@soropass/core 0.1.0

package/dist/create.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/anchors.ts","../src/internal/encoding.ts","../src/webauthn/createOptions.ts","../src/internal/bytes.ts","../src/internal/cbor.ts","../src/webauthn/authData.ts","../src/webauthn/publicKey.ts","../src/ceremonies/random.ts","../src/ceremonies/browserClient.ts","../src/ceremonies/create.ts","../src/webauthn/clientData.ts","../src/soroban/address.ts"],"names":["p256","Address","xdr","hash","StrKey","sha256"],"mappings":";;;;;;;AAoBO,IAAM,QAAA,GAAN,MAAM,SAAA,SAAiB,KAAA,CAAM;AAAA,EACzB,IAAA;AAAA,EACS,IAAA,GAAO,UAAA;AAAA,EAEzB,WAAA,CAAY,IAAA,EAAoB,OAAA,EAAkB,OAAA,EAA+B;AAC/E,IAAA,KAAA,CAAM,OAAA,IAAW,MAAM,OAAO,CAAA;AAC9B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAGZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,SAAA,CAAS,SAAS,CAAA;AAAA,EAChD;AACF,CAAA;ACXA,IAAM,SAAA,GAAY,EAAA;AAOX,SAAS,YAAY,GAAA,EAAmB;AAC7C,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,MAAM,IAAI,QAAA,CAAS,qBAAA,EAAuB,CAAA,SAAA,EAAY,GAAG,CAAA,kBAAA,CAAoB,CAAA;AAAA,EAC/E;AACF;AAkBO,SAAS,qBAAqB,UAAA,EAAuC;AAC1E,EAAA,MAAM,EAAA,GACJ,UAAA,IACC,UAAA,CAAW,SAAA,EAAmE,cAAA;AACjF,EAAA,IAAI,EAAA,IAAM,CAAC,EAAA,CAAG,QAAA,EAAU;AACtB,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,gBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;;;ACpDO,SAAS,iBAAiB,KAAA,EAA2B;AAC1D,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,iBAAiB,KAAA,EAAwC;AACvE,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,SAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,KAAM,CAAC,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAC,CAAA;AACzD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,YAAY,IAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA;AACtC;;;ACoBO,SAAS,mBACd,KAAA,EACwC;AACxC,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,IAAe,UAAA;AACzC,EAAA,OAAO;AAAA,IACL,IAAI,EAAE,EAAA,EAAI,MAAM,IAAA,EAAM,IAAA,EAAM,MAAM,MAAA,EAAO;AAAA,IACzC,IAAA,EAAM;AAAA,MACJ,IAAI,gBAAA,CAAiB,KAAA,CAAM,UAAU,WAAA,CAAY,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MAChE,MAAM,KAAA,CAAM,QAAA;AAAA,MACZ,WAAA,EAAa,KAAA,CAAM,eAAA,IAAmB,KAAA,CAAM;AAAA,KAC9C;AAAA,IACA,SAAA,EAAW,gBAAA,CAAiB,KAAA,CAAM,SAAS,CAAA;AAAA,IAC3C,kBAAkB,CAAC,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,IAAI,CAAA;AAAA,IAClD,sBAAA,EAAwB;AAAA,MACtB,WAAA;AAAA,MACA,oBAAoB,WAAA,KAAgB,UAAA;AAAA,MACpC,gBAAA,EAAkB,MAAM,gBAAA,IAAoB;AAAA,KAC9C;AAAA,IACA,WAAA,EAAa,MAAA;AAAA,IACb,OAAA,EAAS,MAAM,OAAA,IAAW;AAAA,GAC5B;AACF;;;ACjEO,SAAS,eAAe,MAAA,EAAkC;AAC/D,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAA,CAAO,CAAC,GAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,MAAM,CAAA;AACjB,IAAA,MAAA,IAAU,CAAA,CAAE,MAAA;AAAA,EACd;AACA,EAAA,OAAO,GAAA;AACT;;;ACQA,SAAS,MAAA,CAAO,OAAmB,KAAA,EAAuB;AACxD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAK,CAAA;AACzB,EAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,KAAK,CAAA,CAAE,CAAA;AACzF,EAAA,OAAO,KAAA;AACT;AAGA,IAAM,SAAA,GAAY,EAAA;AAEX,SAAS,UAAA,CAAW,KAAA,EAAmB,MAAA,GAAS,CAAA,EAAG,QAAQ,CAAA,EAAY;AAC5E,EAAA,IAAI,KAAA,GAAQ,SAAA,EAAW,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAC7E,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AAClC,EAAA,MAAM,QAAQ,KAAA,IAAS,CAAA;AACvB,EAAA,MAAM,OAAO,KAAA,GAAQ,EAAA;AACrB,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA;AAEnB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AACb,IAAA,QAAA,GAAW,IAAA;AAAA,EACb,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAW,MAAA,CAAO,OAAO,GAAG,CAAA;AAC5B,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GAAY,MAAA,CAAO,OAAO,GAAG,CAAA,IAAK,IAAK,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5D,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAA,IAAW,SAAS,EAAA,EAAI;AACtB,IAAA,QAAA,GACE,MAAA,CAAO,OAAO,GAAG,CAAA,GAAI,YACpB,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,OAC1B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA,IAAK,KAC3B,MAAA,CAAO,KAAA,EAAO,MAAM,CAAC,CAAA;AACvB,IAAA,GAAA,IAAO,CAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mDAAA,EAAsD,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/E;AAEA,EAAA,QAAQ,KAAA;AAAO,IACb,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACjD,KAAK,CAAA;AACH,MAAA,OAAO,EAAE,KAAA,EAAO,EAAA,GAAK,QAAA,EAAU,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACtD,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,OAAO,KAAA,CAAM,KAAA,CAAM,KAAK,GAAG,CAAA,EAAG,MAAA,EAAQ,GAAA,GAAM,MAAA,EAAO;AAAA,IAC9D;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,MAAM,GAAA,GAAM,QAAA;AAClB,MAAA,IAAI,MAAM,KAAA,CAAM,MAAA,EAAQ,MAAM,IAAI,MAAM,iCAAiC,CAAA;AACzE,MAAA,OAAO,EAAE,KAAA,EAAO,IAAI,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,GAAA,EAAK,GAAG,CAAC,CAAA,EAAG,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,IACxF;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,QAAqB,EAAC;AAC5B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,IAAA,GAAO,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAChD,QAAA,KAAA,CAAM,IAAA,CAAK,KAAK,KAAK,CAAA;AACrB,QAAA,MAAA,IAAU,IAAA,CAAK,MAAA;AAAA,MACjB;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IACjD;AAAA,IACA,KAAK,CAAA,EAAG;AAEN,MAAA,MAAM,GAAA,uBAAmB,GAAA,EAAI;AAC7B,MAAA,IAAI,MAAA,GAAS,GAAA;AACb,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,EAAU,KAAK,CAAA,EAAG;AACpC,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAC/C,QAAA,MAAA,IAAU,GAAA,CAAI,MAAA;AACd,QAAA,IAAI,OAAO,GAAA,CAAI,KAAA,KAAU,YAAY,OAAO,GAAA,CAAI,UAAU,QAAA,EAAU;AAClE,UAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,QAClD;AACA,QAAA,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AACtB,UAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,QAC3D;AACA,QAAA,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,GAAA,CAAI,KAAK,CAAA;AAAA,MAC9B;AACA,MAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,MAAA,EAAQ,SAAS,MAAA,EAAO;AAAA,IAC/C;AAAA,IACA;AACE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AAAA;AAE7D;AAEO,SAAS,gBAAgB,KAAA,EAA8B;AAC5D,EAAA,OAAO,UAAA,CAAW,KAAA,EAAO,CAAC,CAAA,CAAE,KAAA;AAC9B;;;AC3EA,IAAM,UAAA,GAAa,EAAA;AAGZ,SAAS,uBAAuB,QAAA,EAA+C;AACpF,EAAA,IAAI,QAAA,CAAS,SAAS,UAAA,EAAY;AAChC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,0BAAA,EAA6B,UAAU,CAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,QAAA,CAAS,QAAA,CAAS,QAAQ,QAAA,CAAS,UAAA,EAAY,SAAS,UAAU,CAAA;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACrC,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,EAAE,CAAA,IAAK,CAAA;AAC7B,EAAA,MAAM,KAAA,GAAgC;AAAA,IACpC,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,CAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,EAAA,MAAU,CAAA;AAAA,IACtB,EAAA,EAAA,CAAK,OAAO,GAAA,MAAU,CAAA;AAAA,IACtB;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAE1C,EAAA,MAAM,MAAA,GAAkC,EAAE,QAAA,EAAU,KAAA,EAAO,SAAA,EAAU;AAErE,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,IAAI,QAAA,CAAS,SAAS,EAAA,EAAI;AACxB,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,MAAA,GAAS,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,EAAA,EAAI,KAAK,CAAA;AAC7C,IAAA,MAAM,YAAY,EAAA,GAAK,YAAA;AACvB,IAAA,IAAI,QAAA,CAAS,SAAS,SAAA,EAAW;AAC/B,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAA,CAAO,YAAA,GAAe,QAAA,CAAS,KAAA,CAAM,EAAA,EAAI,SAAS,CAAA;AAGlD,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACrC,IAAA,MAAA,CAAO,mBAAA,GAAsB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;;;AC5EA,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,MAAA,GAAS,EAAA;AACf,IAAM,MAAA,GAAS,EAAA;AAEf,IAAM,OAAA,GAAU,CAAA;AAChB,IAAM,QAAA,GAAW,CAAA;AAOV,SAAS,cAAc,OAAA,EAAiC;AAC7D,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,gBAAgB,OAAO,CAAA;AAAA,EACnC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAAA,EACtF;AACA,EAