAAU,KAAA,GACpD,KAAA,CAA6B,IAAA,GAC9B,MAAA;AACN,EAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,IAAA,OAAO,IAAI,QAAA,CAAS,gBAAA,EAAkB,qCAAqC,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,yBAAA;AAGzD,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,GAAG,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,GAAK,OAAA;AAClE,EAAA,OAAO,IAAI,QAAA,CAAS,2BAAA,EAA6B,QAAQ,EAAE,KAAA,EAAO,OAAO,CAAA;AAC3E;AAGO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,WAAA,GAAe,WAAyC,SAAA,EAAW,WAAA;AACzE,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,sCAAsC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,OAAA,EAAgF;AAC3F,MAAA,MAAM,SAAA,GAAgD;AAAA,QACpD,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAAA,QAC7C,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,gBAAA,CAAiB,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA;AAAA,UACpC,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,UACnB,WAAA,EAAa,QAAQ,IAAA,CAAK;AAAA,SAC5B;AAAA,QACA,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,QAC1B,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,QAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,SAAS,OAAA,CAAQ;AAAA,OACnB;AACA,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,MAAA,CAAO,EAAE,WAAW,CAAA;AAAA,MACtD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,mCAAmC,CAAA;AACzF,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,MAAM,IAAI,OAAA,EAAyD;AACjE,MAAA,MAAM,SAAA,GAA+C;AAAA,QACnD,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,SAAA,EAAW,QAAQ,SAAA,GAAY,IAAI,WAAW,OAAA,CAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,EAAE,CAAA;AAAA,QACjF,mBAAmB,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,UAC9D,IAAA,EAAM,YAAA;AAAA,UACN,EAAA,EAAI,iBAAiB,EAAE;AAAA,SACzB,CAAE,CAAA;AAAA,QACF,kBAAkB,OAAA,CAAQ;AAAA,OAC5B;AACA,MAAA,MAAM,OAAA,GAAoC,EAAE,SAAA,EAAU;AACtD,MAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MAC7C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,yBAAyB,CAAA;AAC/E,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AAAA,QAC5D,cAAA,EAAgB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAAA,QACtD,SAAA,EAAW,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS;AAAA,OAC9C;AAAA,IACF;AAAA,GACF;AACF;AAGO,SAAS,wBAAA,GAA8C;AAC5D,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAyB,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA;AAC7D,EAAA,MAAM,KAAM,UAAA,CAA0C,YAAA;AACtD,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,OAAO;AAAA,MACL,KAAK,CAAC,IAAA,KAAS,GAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,MACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,QAAA,EAAA,CAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,YAAY,CAAA;AAAA,MACpC;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AAAA,IACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,MAAA,MAAA,CAAO,GAAA,CAAI,MAAM,YAAY,CAAA;AAAA,IAC/B;AAAA,GACF;AACF;;;ACrGA,eAAe,yBAAA,GAA8C;AAC3D,EAAA,MAAM,MACJ,UAAA,CAGA,mBAAA;AACF,EAAA,IAAI,CAAC,GAAA,EAAK,+BAAA,EAAiC,OAAO,KAAA;AAClD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAI,+BAAA,EAAgC;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASA,eAAsB,QAAQ,OAAA,EAAwD;AACpF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,wBAAA,EAAyB;AAC5D,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAC7C,EAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,wBAAA,IAA6B,MAAM,yBAAA,EAA0B;AAC7F,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,GAAA,CAAI;AAAA,QACjB,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,gBAAA,EAAkB,CAAC,YAAY,CAAA;AAAA,QAC/B,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,oBAAoB,YAAY,CAAA;AACvE,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,CAAC,CAAA,EAAG,UAAA;AAChC,EAAA,OAAO,UAAA,GAAa,EAAE,UAAA,EAAY,YAAA,EAAa,GAAI,IAAA;AACrD","file":"connect.cjs","sourcesContent":["/**\n * The frozen taxonomy of error codes the SDK can throw. This union is\n * deliberately closed — every failure path maps to exactly one of these.\n */\nexport const KIT_ERROR_CODES = Object.freeze([\n  'USER_CANCELLED',\n  'ES256_NOT_SUPPORTED',\n  'RP_ID_MISMATCH',\n  'ORIGIN_MISMATCH',\n  'CHALLENGE_MISMATCH',\n  'INVALID_SIGNATURE_DER',\n  'INVALID_PUBLIC_KEY',\n  'CONTRACT_AUTH_FAILED',\n  'NETWORK_ERROR',\n  'UNSUPPORTED_AUTHENTICATOR',\n] as const);\n\nexport type KitErrorCode = (typeof KIT_ERROR_CODES)[number];\n\n/** Structured error carrying a machine-readable {@link KitErrorCode}. */\nexport class KitError extends Error {\n  readonly code: KitErrorCode;\n  override readonly name = 'KitError';\n\n  constructor(code: KitErrorCode, message?: string, options?: { cause?: unknown }) {\n    super(message ?? code, options);\n    this.code = code;\n    // Restore the prototype chain so `instanceof KitError` works after\n    // down-level transpilation to CJS.