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,4BAA4B,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,GAAA,GAAM,OAAA;AACZ,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AAC5B,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAI,QAAA,CAAS,qBAAA,EAAuB,YAAY,MAAA,CAAO,GAAG,CAAC,CAAA,kBAAA,CAAoB,CAAA;AAAA,EACvF;AACA,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,KAAM,OAAA,EAAS;AACjC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA,YAAY,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAC,CAAA,eAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,KAAM,QAAA,EAAU;AAClC,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA,YAAY,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAC,CAAC,CAAA,iBAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAA;AACxB,EAAA,IAAI,EAAE,CAAA,YAAa,UAAA,CAAA,IAAe,CAAA,CAAE,WAAW,EAAA,EAAI;AACjD,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAuC,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,EAAE,CAAA,YAAa,UAAA,CAAA,IAAe,CAAA,CAAE,WAAW,EAAA,EAAI;AACjD,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAuC,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,IAAA,GAAO,YAAY,IAAI,UAAA,CAAW,CAAC,CAAI,CAAC,CAAA,EAAG,CAAA,EAAG,CAAC,CAAA;AAErD,EAAA,IAAI;AACF,IAAAA,SAAA,CAAK,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,uCAAA,EAAyC,EAAE,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,6BAA6B,QAAA,EAAkC;AAC7E,EAAA,MAAM,MAAA,GAAS,uBAAuB,QAAQ,CAAA;AAC9C,EAAA,IAAI,CAAC,OAAO,mBAAA,EAAqB;AAC/B,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,aAAA,CAAc,OAAO,mBAAmB,CAAA;AACjD;AAGO,SAAS,sCAAsC,iBAAA,EAA2C;AAC/F,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,gBAAgB,iBAAiB,CAAA;AAAA,EAC7C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,yCAAA,EAA2C,EAAE,OAAO,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,qCAAqC,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,QAAA,GAAY,OAAA,CAAoB,GAAA,CAAI,UAAU,CAAA;AACpD,EAAA,IAAI,EAAE,oBAAoB,UAAA,CAAA,EAAa;AACrC,IAAA,MAAM,IAAI,QAAA,CAAS,oBAAA,EAAsB,+CAA+C,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,6BAA6B,QAAQ,CAAA;AAC9C;;;ACzFO,SAAS,YAAY,MAAA,EAAyC;AACnE,EAAA,MAAM,YAAY,UAAA,CAAW,MAAA;AAC7B,EAAA,IAAI,OAAO,SAAA,EAAW,eAAA,KAAoB,UAAA,EAAY;AACpD,IAAA,MAAM,IAAI,QAAA;AAAA,MACR,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,WAAA,CAAY,MAAM,CAAC,CAAA;AAClD,EAAA,SAAA,CAAU,gBAAgB,GAAG,CAAA;AAC7B,EAAA,OAAO,GAAA;AACT;;;ACAA,SAAS,WAAW,KAAA,EAA0B;AAC5C,EAAA,IAAI,KAAA,YAAiB,UAAU,OAAO,KAAA;AACtC,EAAA,MAAM,IAAA,GACJ,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,MAAA,IAAU,KAAA,GACpD,KAAA,CAA6B,IAAA,GAC9B,MAAA;AACN,EAAA,IAAI,SAAS,iBAAA,EAAmB;AAC9B,IAAA,OAAO,IAAI,QAAA,CAAS,gBAAA,EAAkB,qCAAqC,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC7F;AACA,EAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,yBAAA;AAGzD,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,GAAG,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,GAAK,OAAA;AAClE,EAAA,OAAO,IAAI,QAAA,CAAS,2BAAA,EAA6B,QAAQ,EAAE,KAAA,EAAO,OAAO,CAAA;AAC3E;AAGO,SAAS,qBAAA,GAAwC;AACtD,EAAA,MAAM,WAAA,GAAe,WAAyC,SAAA,EAAW,WAAA;AACzE,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,QAAA,CAAS,2BAAA,EAA6B,sCAAsC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,OAAO,OAAA,EAAgF;AAC3F,MAAA,MAAM,SAAA,GAAgD;AAAA,QACpD,SAAA,EAAW,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAAA,QAC7C,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,gBAAA,CAAiB,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA;AAAA,UACpC,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,UACnB,WAAA,EAAa,QAAQ,IAAA,CAAK;AAAA,SAC5B;AAAA,QACA,kBAAkB,OAAA,CAAQ,gBAAA;AAAA,QAC1B,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,QAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,SAAS,OAAA,CAAQ;AAAA,OACnB;AACA,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,MAAA,CAAO,EAAE,WAAW,CAAA;AAAA,MACtD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,mCAAmC,CAAA;AACzF,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,MAAM,IAAI,OAAA,EAAyD;AACjE,MAAA,MAAM,SAAA,GAA+C;AAAA,QACnD,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,SAAA,EAAW,QAAQ,SAAA,GAAY,IAAI,WAAW,OAAA,CAAQ,SAAS,CAAA,GAAI,WAAA,CAAY,EAAE,CAAA;AAAA,QACjF,mBAAmB,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA,CAAI,CAAC,EAAA,MAAQ;AAAA,UAC9D,IAAA,EAAM,YAAA;AAAA,UACN,EAAA,EAAI,iBAAiB,EAAE;AAAA,SACzB,CAAE,CAAA;AAAA,QACF,kBAAkB,OAAA,CAAQ;AAAA,OAC5B;AACA,MAAA,MAAM,OAAA,GAAoC,EAAE,SAAA,EAAU;AACtD,MAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,MAAA,IAAI,UAAA;AACJ,MAAA,IAAI;AACF,QAAA,UAAA,GAAc,MAAM,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MAC7C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,WAAW,KAAK,CAAA;AAAA,MACxB;AACA,MAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,QAAA,CAAS,kBAAkB,yBAAyB,CAAA;AAC/E,MAAA,MAAM,WAAW,UAAA,CAAW,QAAA;AAC5B,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,KAAA,EAAO,IAAI,UAAA,CAAW,UAAA,CAAW,KAAK,CAAA;AAAA,QACtC,iBAAA,EAAmB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AAAA,QAC5D,cAAA,EAAgB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAAA,QACtD,SAAA,EAAW,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS;AAAA,OAC9C;AAAA,IACF;AAAA,GACF;AACF;AAGO,SAAS,wBAAA,GAA8C;AAC5D,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAyB,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA;AAC7D,EAAA,MAAM,KAAM,UAAA,CAA0C,YAAA;AACtD,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,OAAO;AAAA,MACL,KAAK,CAAC,IAAA,KAAS,GAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,MACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,QAAA,EAAA,CAAG,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,YAAY,CAAA;AAAA,MACpC;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AAAA,IACnC,GAAA,EAAK,CAAC,IAAA,EAAM,YAAA,KAAiB;AAC3B,MAAA,MAAA,CAAO,GAAA,CAAI,MAAM,YAAY,CAAA;AAAA,IAC/B;AAAA,GACF;AACF;;;AC7EA,eAAsB,gBAAgB,OAAA,EAA6D;AACjG,EAAA,oBAAA,CAAqB,QAAQ,cAAc,CAAA;AAC3C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,qBAAA,EAAsB;AAE3D,EAAA,MAAM,kBAAkB,kBAAA,CAAmB;AAAA,IACzC,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA,EAAW,OAAA,CAAQ,SAAA,IAAa,WAAA,CAAY,EAAE,CAAA;AAAA,IAC9C,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,kBAAkB,OAAA,CAAQ;AAAA,GAC3B,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,MAAA,CAAO,eAAe,CAAA;AAExD,EAAA,MAAM,SAAA,GAAY,qCAAA,CAAsC,UAAA,CAAW,iBAAiB,CAAA;AACpF,EAAA,OAAO,EAAE,YAAA,EAAc,UAAA,CAAW,EAAA,EAAI,SAAA,EAAU;AAClD;AAOA,eAAsB,cAAc,OAAA,EAA2D;AAC7F,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,wBAAA,EAAyB;AAC5D,EAAA,MAAM,EAAE,YAAA,EAAc,SAAA,EAAU,GAAI,MAAM,gBAAgB,OAAO,CAAA;AACjE,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAA,CAAQ,SAAS,MAAA,CAAO,EAAE,SAAA,EAAW,YAAA,EAAc,CAAA;AAChF,EAAA,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,YAAY,CAAA;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,SAAA,EAAU;AAC/C;;;ACvDO,SAAS,gBAAgB,SAAA,EAA+B;AAC7D,EAAA,OAAO,iBAAiB,SAAS,CAAA;AACnC;;;ACdA,SAAS,0BAAA,CACP,QAAA,EACA,IAAA,EACA,iBAAA,EACQ;AACR,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAUC,kBAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA,CAAE,WAAA,EAAY;AAAA,EACrD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,SAAS,sBAAA,EAAwB,CAAA,0BAAA,EAA6B,QAAQ,CAAA,CAAA,CAAA,EAAK,EAAE,OAAO,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,QAAA,GAAWC,eAAI,cAAA,CAAe,sBAAA;AAAA,IAClC,IAAIA,eAAI,wBAAA,CAAyB;AAAA,MAC/B,SAAA,EAAWC,eAAA,CAAK,MAAA,CAAO,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC9C,kBAAA,EAAoBD,eAAI,kBAAA,CAAmB,6BAAA;AAAA,QACzC,IAAIA,eAAI,6BAAA,CAA8B;AAAA,UACpC,OAAA;AAAA,UACA,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,IAAI;AAAA,SACvB;AAAA;AACH,KACD;AAAA,GACH;AACA,EAAA,OAAOE,kBAAO,cAAA,CAAeD,eAAA,CAAK,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACrD;AAkBO,SAAS,qBAAqB,OAAA,EAA8C;AACjF,EAAA,MAAM,EAAE,iBAAA,EAAmB,YAAA,EAAc,iBAAA,EAAkB,GAAI,OAAA;AAC/D,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,2CAA2C,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,0BAAA;AAAA,IACL,iBAAA;AAAA,IACAA,eAAA,CAAK,MAAA,CAAO,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA;AAAA,IAC9B;AAAA,GACF;AACF;AAyBO,SAAS,yBAAyB,OAAA,EAAkD;AACzF,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA;AAChD,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,QAAA,CAAS,sBAAA,EAAwB,+CAA+C,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,2BAA2B,OAAA,CAAQ,QAAA,EAAUE,cAAO,GAAG,CAAA,EAAG,QAAQ,iBAAiB,CAAA;AAC5F","file":"create.cjs","sourcesContent":["/**\n * The frozen taxonomy of error codes the SDK can throw. This union is\n * deliberately closed — every failure path maps to exactly one of these.\n */\nexport const KIT_ERROR_CODES = Object.freeze([\n  'USER_CANCELLED',\n  'ES256_NOT_SUPPORTED',\n  'RP_ID_MISMATCH',\n  'ORIGIN_MISMATCH',\n  'CHALLENGE_MISMATCH',\n  'INVALID_SIGNATURE_DER',\n  'INVALID_PUBLIC_KEY',\n  'CONTRACT_AUTH_FAILED',\n  'NETWORK_ERROR',\n  'UNSUPPORTED_AUTHENTICATOR',\n] as const);\n\nexport type KitErrorCode = (typeof KIT_ERROR_CODES)[number];\n\n/** Structured error carrying a machine-readable {@link KitErrorCode}. */\nexport class KitError extends Error {\n  readonly code: KitErrorCode;\n  override readonly name = 'KitError';\n\n  constructor(code: KitErrorCode, message?: string, options?: { cause?: unknown }) {\n    super(message ?? code, options);\n    this.code = code;\n    // Restore the prototype chain so `instanceof KitError` works after\n    // down-level transpilation to CJS.\n    Object.setPrototypeOf(this, KitError.prototype);\n  }\n}\n\nexport function isKitError(value: unknown): value is KitError {\n  return value instanceof KitError;\n}\n","import { KitError } from './errors';\n\n/**\n * Stable identifiers for the three battle-tested anchors (S04 / YK-430) — the\n * bugs that silently break ~50% of users. Referenced by stable name from the\n * threat model (S14) and the compatibility matrix (S09) so each mitigation has\n * one canonical id across code and docs.\n */\nexport const BATTLE_TESTED_ANCHORS = Object.freeze({\n  /** Apple Touch ID/Face ID emit high-S ~50% of the time; we normalize to low-S. */\n  LOW_S_NORMALIZATION: 'low-s-normalization',\n  /** Non-ES256 credentials (e.g. some Windows Hello configs) cannot verify on-chain. */\n  RS256_HARD_FAIL: 'rs256-hard-fail',\n  /** Safari requires create/get inside a user activation or it silently rejects. */\n  APPLE_USER_GESTURE: 'apple-user-gesture',\n} as const);\n\nexport type BattleTestedAnchor = (typeof BATTLE_TESTED_ANCHORS)[keyof typeof BATTLE_TESTED_ANCHORS];\n\n/** COSE algorithm id for ES256 (ECDSA w/ SHA-256 over P-256). */\nconst ALG_ES256 = -7;\n\n/**\n * Anchor `RS256_HARD_FAIL`. The Soroban webauthn-wallet verifies *only*\n * secp256r1, so a non-ES256 credential would produce an unusable account.\n * Hard-fail rather than continue (invariant #1).\n */\nexport function assertES256(alg: number): void {\n  if (alg !== ALG_ES256) {\n    throw new KitError('ES256_NOT_SUPPORTED', `COSE alg ${alg} is not ES256 (-7)`);\n  }\n}\n\ninterface UserActivationLike {\n  isActive: boolean;\n}\n\n/**\n * Anchor `APPLE_USER_GESTURE`. `navigator.credentials.create/get` on\n * Safari/WebKit must run inside a transient user activation (a real click/tap)\n * or the promise silently rejects. Call this at the very top of a create/sign\n * handler.\n *\n * UI pattern (for S18): never auto-trigger the ceremony from a mount/effect —\n * always gate it behind an explicit user click, and surface `USER_CANCELLED`\n * in the flow state machine. Lenient when `navigator.userActivation` is\n * unavailable (non-browser / older engines) so the SDK stays isomorphic; pass\n * an explicit `{ isActive }` to force the check.\n */\nexport function assertUserActivation(activation?: UserActivationLike): void {\n  const ua =\n    activation ??\n    (globalThis.navigator as { userActivation?: UserActivationLike } | undefined)?.userActivation;\n  if (ua && !ua.isActive) {\n    throw new KitError(\n      'USER_CANCELLED',\n      'WebAuthn ceremony must be invoked inside a user activation (click/tap)',\n    );\n  }\n}\n","/**\n * Isomorphic base64url + UTF-8 codecs. `atob`/`btoa`/`TextEncoder`/`TextDecoder`\n * are globals in modern browsers and Node >= 16, so no platform branch is\n * needed and nothing is bundled.\n */\n\n/** Encode bytes as unpadded base64url. */\nexport function bytesToBase64Url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode base64 or base64url (padding optional) to bytes. */\nexport function base64UrlToBytes(input: string): Uint8Array<ArrayBuffer> {\n  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\n\nexport function utf8ToBytes(text: string): Uint8Array {\n  return new TextEncoder().encode(text);\n}\n\nexport function bytesToUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n","import { bytesToBase64Url } from '../internal/encoding';\nimport { utf8ToBytes } from '../internal/encoding';\n\nexport type ResidentKeyRequirement = 'discouraged' | 'preferred' | 'required';\nexport type UserVerificationRequirement = 'discouraged' | 'preferred' | 'required';\n\nexport interface BuildCreateOptionsInput {\n  rpId: string;\n  rpName: string;\n  userName: string;\n  /** Stable, opaque user handle. Defaults to UTF-8 bytes of `userName`. */\n  userId?: Uint8Array;\n  userDisplayName?: string;\n  /** Raw challenge bytes (base64url-encoded into the options). */\n  challenge: Uint8Array;\n  residentKey?: ResidentKeyRequirement;\n  userVerification?: UserVerificationRequirement;\n  timeout?: number;\n}\n\n/** ES256-only credential parameter. The `alg: -7` literal is non-negotiable. */\nexport interface PubKeyCredParam {\n  type: 'public-key';\n  alg: -7;\n}\n\nexport interface PublicKeyCredentialCreationOptionsJSON {\n  rp: { id: string; name: string };\n  user: { id: string; name: string; displayName: string };\n  challenge: string;\n  pubKeyCredParams: PubKeyCredParam[];\n  authenticatorSelection: {\n    residentKey: ResidentKeyRequirement;\n    requireResidentKey: boolean;\n    userVerification: UserVerificationRequirement;\n  };\n  attestation: 'none';\n  timeout: number;\n}\n\n/**\n * Build WebAuthn registration options that offer ES256 *and only* ES256\n * (`pubKeyCredParams: [{ type: 'public-key', alg: -7 }]`) — invariant #1.\n * Soroban verifies only secp256r1, so we never advertise any other algorithm.\n */\nexport function buildCreateOptions(\n  input: BuildCreateOptionsInput,\n): PublicKeyCredentialCreationOptionsJSON {\n  const residentKey = input.residentKey ?? 'required';\n  return {\n    rp: { id: input.rpId, name: input.rpName },\n    user: {\n      id: bytesToBase64Url(input.userId ?? utf8ToBytes(input.userName)),\n      name: input.userName,\n      displayName: input.userDisplayName ?? input.userName,\n    },\n    challenge: bytesToBase64Url(input.challenge),\n    pubKeyCredParams: [{ type: 'public-key', alg: -7 }],\n    authenticatorSelection: {\n      residentKey,\n      requireResidentKey: residentKey === 'required',\n      userVerification: input.userVerification ?? 'preferred',\n    },\n    attestation: 'none',\n    timeout: input.timeout ?? 