\n    Object.setPrototypeOf(this, KitError.prototype);\n  }\n}\n\nexport function isKitError(value: unknown): value is KitError {\n  return value instanceof KitError;\n}\n","/**\n * Isomorphic base64url + UTF-8 codecs. `atob`/`btoa`/`TextEncoder`/`TextDecoder`\n * are globals in modern browsers and Node >= 16, so no platform branch is\n * needed and nothing is bundled.\n */\n\n/** Encode bytes as unpadded base64url. */\nexport function bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode base64 or base64url (padding optional) to bytes. */\nexport function base64UrlToBytes(input: string): Uint8Array<ArrayBuffer> {\n  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nexport function utf8ToBytes(text: string): Uint8Array {\n  return new TextEncoder().encode(text);\n}\n\nexport function bytesToUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n","import { KitError } from '../errors';\n\n/**\n * Cryptographically-random bytes, isomorphic (browser + Node global crypto).\n * Throws instead of silently returning all-zero bytes when no secure RNG is\n * present — an all-zero challenge would be catastrophic, not a soft fallback.\n */\nexport function randomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const webcrypto = globalThis.crypto as Crypto | undefined;\n  if (typeof webcrypto?.getRandomValues !== 'function') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'no secure random source (globalThis.crypto.getRandomValues) is available in this environment',\n    );\n  }\n  const out = new Uint8Array(new ArrayBuffer(length));\n  webcrypto.getRandomValues(out);\n  return out;\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes } from '../internal/encoding';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '../webauthn/createOptions';\nimport { randomBytes } from './random';\nimport type {\n  CredentialStorage,\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from './types';\n\n/**\n * Map a `navigator.credentials` rejection to a `KitError`. Dismissing the OS\n * passkey sheet rejects with a `NotAllowedError` (a DOMException) — surface that\n * as `USER_CANCELLED` so the UI shows the true \"you cancelled\" copy instead of\n * the generic unsupported-authenticator fallback (S20 / S04 polish).\n */\nfunction asKitError(error: unknown): KitError {\n  if (error instanceof KitError) return error;\n  const name =\n    typeof error === 'object' && error !== null && 'name' in error\n      ? (error as { name?: unknown }).name\n      : undefined;\n  if (name === 'NotAllowedError') {\n    return new KitError('USER_CANCELLED', 'The passkey prompt was dismissed.', { cause: error });\n  }\n  const message = error instanceof Error ? error.message : 'WebAuthn request failed';\n  // Preserve the original DOMException name (e.g. InvalidStateError / ConstraintError)\n  // in the message so diagnostics show the true cause, not just the generic bucket.\n  const detail = typeof name === 'string' ? `${name}: ${message}` : message;\n  return new KitError('UNSUPPORTED_AUTHENTICATOR', detail, { cause: error });\n}\n\n/** The browser `WebAuthnClient` backed by `navigator.credentials`. */\nexport function browserWebAuthnClient(): WebAuthnClient {\n  const credentials = (globalThis as { navigator?: Navigator }).navigator?.credentials;\n  if (!credentials) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'navigator.credentials is unavailable');\n  }\n  return {\n    async create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult> {\n      const publicKey: PublicKeyCredentialCreationOptions = {\n        challenge: base64UrlToBytes(options.challenge),\n        rp: options.rp,\n        user: {\n          id: base64UrlToBytes(options.user.id),\n          name: options.user.name,\n          displayName: options.user.displayName,\n        },\n        pubKeyCredParams: options.pubKeyCredParams,\n        authenticatorSelection: options.authenticatorSelection,\n        attestation: options.attestation,\n        timeout: options.timeout,\n      };\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.create({ publicKey })) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'credential creation returned null');\n      const response = credential.response as AuthenticatorAttestationResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        attestationObject: new Uint8Array(response.attestationObject),\n      };\n    },\n    async get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const publicKey: PublicKeyCredentialRequestOptions = {\n        rpId: options.rpId,\n        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),\n        