60_000,\n  };\n}\n","/** Concatenate byte arrays into one. */\nexport function concatBytes(...arrays: Uint8Array[]): Uint8Array {\n  const total = arrays.reduce((n, a) => n + a.length, 0);\n  const out = new Uint8Array(total);\n  let offset = 0;\n  for (const a of arrays) {\n    out.set(a, offset);\n    offset += a.length;\n  }\n  return out;\n}\n\n/** Length-safe, constant-time-ish byte equality. */\nexport function equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);\n  return diff === 0;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let hex = '';\n  for (const byte of bytes) hex += byte.toString(16).padStart(2, '0');\n  return hex;\n}\n","/**\n * A minimal CBOR (RFC 8949) decoder — only the major types WebAuthn needs:\n * unsigned ints, negative ints, byte strings, text strings, arrays and maps,\n * with 1/2/4-byte length prefixes. Indefinite lengths, tags, floats and\n * 8-byte lengths are intentionally unsupported (COSE keys and attestation\n * objects never use them) and throw. This keeps the SDK dependency-free while\n * staying robust — it is fully fixture-tested. It replaces passkey-kit's\n * hardcoded byte-offset scanning, which had no bounds checks.\n */\nexport type CborValue = number | bigint | Uint8Array | string | CborValue[] | CborMap;\nexport type CborMap = Map<number | string, CborValue>;\n\ninterface Decoded {\n  value: CborValue;\n  /** Total bytes consumed starting at the requested offset. */\n  length: number;\n}\n\nfunction byteAt(bytes: Uint8Array, index: number): number {\n  const value = bytes[index];\n  if (value === undefined) throw new Error(`CBOR: unexpected end of input at byte ${index}`);\n  return value;\n}\n\n/** Decode the first CBOR item at `offset`, returning its value and byte length. */\nconst MAX_DEPTH = 16; // COSE keys / attestation objects nest at most ~3 levels.\n\nexport function decodeCbor(bytes: Uint8Array, offset = 0, depth = 0): Decoded {\n  if (depth > MAX_DEPTH) throw new Error('CBOR: maximum nesting depth exceeded');\n  const first = byteAt(bytes, offset);\n  const major = first >> 5;\n  const info = first & 0x1f;\n  let pos = offset + 1;\n\n  let argument: number;\n  if (info < 24) {\n    argument = info;\n  } else if (info === 24) {\n    argument = byteAt(bytes, pos);\n    pos += 1;\n  } else if (info === 25) {\n    argument = (byteAt(bytes, pos) << 8) | byteAt(bytes, pos + 1);\n    pos += 2;\n  } else if (info === 26) {\n    argument =\n      byteAt(bytes, pos) * 0x1000000 +\n      (byteAt(bytes, pos + 1) << 16) +\n      (byteAt(bytes, pos + 2) << 8) +\n      byteAt(bytes, pos + 3);\n    pos += 4;\n  } else {\n    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);\n  }\n\n  switch (major) {\n    case 0: // unsigned integer\n      return { value: argument, length: pos - offset };\n    case 1: // negative integer\n      return { value: -1 - argument, length: pos - offset };\n    case 2: {\n      // byte string\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: byte string exceeds input');\n      return { value: bytes.slice(pos, end), length: end - offset };\n    }\n    case 3: {\n      // text string (UTF-8)\n      const end = pos + argument;\n      if (end > bytes.length) throw new Error('CBOR: text string exceeds input');\n      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };\n    }\n    case 4: {\n      // array\n      const items: CborValue[] = [];\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const item = decodeCbor(bytes, cursor, depth + 1);\n        items.push(item.value);\n        cursor += item.length;\n      }\n      return { value: items, length: cursor - offset };\n    }\n    case 5: {\n      // map\n      const map: CborMap = new Map();\n      let cursor = pos;\n      for (let i = 0; i < argument; i += 1) {\n        const key = decodeCbor(bytes, cursor, depth + 1);\n        cursor += key.length;\n        const val = decodeCbor(bytes, cursor, depth + 1);\n        cursor += val.length;\n        if (typeof key.value !== 'number' && typeof key.value !== 'string') {\n          throw new Error('CBOR: unsupported map key type');\n        }\n        if (map.has(key.value)) {\n          throw new Error('CBOR: duplicate map key (non-canonical)');\n        }\n        map.set(key.value, val.value);\n      }\n      return { value: map, length: cursor - offset };\n    }\n    default:\n      throw new Error(`CBOR: unsupported major type ${major}`);\n  }\n}\n\nexport function decodeCborFirst(bytes: Uint8Array): CborValue {\n  return decodeCbor(bytes, 0).value;\n}\n","import { KitError } from '../errors';\nimport { decodeCbor } from '../internal/cbor';\nimport { sha256 } from '../internal/sha256';\nimport { equalBytes } from '../internal/bytes';\nimport { utf8ToBytes } from '../internal/encoding';\n\nexport interface AuthenticatorDataFlags {\n  /** User Present */\n  up: boolean;\n  /** User Verified */\n  uv: boolean;\n  /** Backup Eligible */\n  be: boolean;\n  /** Backup State */\n  bs: boolean;\n  /** Attested credential data present */\n  at: boolean;\n  /** Extension data present */\n  ed: boolean;\n  /** Raw flags byte. */\n  bits: number;\n}\n\nexport interface ParsedAuthenticatorData {\n  rpIdHash: Uint8Array;\n  flags: AuthenticatorDataFlags;\n  signCount: number;\n  aaguid?: Uint8Array;\n  credentialId?: Uint8Array;\n  /** Raw CBOR-encoded COSE public key (exact bytes), if attested data present. */\n  credentialPublicKey?: Uint8Array;\n}\n\nconst MIN_LENGTH = 37; // rpIdHash(32) + flags(1) + signCount(4)\n\n/** Parse the authenticatorData byte structure (WebAuthn §6.1). */\nexport function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData {\n  if (authData.length < MIN_LENGTH) {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`,\n    );\n  }\n  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);\n  const rpIdHash = authData.slice(0, 32);\n  const bits = authData[32] ?? 0;\n  const flags: AuthenticatorDataFlags = {\n    up: (bits & 0x01) !== 0,\n    uv: (bits & 0x04) !== 0,\n    be: (bits & 0x08) !== 0,\n    bs: (bits & 0x10) !== 0,\n    at: (bits & 0x40) !== 0,\n    ed: (bits & 0x80) !== 0,\n    bits,\n  };\n  const signCount = view.getUint32(33, false);\n\n  const result: ParsedAuthenticatorData = { rpIdHash, flags, signCount };\n\n  if (flags.at) {\n    if (authData.length < 55) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in attested data',\n      );\n    }\n    result.aaguid = authData.slice(37, 53);\n    const credIdLength = view.getUint16(53, false);\n    const credIdEnd = 55 + credIdLength;\n    if (authData.length < credIdEnd) {\n      throw new KitError(\n        'UNSUPPORTED_AUTHENTICATOR',\n        'authenticatorData truncated in credentialId',\n      );\n    }\n    result.credentialId = authData.slice(55, credIdEnd);\n    // The COSE public key is the next CBOR item; capture its exact bytes so we\n    // stop cleanly before any extension data (when flags.ed is set).\n    const rest = authData.slice(credIdEnd);\n    const { length } = decodeCbor(rest, 0);\n    result.credentialPublicKey = rest.slice(0, length);\n  }\n\n  return result;\n}\n\n/** Verify that authenticatorData's rpIdHash equals SHA-256(rpId). */\nexport function verifyRpIdHash(authData: Uint8Array, rpId: string): void {\n  const actual = parseAuthenticatorData(authData).rpIdHash;\n  const expected = sha256(utf8ToBytes(rpId));\n  if (!equalBytes(actual, expected)) {\n    throw new KitError(\n      'RP_ID_MISMATCH',\n      `authenticatorData rpIdHash does not match SHA-256(\"${rpId}\")`,\n    );\n  }\n}\n","import { p256 } from '@noble/curves/nist';\nimport { KitError } from '../errors';\nimport { concatBytes } from '../internal/bytes';\nimport { decodeCborFirst, type CborMap } from '../internal/cbor';\nimport { parseAuthenticatorData } from './authData';\nimport { assertES256 } from '../anchors';\n\n// COSE key common parameters (RFC 9052) and EC2 key parameters.\nconst COSE_KTY = 1;\nconst COSE_ALG = 3;\nconst COSE_CRV = -1;\nconst COSE_X = -2;\nconst COSE_Y = -3;\n\nconst KTY_EC2 = 2;\nconst CRV_P256 = 1;\n\n/**\n * Convert a CBOR-encoded COSE EC2 public key to the 65-byte SEC-1 uncompressed\n * point `0x04 ‖ X ‖ Y`. Enforces ES256/P-256 — anything else (e.g. RS256)\n * throws `ES256_NOT_SUPPORTED` (invariant #1).\n */\nexport function coseKeyToSec1(coseKey: Uint8Array): Uint8Array {\n  let decoded: ReturnType<typeof decodeCborFirst>;\n  try {\n    decoded = decodeCborFirst(coseKey);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'failed to CBOR-decode COSE key', { cause });\n  }\n  if (!(decoded instanceof Map)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key is not a CBOR map');\n  }\n  const map = decoded as CborMap;\n  const alg = map.get(COSE_ALG);\n  if (typeof alg !== 'number') {\n    throw new KitError('ES256_NOT_SUPPORTED', `COSE alg ${String(alg)} is not ES256 (-7)`);\n  }\n  assertES256(alg); // anchor RS256_HARD_FAIL\n  if (map.get(COSE_KTY) !== KTY_EC2) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      `COSE kty ${String(map.get(COSE_KTY))} is not EC2 (2)`,\n    );\n  }\n  if (map.get(COSE_CRV) !== CRV_P256) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      `COSE crv ${String(map.get(COSE_CRV))} is not P-256 (1)`,\n    );\n  }\n  const x = map.get(COSE_X);\n  const y = map.get(COSE_Y);\n  if (!(x instanceof Uint8Array) || x.length !== 32) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key X coordinate is not 32 bytes');\n  }\n  if (!(y instanceof Uint8Array) || y.length !== 32) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'COSE key Y coordinate is not 32 bytes');\n  }\n  const sec1 = concatBytes(new Uint8Array([0x04]), x, y);\n  // Reject off-curve / invalid points so an invalid key can never be persisted.\n  try {\n    p256.Point.fromHex(sec1);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'public key is not a valid P-256 point', { cause });\n  }\n  return sec1;\n}\n\n/** Extract the SEC-1 public key from raw authenticatorData (attested data). */\nexport function extractPublicKeyFromAuthData(authData: Uint8Array): Uint8Array {\n  const parsed = parseAuthenticatorData(authData);\n  if (!parsed.credentialPublicKey) {\n    throw new KitError(\n      'INVALID_PUBLIC_KEY',\n      'authenticatorData has no attested credential public key',\n    );\n  }\n  return coseKeyToSec1(parsed.credentialPublicKey);\n}\n\n/** Extract the SEC-1 public key from a CBOR attestationObject (create ceremony). */\nexport function extractPublicKeyFromAttestationObject(attestationObject: Uint8Array): Uint8Array {\n  let decoded: ReturnType<typeof decodeCborFirst>;\n  try {\n    decoded = decodeCborFirst(attestationObject);\n  } catch (cause) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'failed to CBOR-decode attestationObject', { cause });\n  }\n  if (!(decoded instanceof Map)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'attestationObject is not a CBOR map');\n  }\n  const authData = (decoded as CborMap).get('authData');\n  if (!(authData instanceof Uint8Array)) {\n    throw new KitError('INVALID_PUBLIC_KEY', 'attestationObject has no authData byte string');\n  }\n  return extractPublicKeyFromAuthData(authData);\n}\n","import { KitError } from '../errors';\n\n/**\n * Cryptographically-random bytes, isomorphic (browser + Node global crypto).\n * Throws instead of silently returning all-zero bytes when no secure RNG is\n * present — an all-zero challenge would be catastrophic, not a soft fallback.\n */\nexport function randomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const webcrypto = globalThis.crypto as Crypto | undefined;\n  if (typeof webcrypto?.getRandomValues !== 'function') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      'no secure random source (globalThis.crypto.getRandomValues) is available in this environment',\n    );\n  }\n  const out = new Uint8Array(new ArrayBuffer(length));\n  webcrypto.getRandomValues(out);\n  return out;\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes } from '../internal/encoding';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '../webauthn/createOptions';\nimport { randomBytes } from './random';\nimport type {\n  CredentialStorage,\n  WebAuthnClient,\n  WebAuthnCreateResult,\n  WebAuthnGetOptions,\n  WebAuthnGetResult,\n} from './types';\n\n/**\n * Map a `navigator.credentials` rejection to a `KitError`. Dismissing the OS\n * passkey sheet rejects with a `NotAllowedError` (a DOMException) — surface that\n * as `USER_CANCELLED` so the UI shows the true \"you cancelled\" copy instead of\n * the generic unsupported-authenticator fallback (S20 / S04 polish).\n */\nfunction asKitError(error: unknown): KitError {\n  if (error instanceof KitError) return error;\n  const name =\n    typeof error === 'object' && error !== null && 'name' in error\n      ? (error as { name?: unknown }).name\n      : undefined;\n  if (name === 'NotAllowedError') {\n    return new KitError('USER_CANCELLED', 'The passkey prompt was dismissed.', { cause: error });\n  }\n  const message = error instanceof Error ? error.message : 'WebAuthn request failed';\n  // Preserve the original DOMException name (e.g. InvalidStateError / ConstraintError)\n  // in the message so diagnostics show the true cause, not just the generic bucket.\n  const detail = typeof name === 'string' ? `${name}: ${message}` : message;\n  return new KitError('UNSUPPORTED_AUTHENTICATOR', detail, { cause: error });\n}\n\n/** The browser `WebAuthnClient` backed by `navigator.credentials`. */\nexport function browserWebAuthnClient(): WebAuthnClient {\n  const credentials = (globalThis as { navigator?: Navigator }).navigator?.credentials;\n  if (!credentials) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'navigator.credentials is unavailable');\n  }\n  return {\n    async create(options: PublicKeyCredentialCreationOptionsJSON): Promise<WebAuthnCreateResult> {\n      const publicKey: PublicKeyCredentialCreationOptions = {\n        challenge: base64UrlToBytes(options.challenge),\n        rp: options.rp,\n        user: {\n          id: base64UrlToBytes(options.user.id),\n          name: options.user.name,\n          displayName: options.user.displayName,\n        },\n        pubKeyCredParams: options.pubKeyCredParams,\n        authenticatorSelection: options.authenticatorSelection,\n        attestation: options.attestation,\n        timeout: options.timeout,\n      };\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.create({ publicKey })) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'credential creation returned null');\n      const response = credential.response as AuthenticatorAttestationResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        attestationObject: new Uint8Array(response.attestationObject),\n      };\n    },\n    async get(options: WebAuthnGetOptions): Promise<WebAuthnGetResult> {\n      const publicKey: PublicKeyCredentialRequestOptions = {\n        rpId: options.rpId,\n        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),\n        allowCredentials: (options.allowCredentials ?? []).map((id) => ({\n          type: 'public-key',\n          id: base64UrlToBytes(id),\n        })),\n        userVerification: options.userVerification,\n      };\n      const request: CredentialRequestOptions = { publicKey };\n      if (options.mediation) request.mediation = options.mediation;\n      let credential: PublicKeyCredential | null;\n      try {\n        credential = (await credentials.get(request)) as PublicKeyCredential | null;\n      } catch (error) {\n        throw asKitError(error);\n      }\n      if (!credential) throw new KitError('USER_CANCELLED', 'assertion returned null');\n      