allowCredentials: (options.allowCredentials ?? []).map((id) => ({\n          type: 'public-key',\n          id: base64UrlToBytes(id),\n        })),\n        userVerification: options.userVerification,\n      };\n      const request: CredentialRequestOptions = { publicKey };\n      if (options.mediation) request.mediation = options.mediation;\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.get(request)) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'assertion returned null');\n      const response = credential.response as AuthenticatorAssertionResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        authenticatorData: new Uint8Array(response.authenticatorData),\n        clientDataJSON: new Uint8Array(response.clientDataJSON),\n        signature: new Uint8Array(response.signature),\n      };\n    },\n  };\n}\n\n/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */\nexport function defaultCredentialStorage(): CredentialStorage {\n  const key = (rpId: string): string => `stellar-passkey:${rpId}`;\n  const ls = (globalThis as { localStorage?: Storage }).localStorage;\n  if (ls) {\n    return {\n      get: (rpId) => ls.getItem(key(rpId)),\n      set: (rpId, credentialId) => {\n        ls.setItem(key(rpId), credentialId);\n      },\n    };\n  }\n  const memory = new Map<string, string>();\n  return {\n    get: (rpId) => memory.get(rpId) ?? null,\n    set: (rpId, credentialId) => {\n      memory.set(rpId, credentialId);\n    },\n  };\n}\n","import type { IndexerAdapter } from '../adapters/types';\nimport { browserWebAuthnClient, defaultCredentialStorage } from './browserClient';\nimport type { CredentialStorage, WebAuthnClient } from './types';\n\nexport interface ConnectOptions {\n  rpId: string;\n  indexer: IndexerAdapter;\n  webauthn?: WebAuthnClient;\n  storage?: CredentialStorage;\n  /** Override silent-mediation detection (default: probe isConditionalMediationAvailable). */\n  silentMediationSupported?: boolean;\n}\n\nexport interface ConnectResult {\n  contractId: string;\n  credentialId: string;\n}\n\nasync function probeConditionalMediation(): Promise<boolean> {\n  const pkc = (\n    globalThis as {\n      PublicKeyCredential?: { isConditionalMediationAvailable?: () => Promise<boolean> };\n    }\n  ).PublicKeyCredential;\n  if (!pkc?.isConditionalMediationAvailable) return false;\n  try {\n    return await pkc.isConditionalMediationAvailable();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * `connect` — silent reconnect using the stored credential id. Where conditional\n * mediation is available, does a best-effort `mediation:'silent'` liveness check;\n * the C-address is resolved via the IndexerAdapter regardless, so connect\n * degrades gracefully where silent mediation is unsupported. Returns null when\n * there is no stored credential (the caller should `recover`) or no account.\n */\nexport async function connect(options: ConnectOptions): Promise<ConnectResult | null> {\n  const storage = options.storage ?? defaultCredentialStorage();\n  const credentialId = storage.get(options.rpId);\n  if (!credentialId) return null;\n\n  const silentSupported = options.silentMediationSupported ?? (await probeConditionalMediation());\n  if (silentSupported) {\n    const webauthn = options.webauthn ?? browserWebAuthnClient();\n    try {\n      await webauthn.get({\n        rpId: options.rpId,\n        allowCredentials: [credentialId],\n        mediation: 'silent',\n      });\n    } catch {\n      // A silent get may no-op or reject; resolution is via the indexer.\n    }\n  }\n\n  const accounts = await options.indexer.resolveByCredential(credentialId);\n  const contractId = accounts[0]?.contractId;\n  return contractId ? { contractId, credentialId } : null;\n}\n"]}

package/dist/connect.d.cts

@@ -0,0 +1,24 @@
+import { I as IndexerAdapter, W as WebAuthnClient, C as CredentialStorage } from './types--WNl-Sda.cjs';
+
+interface ConnectOptions {
+    rpId: string;
+    indexer: IndexerAdapter;
+    webauthn?: WebAuthnClient;
+    storage?: CredentialStorage;
+    /** Override silent-mediation detection (default: probe isConditionalMediationAvailable). */
+    silentMediationSupported?: boolean;
+}
+interface ConnectResult {
+    contractId: string;
+    credentialId: string;
+}
+/**
+ * `connect` — silent reconnect using the stored credential id. Where conditional
+ * mediation is available, does a best-effort `mediation:'silent'` liveness check;
+ * the C-address is resolved via the IndexerAdapter regardless, so connect
+ * degrades gracefully where silent mediation is unsupported. Returns null when
+ * there is no stored credential (the caller should `recover`) or no account.