const response = credential.response as AuthenticatorAssertionResponse;\n      return {\n        id: credential.id,\n        rawId: new Uint8Array(credential.rawId),\n        authenticatorData: new Uint8Array(response.authenticatorData),\n        clientDataJSON: new Uint8Array(response.clientDataJSON),\n        signature: new Uint8Array(response.signature),\n      };\n    },\n  };\n}\n\n/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */\nexport function defaultCredentialStorage(): CredentialStorage {\n  const key = (rpId: string): string => `stellar-passkey:${rpId}`;\n  const ls = (globalThis as { localStorage?: Storage }).localStorage;\n  if (ls) {\n    return {\n      get: (rpId) => ls.getItem(key(rpId)),\n      set: (rpId, credentialId) => {\n        ls.setItem(key(rpId), credentialId);\n      },\n    };\n  }\n  const memory = new Map<string, string>();\n  return {\n    get: (rpId) => memory.get(rpId) ?? null,\n    set: (rpId, credentialId) => {\n      memory.set(rpId, credentialId);\n    },\n  };\n}\n","import { assertUserActivation } from '../anchors';\nimport { buildCreateOptions } from '../webauthn/createOptions';\nimport { extractPublicKeyFromAttestationObject } from '../webauthn/publicKey';\nimport type { PasskeyCredential } from '../types';\nimport { browserWebAuthnClient, defaultCredentialStorage } from './browserClient';\nimport { randomBytes } from './random';\nimport type { AccountDeployer, CredentialStorage, WebAuthnClient } from './types';\n\nexport interface CreatePasskeyOptions {\n  rpId: string;\n  rpName: string;\n  userName: string;\n  /** Deploys the smart account for the new passkey (contract-specific; see AccountDeployer). */\n  deployer: AccountDeployer;\n  webauthn?: WebAuthnClient;\n  storage?: CredentialStorage;\n  userId?: Uint8Array;\n  challenge?: Uint8Array;\n  residentKey?: 'discouraged' | 'preferred' | 'required';\n  userVerification?: 'discouraged' | 'preferred' | 'required';\n  /** Pass navigator.userActivation to enforce the Safari gesture requirement (S04). */\n  userActivation?: { isActive: boolean };\n}\n\n/** Options for {@link registerPasskey} — a create WITHOUT deploy (see below). */\nexport type RegisterPasskeyOptions = Omit<CreatePasskeyOptions, 'deployer' | 'storage'>;\n\n/** A freshly-registered passkey credential (no account deployed yet). */\nexport interface RegisteredPasskey {\n  /** base64url credential id returned by the authenticator. */\n  credentialId: string;\n  /** SEC-1 uncompressed public key (65 bytes). */\n  publicKey: Uint8Array;\n}\n\n/**\n * `registerPasskey` — register an ES256-only passkey and extract its SEC-1 public\n * key (RS256 hard-fails), but do NOT deploy an account or persist anything. This\n * is the \"new device\" primitive for multi-device recovery: a fresh device\n * produces a `{credentialId, publicKey}` signer spec that an existing device then\n * authorizes on-chain via `addSigner`. (`createPasskey` is this plus a deploy.)\n */\nexport async function registerPasskey(options: RegisterPasskeyOptions): Promise<RegisteredPasskey> {\n  assertUserActivation(options.userActivation); // anchor: apple-user-gesture (S04)\n  const webauthn = options.webauthn ?? browserWebAuthnClient();\n\n  const creationOptions = buildCreateOptions({\n    rpId: options.rpId,\n    rpName: options.rpName,\n    userName: options.userName,\n    userId: options.userId,\n    challenge: options.challenge ?? randomBytes(32),\n    residentKey: options.residentKey,\n    userVerification: options.userVerification,\n  });\n\n  const credential = await webauthn.create(creationOptions);\n  // ES256-only enforcement happens here: a non-ES256 credential throws ES256_NOT_SUPPORTED.\n  const publicKey = extractPublicKeyFromAttestationObject(credential.attestationObject);\n  return { credentialId: credential.id, publicKey };\n}\n\n/**\n * `createPasskey` — register an ES256-only passkey (see {@link registerPasskey}),\n * deploy a smart account for it via the factory, persist the credential id, and\n * return the account.\n */\nexport async function createPasskey(options: CreatePasskeyOptions): Promise<PasskeyCredential> {\n  const storage = options.storage ?? defaultCredentialStorage();\n  const { credentialId, publicKey } = await registerPasskey(options);\n  const { contractId } = await options.deployer.deploy({ publicKey, credentialId });\n  storage.set(options.rpId, credentialId);\n  return { contractId, credentialId, publicKey };\n}\n","import { KitError } from '../errors';\nimport { base64UrlToBytes, bytesToBase64Url, bytesToUtf8 } from '../internal/encoding';\n\n/** The subset of clientDataJSON fields we rely on. */\nexport interface ClientData {\n  type: string;\n  /** base64url-encoded challenge as embedded by the client. */\n  challenge: string;\n  origin: string;\n  crossOrigin?: boolean;\n}\n\n/** Encode a raw challenge as the base64url string embedded in clientDataJSON. */\nexport function encodeChallenge(challenge: Uint8Array): string {\n  return bytesToBase64Url(challenge);\n}\n\n/** Decode the base64url challenge embedded in clientDataJSON back to bytes. */\nexport function decodeChallenge(challenge: string): Uint8Array {\n  return base64UrlToBytes(challenge);\n}\n\n/** Parse clientDataJSON bytes into a typed, validated-shape object. */\nexport function parseClientDataJSON(clientDataJSON: Uint8Array): ClientData {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(bytesToUtf8(clientDataJSON));\n  } catch (cause) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not valid JSON', { cause });\n  }\n  if (typeof raw !== 'object' || raw === null) {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is not a JSON object');\n  }\n  const obj = raw as Record<string, unknown>;\n  const { type, challenge, origin, crossOrigin } = obj;\n  if (typeof type !== 'string' || typeof challenge !== 'string' || typeof origin !== 'string') {\n    throw new KitError('UNSUPPORTED_AUTHENTICATOR', 'clientDataJSON is missing required fields');\n  }\n  return {\n    type,\n    challenge,\n    origin,\n    crossOrigin: typeof crossOrigin === 'boolean' ? crossOrigin : undefined,\n  };\n}\n\n/**\n * Parse and verify clientDataJSON for an authentication (`webauthn.get`)\n * assertion: the ceremony type, the origin (exact match against one or more\n * allowed origins), and the embedded challenge (base64url string).\n */\nexport function verifyClientDataJSON(\n  clientDataJSON: Uint8Array,\n  expected: { origin: string | string[]; challenge: string },\n): ClientData {\n  const data = parseClientDataJSON(clientDataJSON);\n  if (data.type !== 'webauthn.get') {\n    throw new KitError(\n      'UNSUPPORTED_AUTHENTICATOR',\n      `clientDataJSON.type \"${data.type}\" is not \"webauthn.get\"`,\n    );\n  }\n  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];\n  if (!allowed.includes(data.origin)) {\n    throw new KitError('ORIGIN_MISMATCH', `origin \"${data.origin}\" not in [${allowed.join(', ')}]`);\n  }\n  if (data.challenge !