+ */
+declare function connect(options: ConnectOptions): Promise<ConnectResult | null>;
+
+export { type ConnectOptions, type ConnectResult, connect };

package/dist/connect.d.ts

@@ -0,0 +1,24 @@
+import { I as IndexerAdapter, W as WebAuthnClient, C as CredentialStorage } from './types--WNl-Sda.js';
+
+interface ConnectOptions {
+    rpId: string;
+    indexer: IndexerAdapter;
+    webauthn?: WebAuthnClient;
+    storage?: CredentialStorage;
+    /** Override silent-mediation detection (default: probe isConditionalMediationAvailable). */
+    silentMediationSupported?: boolean;
+}
+interface ConnectResult {
+    contractId: string;
+    credentialId: string;
+}
+/**
+ * `connect` — silent reconnect using the stored credential id. Where conditional
+ * mediation is available, does a best-effort `mediation:'silent'` liveness check;
+ * the C-address is resolved via the IndexerAdapter regardless, so connect
+ * degrades gracefully where silent mediation is unsupported. Returns null when
+ * there is no stored credential (the caller should `recover`) or no account.
+ */
+declare function connect(options: ConnectOptions): Promise<ConnectResult | null>;
+
+export { type ConnectOptions, type ConnectResult, connect };

package/dist/connect.js

@@ -0,0 +1,6 @@
+import './chunk-OGSUGATA.js';
+export { connect } from './chunk-AHFGTIBY.js';
+import './chunk-LB4HOTLV.js';
+import './chunk-AMYFJQAC.js';
+//# sourceMappingURL=connect.js.map
+//# sourceMappingURL=connect.js.map

package/dist/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"connect.js"}

package/dist/create.cjs

@@ -0,0 +1,483 @@
+'use strict';
+
+var nist = require('@noble/curves/nist');
+var stellarSdk = require('@stellar/stellar-sdk');
+var sha256 = require('@noble/hashes/sha256');
+
+// src/errors.ts
+var KitError = class _KitError extends Error {
+  code;
+  name = "KitError";
+  constructor(code, message, options) {
+    super(message ?? code, options);
+    this.code = code;
+    Object.setPrototypeOf(this, _KitError.prototype);
+  }
+};
+var ALG_ES256 = -7;
+function assertES256(alg) {
+  if (alg !== ALG_ES256) {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${alg} is not ES256 (-7)`);
+  }
+}
+function assertUserActivation(activation) {
+  const ua = activation ?? globalThis.navigator?.userActivation;
+  if (ua && !ua.isActive) {
+    throw new KitError(
+      "USER_CANCELLED",
+      "WebAuthn ceremony must be invoked inside a user activation (click/tap)"
+    );
+  }
+}
+
+// src/internal/encoding.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function utf8ToBytes(text) {
+  return new TextEncoder().encode(text);
+}
+
+// src/webauthn/createOptions.ts
+function buildCreateOptions(input) {
+  const residentKey = input.residentKey ?? "required";
+  return {
+    rp: { id: input.rpId, name: input.rpName },
+    user: {
+      id: bytesToBase64Url(input.userId ?? utf8ToBytes(input.userName)),
+      name: input.userName,
+      displayName: input.userDisplayName ?? input.userName
+    },
+    challenge: bytesToBase64Url(input.challenge),
+    pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+    authenticatorSelection: {
+      residentKey,
+      requireResidentKey: residentKey === "required",
+      userVerification: input.userVerification ?? "preferred"
+    },
+    attestation: "none",
+    timeout: input.timeout ?? 6e4
+  };
+}
+
+// src/internal/bytes.ts
+function concatBytes(...arrays) {
+  const total = arrays.reduce((n, a) => n + a.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    out.set(a, offset);
+    offset += a.length;
+  }
+  return out;
+}
+
+// src/internal/cbor.ts
+function byteAt(bytes, index) {
+  const value = bytes[index];
+  if (value === void 0) throw new Error(`CBOR: unexpected end of input at byte ${index}`);
+  return value;
+}
+var MAX_DEPTH = 16;
+function decodeCbor(bytes, offset = 0, depth = 0) {
+  if (depth > MAX_DEPTH) throw new Error("CBOR: maximum nesting depth exceeded");
+  const first = byteAt(bytes, offset);
+  const major = first >> 5;
+  const info = first & 31;
+  let pos = offset + 1;
+  let argument;
+  if (info < 24) {
+    argument = info;
+  } else if (info === 24) {