== expected.challenge) {\n    throw new KitError('CHALLENGE_MISMATCH', 'clientDataJSON challenge does not match expected');\n  }\n  return data;\n}\n","import { Address, StrKey, hash, xdr } from '@stellar/stellar-sdk';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { KitError } from '../errors';\nimport { decodeChallenge } from '../webauthn/clientData';\n\n/** The createCustomContract C-address from a deployer address + 32-byte salt (no network round-trip). */\nfunction contractIdFromDeployerSalt(\n  deployer: string,\n  salt: Uint8Array,\n  networkPassphrase: string,\n): string {\n  let address: xdr.ScAddress;\n  try {\n    address = Address.fromString(deployer).toScAddress();\n  } catch (cause) {\n    throw new KitError('CONTRACT_AUTH_FAILED', `invalid deployer address \"${deployer}\"`, { cause });\n  }\n  const preimage = xdr.HashIdPreimage.envelopeTypeContractId(\n    new xdr.HashIdPreimageContractId({\n      networkId: hash(Buffer.from(networkPassphrase)),\n      contractIdPreimage: xdr.ContractIdPreimage.contractIdPreimageFromAddress(\n        new xdr.ContractIdPreimageFromAddress({\n          address,\n          salt: Buffer.from(salt),\n        }),\n      ),\n    }),\n  );\n  return StrKey.encodeContract(hash(preimage.toXDR()));\n}\n\nexport interface DeriveAccountAddressOptions {\n  /** The AccountFactory contract C-address — the deployer. */\n  factoryContractId: string;\n  /** The credential-id bytes the factory salts by SHA-256 (utf-8 of the base64url id in our factory). */\n  credentialId: Uint8Array;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of the `webauthn-account` our AccountFactory\n * deploys for a passkey — with NO network round-trip. The factory salts by\n * `sha256(credential_id)` and deploys with `deployer().with_current_contract(salt)`.\n * Verified against the on-chain `factoryDeployProof` in `contracts/deployments.json`\n * (credential `democred` → `CAGWE36M…`). For the passkey-kit v1 smart-wallet, use\n * {@link deriveSmartWalletAddress} instead (different deployer + salt-input scheme).\n */\nexport function deriveAccountAddress(options: DeriveAccountAddressOptions): string {\n  const { factoryContractId, credentialId, networkPassphrase } = options;\n  if (credentialId.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveAccountAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(\n    factoryContractId,\n    hash(Buffer.from(credentialId)), // e.crypto().sha256(credential_id)\n    networkPassphrase,\n  );\n}\n\nexport interface DeriveSmartWalletAddressOptions {\n  /**\n   * The account that deploys the wallet via `createCustomContract` — a classic\n   * G-address (or a factory C-address). MUST be stable for offline `getAddress`.\n   */\n  deployer: string;\n  /** base64url WebAuthn credential id of the FOUNDING passkey — its RAW bytes are salted. */\n  credentialId: string;\n  networkPassphrase: string;\n}\n\n/**\n * Derive the deterministic C-address of a passkey-kit **v1 smart-wallet** — offline,\n * no network. Mirrors passkey-kit's scheme exactly: `salt = sha256(rawCredentialId)`\n * (the base64url-decoded credential-id bytes), deployed by a fixed `deployer`\n * account via `createCustomContract`. Proven on-chain (`scripts/v1-events-probe.ts`:\n * derived id === deployed id).\n *\n * This only recovers the address for the wallet's FOUNDING credential (the one used\n * as the deploy salt). Signers added later via `add_signer` do not change the\n * address and cannot be reversed into it — resolve those through the events indexer\n * ({@link smartWalletV1Indexer}).\n */\nexport function deriveSmartWalletAddress(options: DeriveSmartWalletAddressOptions): string {\n  const raw = decodeChallenge(options.credentialId);\n  if (raw.length === 0) {\n    throw new KitError('CONTRACT_AUTH_FAILED', 'deriveSmartWalletAddress: empty credential id');\n  }\n  return contractIdFromDeployerSalt(options.deployer, sha256(raw), options.networkPassphrase);\n}\n"]}

package/dist/create.d.cts

@@ -0,0 +1,106 @@
+import { P as PasskeyCredential } from './types-dMRWEEo0.cjs';
+export { d as assertES256, e as assertUserActivation } from './types-dMRWEEo0.cjs';
+import { A as AccountDeployer, W as WebAuthnClient, C as CredentialStorage } from './types--WNl-Sda.cjs';
+export { g as buildCreateOptions } from './types--WNl-Sda.cjs';
+import './checkAuth-C2AcXqFe.cjs';
+import '@stellar/stellar-sdk';
+import './sign-Cfg0NM0T.cjs';
+
+interface CreatePasskeyOptions {
+    rpId: string;
+    rpName: string;
+    userName: string;
+    /** Deploys the smart account for the new passkey (contract-specific; see AccountDeployer). */
+    deployer: AccountDeployer;
+    webauthn?: WebAuthnClient;
+    storage?: CredentialStorage;
+    userId?: Uint8Array;
+    challenge?: Uint8Array;
+    residentKey?: 'discouraged' | 'preferred' | 'required';
+    userVerification?: 'discouraged' | 'preferred' | 'required';
+    /** Pass navigator.userActivation to enforce the Safari gesture requirement (S04). */
+    userActivation?: {
+        isActive: boolean;
+    };
+}
+/** Options for {@link registerPasskey} — a create WITHOUT deploy (see below). */
+type RegisterPasskeyOptions = Omit<CreatePasskeyOptions, 'deployer' | 'storage'>;
+/** A freshly-registered passkey credential (no account deployed yet). */
+interface RegisteredPasskey {
+    /** base64url credential id returned by the authenticator. */
+    credentialId: string;
+    /** SEC-1 uncompressed public key (65 bytes). */
+    publicKey: Uint8Array;
+}
+/**
+ * `registerPasskey` — register an ES256-only passkey and extract its SEC-1 public
+ * key (RS256 hard-fails), but do NOT deploy an account or persist anything. This
+ * is the "new device" primitive for multi-device recovery: a fresh device
+ * produces a `{credentialId, publicKey}` signer spec that an existing device then
+ * authorizes on-chain via `addSigner`. (`createPasskey` is this plus a deploy.)
+ */
+declare function registerPasskey(options: RegisterPasskeyOptions): Promise<RegisteredPasskey>;
+/**
+ * `createPasskey` — register an ES256-only passkey (see {@link registerPasskey}),
+ * deploy a smart account for it via the factory, persist the credential id, and
+ * return the account.
+ */
+declare function createPasskey(options: CreatePasskeyOptions): Promise<PasskeyCredential>;
+
+/** The browser `WebAuthnClient` backed by `navigator.credentials`. */
+declare function browserWebAuthnClient(): WebAuthnClient;
+/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */
+declare function defaultCredentialStorage(): CredentialStorage;
+
+/**
+ * Convert a CBOR-encoded COSE EC2 public key to the 65-byte SEC-1 uncompressed
+ * point `0x04 ‖ X ‖ Y`. Enforces ES256/P-256 — anything else (e.g. RS256)
+ * throws `ES256_NOT_SUPPORTED` (invariant #1).
+ */
+declare function coseKeyToSec1(coseKey: Uint8Array): Uint8Array;
+/** Extract the SEC-1 public key from raw authenticatorData (attested data). */
+declare function extractPublicKeyFromAuthData(authData: Uint8Array): Uint8Array;
+/** Extract the SEC-1 public key from a CBOR attestationObject (create ceremony). */
+declare function extractPublicKeyFromAttestationObject(attestationObject: Uint8Array): Uint8Array;
+
+interface DeriveAccountAddressOptions {
+    /** The AccountFactory contract C-address — the deployer. */
+    factoryContractId: string;
+    /** The credential-id bytes the factory salts by SHA-256 (utf-8 of the base64url id in our factory). */
+    credentialId: Uint8Array;
+    networkPassphrase: string;
+}
+/**
+ * Derive the deterministic C-address of the `webauthn-account` our AccountFactory
+ * deploys for a passkey — with NO network round-trip. The factory salts by
+ * `sha256(credential_id)` and deploys with `deployer().with_current_contract(salt)`.
+ * Verified against the on-chain `factoryDeployProof` in `contracts/deployments.json`
+ * (credential `democred` → `CAGWE36M…`). For the passkey-kit v1 smart-wallet, use
+ * {@link deriveSmartWalletAddress} instead (different deployer + salt-input scheme).
+ */
+declare function deriveAccountAddress(options: DeriveAccountAddressOptions): string;
+interface DeriveSmartWalletAddressOptions {
+    /**
+     * The account that deploys the wallet via `createCustomContract` — a classic
+     * G-address (or a factory C-address). MUST be stable for offline `getAddress`.