+    argument = byteAt(bytes, pos);
+    pos += 1;
+  } else if (info === 25) {
+    argument = byteAt(bytes, pos) << 8 | byteAt(bytes, pos + 1);
+    pos += 2;
+  } else if (info === 26) {
+    argument = byteAt(bytes, pos) * 16777216 + (byteAt(bytes, pos + 1) << 16) + (byteAt(bytes, pos + 2) << 8) + byteAt(bytes, pos + 3);
+    pos += 4;
+  } else {
+    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);
+  }
+  switch (major) {
+    case 0:
+      return { value: argument, length: pos - offset };
+    case 1:
+      return { value: -1 - argument, length: pos - offset };
+    case 2: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: byte string exceeds input");
+      return { value: bytes.slice(pos, end), length: end - offset };
+    }
+    case 3: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: text string exceeds input");
+      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };
+    }
+    case 4: {
+      const items = [];
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const item = decodeCbor(bytes, cursor, depth + 1);
+        items.push(item.value);
+        cursor += item.length;
+      }
+      return { value: items, length: cursor - offset };
+    }
+    case 5: {
+      const map = /* @__PURE__ */ new Map();
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const key = decodeCbor(bytes, cursor, depth + 1);
+        cursor += key.length;
+        const val = decodeCbor(bytes, cursor, depth + 1);
+        cursor += val.length;
+        if (typeof key.value !== "number" && typeof key.value !== "string") {
+          throw new Error("CBOR: unsupported map key type");
+        }
+        if (map.has(key.value)) {
+          throw new Error("CBOR: duplicate map key (non-canonical)");
+        }
+        map.set(key.value, val.value);
+      }
+      return { value: map, length: cursor - offset };
+    }
+    default:
+      throw new Error(`CBOR: unsupported major type ${major}`);
+  }
+}
+function decodeCborFirst(bytes) {
+  return decodeCbor(bytes, 0).value;
+}
+
+// src/webauthn/authData.ts
+var MIN_LENGTH = 37;
+function parseAuthenticatorData(authData) {
+  if (authData.length < MIN_LENGTH) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`
+    );
+  }
+  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);
+  const rpIdHash = authData.slice(0, 32);
+  const bits = authData[32] ?? 0;
+  const flags = {
+    up: (bits & 1) !== 0,
+    uv: (bits & 4) !== 0,
+    be: (bits & 8) !== 0,
+    bs: (bits & 16) !== 0,
+    at: (bits & 64) !== 0,
+    ed: (bits & 128) !== 0,
+    bits
+  };
+  const signCount = view.getUint32(33, false);
+  const result = { rpIdHash, flags, signCount };
+  if (flags.at) {
+    if (authData.length < 55) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in attested data"
+      );
+    }
+    result.aaguid = authData.slice(37, 53);
+    const credIdLength = view.getUint16(53, false);
+    const credIdEnd = 55 + credIdLength;
+    if (authData.length < credIdEnd) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in credentialId"
+      );
+    }
+    result.credentialId = authData.slice(55, credIdEnd);
+    const rest = authData.slice(credIdEnd);
+    const { length } = decodeCbor(rest, 0);
+    result.credentialPublicKey = rest.slice(0, length);
+  }
+  return result;
+}
+
+// src/webauthn/publicKey.ts
+var COSE_KTY = 1;
+var COSE_ALG = 3;
+var COSE_CRV = -1;
+var COSE_X = -2;
+var COSE_Y = -3;
+var KTY_EC2 = 2;
+var CRV_P256 = 1;
+function coseKeyToSec1(coseKey) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(coseKey);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode COSE key", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key is not a CBOR map");
+  }
+  const map = decoded;
+  const alg = map.get(COSE_ALG);
+  if (typeof alg !== "number") {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${String(alg)} is not ES256 (-7)`);
+  }
+  assertES256(alg);
+  if (map.get(COSE_KTY) !== KTY_EC2) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE kty ${String(map.get(COSE_KTY))} is not EC2 (2)`
+    );
+  }
+  if (map.get(COSE_CRV) !== CRV_P256) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE crv ${String(map.get(COSE_CRV))} is not P-256 (1)`
+    );
+  }
+  const x = map.get(COSE_X);
+  const y = map.get(COSE_Y);
+  if (!(x instanceof Uint8Array) || x.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key X coordinate is not 32 bytes");
+  }
+  if (!(y instanceof Uint8Array) || y.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key Y coordinate is not 32 bytes");
+  }
+  const sec1 = concatBytes(new Uint8Array([4]), x, y);
+  try {
+    nist.p256.Point.fromHex(sec1);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "public key is not a valid P-256 point", { cause });
+  }
+  return sec1;
+}
+function extractPublicKeyFromAuthData(authData) {
+  const parsed = parseAuthenticatorData(authData);
+  if (!parsed.credentialPublicKey) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      "authenticatorData has no attested credential public key"
+    );
+  }
+  return coseKeyToSec1(parsed.credentialPublicKey);
+}
+function extractPublicKeyFromAttestationObject(attestationObject) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(attestationObject);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode attestationObject", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject is not a CBOR map");
+  }
+  const authData = decoded.get("authData");
+  if (!(authData instanceof Uint8Array)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject has no authData byte string");
+  }
+  return extractPublicKeyFromAuthData(authData);
+}
+
+// src/ceremonies/random.ts
+function randomBytes(length) {
+  const webcrypto = globalThis.crypto;
+  if (typeof webcrypto?.getRandomValues !== "function") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "no secure random source (globalThis.crypto.getRandomValues) is available in this environment"
+    );
+  }
+  const out = new Uint8Array(new ArrayBuffer(length));
+  webcrypto.getRandomValues(out);
+  return out;
+}
+
+// src/ceremonies/browserClient.ts
+function asKitError(error) {
+  if (error instanceof KitError) return error;
+  const name = typeof error === "object" && error !== null && "name" in error ? error.name : void 0;
+  if (name === "NotAllowedError") {
+    return new KitError("USER_CANCELLED", "The passkey prompt was dismissed.", { cause: error });
+  }
+  const message = error instanceof Error ? error.message : "WebAuthn request failed";
+  const detail = typeof name === "string" ? `${name}: ${message}` : message;
+  return new KitError("UNSUPPORTED_AUTHENTICATOR", detail, { cause: error });
+}
+function browserWebAuthnClient() {
+  const credentials = globalThis.navigator?.credentials;
+  if (!credentials) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "navigator.credentials is unavailable");
+  }
+  return {
+    async create(options) {
+      const publicKey = {
+        challenge: base64UrlToBytes(options.challenge),
+        rp: options.rp,
+        user: {
+          id: base64UrlToBytes(options.user.id),
+          name: options.user.name,
+          displayName: options.user.displayName
+        },
+        pubKeyCredParams: options.pubKeyCredParams,
+        authenticatorSelection: options.authenticatorSelection,
+        attestation: options.attestation,
+        timeout: options.timeout
+      };
+      let credential;
+      try {
+        credential = await credentials.create({ publicKey });
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "credential creation returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        attestationObject: new Uint8Array(response.attestationObject)
+      };
+    },
+    async get(options) {
+      const publicKey = {
+        rpId: options.rpId,
+        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),
+        allowCredentials: (options.allowCredentials ?? []).map((id) => ({
+          type: "public-key",
+          id: base64UrlToBytes(id)
+        })),
+        userVerification: options.userVerification
+      };
+      const request = { publicKey };
+      if (options.mediation) request.mediation = options.mediation;
+      let credential;
+      try {
+        credential = await credentials.get(request);