+     */
+    deployer: string;
+    /** base64url WebAuthn credential id of the FOUNDING passkey — its RAW bytes are salted. */
+    credentialId: string;
+    networkPassphrase: string;
+}
+/**
+ * Derive the deterministic C-address of a passkey-kit **v1 smart-wallet** — offline,
+ * no network. Mirrors passkey-kit's scheme exactly: `salt = sha256(rawCredentialId)`
+ * (the base64url-decoded credential-id bytes), deployed by a fixed `deployer`
+ * account via `createCustomContract`. Proven on-chain (`scripts/v1-events-probe.ts`:
+ * derived id === deployed id).
+ *
+ * This only recovers the address for the wallet's FOUNDING credential (the one used
+ * as the deploy salt). Signers added later via `add_signer` do not change the
+ * address and cannot be reversed into it — resolve those through the events indexer
+ * ({@link smartWalletV1Indexer}).
+ */
+declare function deriveSmartWalletAddress(options: DeriveSmartWalletAddressOptions): string;
+
+export { type CreatePasskeyOptions, type DeriveAccountAddressOptions, type DeriveSmartWalletAddressOptions, type RegisterPasskeyOptions, type RegisteredPasskey, browserWebAuthnClient, coseKeyToSec1, createPasskey, defaultCredentialStorage, deriveAccountAddress, deriveSmartWalletAddress, extractPublicKeyFromAttestationObject, extractPublicKeyFromAuthData, registerPasskey };

package/dist/create.d.ts

@@ -0,0 +1,106 @@
+import { P as PasskeyCredential } from './types-lW2h8Uxn.js';
+export { d as assertES256, e as assertUserActivation } from './types-lW2h8Uxn.js';
+import { A as AccountDeployer, W as WebAuthnClient, C as CredentialStorage } from './types--WNl-Sda.js';
+export { g as buildCreateOptions } from './types--WNl-Sda.js';
+import './checkAuth-C2AcXqFe.js';
+import '@stellar/stellar-sdk';
+import './sign-Cfg0NM0T.js';
+
+interface CreatePasskeyOptions {
+    rpId: string;
+    rpName: string;
+    userName: string;
+    /** Deploys the smart account for the new passkey (contract-specific; see AccountDeployer). */
+    deployer: AccountDeployer;
+    webauthn?: WebAuthnClient;
+    storage?: CredentialStorage;
+    userId?: Uint8Array;
+    challenge?: Uint8Array;
+    residentKey?: 'discouraged' | 'preferred' | 'required';
+    userVerification?: 'discouraged' | 'preferred' | 'required';
+    /** Pass navigator.userActivation to enforce the Safari gesture requirement (S04). */
+    userActivation?: {
+        isActive: boolean;
+    };
+}
+/** Options for {@link registerPasskey} — a create WITHOUT deploy (see below). */
+type RegisterPasskeyOptions = Omit<CreatePasskeyOptions, 'deployer' | 'storage'>;
+/** A freshly-registered passkey credential (no account deployed yet). */
+interface RegisteredPasskey {
+    /** base64url credential id returned by the authenticator. */
+    credentialId: string;
+    /** SEC-1 uncompressed public key (65 bytes). */
+    publicKey: Uint8Array;
+}
+/**
+ * `registerPasskey` — register an ES256-only passkey and extract its SEC-1 public
+ * key (RS256 hard-fails), but do NOT deploy an account or persist anything. This
+ * is the "new device" primitive for multi-device recovery: a fresh device
+ * produces a `{credentialId, publicKey}` signer spec that an existing device then
+ * authorizes on-chain via `addSigner`. (`createPasskey` is this plus a deploy.)
+ */
+declare function registerPasskey(options: RegisterPasskeyOptions): Promise<RegisteredPasskey>;
+/**
+ * `createPasskey` — register an ES256-only passkey (see {@link registerPasskey}),
+ * deploy a smart account for it via the factory, persist the credential id, and
+ * return the account.
+ */
+declare function createPasskey(options: CreatePasskeyOptions): Promise<PasskeyCredential>;
+
+/** The browser `WebAuthnClient` backed by `navigator.credentials`. */
+declare function browserWebAuthnClient(): WebAuthnClient;
+/** localStorage-backed credential store, with an in-memory fallback (Node/SSR). */
+declare function defaultCredentialStorage(): CredentialStorage;
+
+/**
+ * Convert a CBOR-encoded COSE EC2 public key to the 65-byte SEC-1 uncompressed
+ * point `0x04 ‖ X ‖ Y`. Enforces ES256/P-256 — anything else (e.g. RS256)
+ * throws `ES256_NOT_SUPPORTED` (invariant #1).
+ */
+declare function coseKeyToSec1(coseKey: Uint8Array): Uint8Array;
+/** Extract the SEC-1 public key from raw authenticatorData (attested data). */
+declare function extractPublicKeyFromAuthData(authData: Uint8Array): Uint8Array;
+/** Extract the SEC-1 public key from a CBOR attestationObject (create ceremony). */
+declare function extractPublicKeyFromAttestationObject(attestationObject: Uint8Array): Uint8Array;
+
+interface DeriveAccountAddressOptions {
+    /** The AccountFactory contract C-address — the deployer. */
+    factoryContractId: string;
+    /** The credential-id bytes the factory salts by SHA-256 (utf-8 of the base64url id in our factory). */
+    credentialId: Uint8Array;
+    networkPassphrase: string;
+}
+/**
+ * Derive the deterministic C-address of the `webauthn-account` our AccountFactory
+ * deploys for a passkey — with NO network round-trip. The factory salts by
+ * `sha256(credential_id)` and deploys with `deployer().with_current_contract(salt)`.
+ * Verified against the on-chain `factoryDeployProof` in `contracts/deployments.json`
+ * (credential `democred` → `CAGWE36M…`). For the passkey-kit v1 smart-wallet, use
+ * {@link deriveSmartWalletAddress} instead (different deployer + salt-input scheme).
+ */
+declare function deriveAccountAddress(options: DeriveAccountAddressOptions): string;
+interface DeriveSmartWalletAddressOptions {
+    /**
+     * The account that deploys the wallet via `createCustomContract` — a classic
+     * G-address (or a factory C-address). MUST be stable for offline `getAddress`.
+     */
+    deployer: string;
+    /** base64url WebAuthn credential id of the FOUNDING passkey — its RAW bytes are salted. */
+    credentialId: string;
+    networkPassphrase: string;
+}
+/**
+ * Derive the deterministic C-address of a passkey-kit **v1 smart-wallet** — offline,
+ * no network. Mirrors passkey-kit's scheme exactly: `salt = sha256(rawCredentialId)`
+ * (the base64url-decoded credential-id bytes), deployed by a fixed `deployer`
+ * account via `createCustomContract`. Proven on-chain (`scripts/v1-events-probe.ts`:
+ * derived id === deployed id).
+ *
+ * This only recovers the address for the wallet's FOUNDING credential (the one used
+ * as the deploy salt). Signers added later via `add_signer` do not change the
+ * address and cannot be reversed into it — resolve those through the events indexer
+ * ({@link smartWalletV1Indexer}).
+ */
+declare function deriveSmartWalletAddress(options: DeriveSmartWalletAddressOptions): string;
+
+export { type CreatePasskeyOptions, type DeriveAccountAddressOptions, type DeriveSmartWalletAddressOptions, type RegisterPasskeyOptions, type RegisteredPasskey, browserWebAuthnClient, coseKeyToSec1, createPasskey, defaultCredentialStorage, deriveAccountAddress, deriveSmartWalletAddress, extractPublicKeyFromAttestationObject, extractPublicKeyFromAuthData, registerPasskey };

package/dist/create.js

@@ -0,0 +1,8 @@
+export { deriveAccountAddress, deriveSmartWalletAddress } from './chunk-MMB4ZIW3.js';
+export { buildCreateOptions, coseKeyToSec1, createPasskey, extractPublicKeyFromAttestationObject, extractPublicKeyFromAuthData, registerPasskey } from './chunk-W75OQKHR.js';
+import './chunk-JNJ2FY45.js';
+export { browserWebAuthnClient, defaultCredentialStorage } from './chunk-LB4HOTLV.js';
+export { assertES256, assertUserActivation } from './chunk-TPBBZNPP.js';
+import './chunk-AMYFJQAC.js';
+//# sourceMappingURL=create.js.map
+//# sourceMappingURL=create.js.map

package/dist/create.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"create.js"}