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "assertion returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        authenticatorData: new Uint8Array(response.authenticatorData),
+        clientDataJSON: new Uint8Array(response.clientDataJSON),
+        signature: new Uint8Array(response.signature)
+      };
+    }
+  };
+}
+function defaultCredentialStorage() {
+  const key = (rpId) => `stellar-passkey:${rpId}`;
+  const ls = globalThis.localStorage;
+  if (ls) {
+    return {
+      get: (rpId) => ls.getItem(key(rpId)),
+      set: (rpId, credentialId) => {
+        ls.setItem(key(rpId), credentialId);
+      }
+    };
+  }
+  const memory = /* @__PURE__ */ new Map();
+  return {
+    get: (rpId) => memory.get(rpId) ?? null,
+    set: (rpId, credentialId) => {
+      memory.set(rpId, credentialId);
+    }
+  };
+}
+
+// src/ceremonies/create.ts
+async function registerPasskey(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const creationOptions = buildCreateOptions({
+    rpId: options.rpId,
+    rpName: options.rpName,
+    userName: options.userName,
+    userId: options.userId,
+    challenge: options.challenge ?? randomBytes(32),
+    residentKey: options.residentKey,
+    userVerification: options.userVerification
+  });
+  const credential = await webauthn.create(creationOptions);
+  const publicKey = extractPublicKeyFromAttestationObject(credential.attestationObject);
+  return { credentialId: credential.id, publicKey };
+}
+async function createPasskey(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const { credentialId, publicKey } = await registerPasskey(options);
+  const { contractId } = await options.deployer.deploy({ publicKey, credentialId });
+  storage.set(options.rpId, credentialId);
+  return { contractId, credentialId, publicKey };
+}
+
+// src/webauthn/clientData.ts
+function decodeChallenge(challenge) {
+  return base64UrlToBytes(challenge);
+}
+
+// src/soroban/address.ts
+function contractIdFromDeployerSalt(deployer, salt, networkPassphrase) {
+  let address;
+  try {
+    address = stellarSdk.Address.fromString(deployer).toScAddress();
+  } catch (cause) {
+    throw new KitError("CONTRACT_AUTH_FAILED", `invalid deployer address "${deployer}"`, { cause });
+  }
+  const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeContractId(
+    new stellarSdk.xdr.HashIdPreimageContractId({
+      networkId: stellarSdk.hash(Buffer.from(networkPassphrase)),
+      contractIdPreimage: stellarSdk.xdr.ContractIdPreimage.contractIdPreimageFromAddress(
+        new stellarSdk.xdr.ContractIdPreimageFromAddress({
+          address,
+          salt: Buffer.from(salt)
+        })
+      )
+    })
+  );
+  return stellarSdk.StrKey.encodeContract(stellarSdk.hash(preimage.toXDR()));
+}
+function deriveAccountAddress(options) {
+  const { factoryContractId, credentialId, networkPassphrase } = options;
+  if (credentialId.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveAccountAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(
+    factoryContractId,
+    stellarSdk.hash(Buffer.from(credentialId)),
+    // e.crypto().sha256(credential_id)
+    networkPassphrase
+  );
+}
+function deriveSmartWalletAddress(options) {
+  const raw = decodeChallenge(options.credentialId);
+  if (raw.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveSmartWalletAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(options.deployer, sha256.sha256(raw), options.networkPassphrase);
+}
+
+exports.assertES256 = assertES256;
+exports.assertUserActivation = assertUserActivation;
+exports.browserWebAuthnClient = browserWebAuthnClient;
+exports.buildCreateOptions = buildCreateOptions;
+exports.coseKeyToSec1 = coseKeyToSec1;
+exports.createPasskey = createPasskey;
+exports.defaultCredentialStorage = defaultCredentialStorage;
+exports.deriveAccountAddress = deriveAccountAddress;
+exports.deriveSmartWalletAddress = deriveSmartWalletAddress;
+exports.extractPublicKeyFromAttestationObject = extractPublicKeyFromAttestationObject;
+exports.extractPublicKeyFromAuthData = extractPublicKeyFromAuthData;
+exports.registerPasskey = registerPasskey;
+//# sourceMappingURL=create.cjs.map
+//# sourceMappingURL=create.cjs.map