@soropass/core 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1542 @@
+'use strict';
+
+var nist = require('@noble/curves/nist');
+var sha256 = require('@noble/hashes/sha256');
+var stellarSdk = require('@stellar/stellar-sdk');
+
+// src/errors.ts
+var KIT_ERROR_CODES = Object.freeze([
+  "USER_CANCELLED",
+  "ES256_NOT_SUPPORTED",
+  "RP_ID_MISMATCH",
+  "ORIGIN_MISMATCH",
+  "CHALLENGE_MISMATCH",
+  "INVALID_SIGNATURE_DER",
+  "INVALID_PUBLIC_KEY",
+  "CONTRACT_AUTH_FAILED",
+  "NETWORK_ERROR",
+  "UNSUPPORTED_AUTHENTICATOR"
+]);
+var KitError = class _KitError extends Error {
+  code;
+  name = "KitError";
+  constructor(code, message, options) {
+    super(message ?? code, options);
+    this.code = code;
+    Object.setPrototypeOf(this, _KitError.prototype);
+  }
+};
+function isKitError(value) {
+  return value instanceof KitError;
+}
+
+// src/anchors.ts
+var BATTLE_TESTED_ANCHORS = Object.freeze({
+  /** Apple Touch ID/Face ID emit high-S ~50% of the time; we normalize to low-S. */
+  LOW_S_NORMALIZATION: "low-s-normalization",
+  /** Non-ES256 credentials (e.g. some Windows Hello configs) cannot verify on-chain. */
+  RS256_HARD_FAIL: "rs256-hard-fail",
+  /** Safari requires create/get inside a user activation or it silently rejects. */
+  APPLE_USER_GESTURE: "apple-user-gesture"
+});
+var ALG_ES256 = -7;
+function assertES256(alg) {
+  if (alg !== ALG_ES256) {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${alg} is not ES256 (-7)`);
+  }
+}
+function assertUserActivation(activation) {
+  const ua = activation ?? globalThis.navigator?.userActivation;
+  if (ua && !ua.isActive) {
+    throw new KitError(
+      "USER_CANCELLED",
+      "WebAuthn ceremony must be invoked inside a user activation (click/tap)"
+    );
+  }
+}
+
+// src/internal/encoding.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function utf8ToBytes(text) {
+  return new TextEncoder().encode(text);
+}
+function bytesToUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+
+// src/webauthn/createOptions.ts
+function buildCreateOptions(input) {
+  const residentKey = input.residentKey ?? "required";
+  return {
+    rp: { id: input.rpId, name: input.rpName },
+    user: {
+      id: bytesToBase64Url(input.userId ?? utf8ToBytes(input.userName)),
+      name: input.userName,
+      displayName: input.userDisplayName ?? input.userName
+    },
+    challenge: bytesToBase64Url(input.challenge),
+    pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+    authenticatorSelection: {
+      residentKey,
+      requireResidentKey: residentKey === "required",
+      userVerification: input.userVerification ?? "preferred"
+    },
+    attestation: "none",
+    timeout: input.timeout ?? 6e4
+  };
+}
+
+// src/internal/bytes.ts
+function concatBytes(...arrays) {
+  const total = arrays.reduce((n, a) => n + a.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    out.set(a, offset);
+    offset += a.length;
+  }
+  return out;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return diff === 0;
+}
+
+// src/internal/cbor.ts
+function byteAt(bytes, index) {
+  const value = bytes[index];
+  if (value === void 0) throw new Error(`CBOR: unexpected end of input at byte ${index}`);
+  return value;
+}
+var MAX_DEPTH = 16;
+function decodeCbor(bytes, offset = 0, depth = 0) {
+  if (depth > MAX_DEPTH) throw new Error("CBOR: maximum nesting depth exceeded");
+  const first = byteAt(bytes, offset);
+  const major = first >> 5;
+  const info = first & 31;
+  let pos = offset + 1;
+  let argument;
+  if (info < 24) {
+    argument = info;
+  } else if (info === 24) {
+    argument = byteAt(bytes, pos);
+    pos += 1;
+  } else if (info === 25) {
+    argument = byteAt(bytes, pos) << 8 | byteAt(bytes, pos + 1);
+    pos += 2;
+  } else if (info === 26) {
+    argument = byteAt(bytes, pos) * 16777216 + (byteAt(bytes, pos + 1) << 16) + (byteAt(bytes, pos + 2) << 8) + byteAt(bytes, pos + 3);
+    pos += 4;
+  } else {
+    throw new Error(`CBOR: unsupported length encoding (additional info ${info})`);
+  }
+  switch (major) {
+    case 0:
+      return { value: argument, length: pos - offset };
+    case 1:
+      return { value: -1 - argument, length: pos - offset };
+    case 2: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: byte string exceeds input");
+      return { value: bytes.slice(pos, end), length: end - offset };
+    }
+    case 3: {
+      const end = pos + argument;
+      if (end > bytes.length) throw new Error("CBOR: text string exceeds input");
+      return { value: new TextDecoder().decode(bytes.slice(pos, end)), length: end - offset };
+    }
+    case 4: {
+      const items = [];
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const item = decodeCbor(bytes, cursor, depth + 1);
+        items.push(item.value);
+        cursor += item.length;
+      }
+      return { value: items, length: cursor - offset };
+    }
+    case 5: {
+      const map = /* @__PURE__ */ new Map();
+      let cursor = pos;
+      for (let i = 0; i < argument; i += 1) {
+        const key = decodeCbor(bytes, cursor, depth + 1);
+        cursor += key.length;
+        const val = decodeCbor(bytes, cursor, depth + 1);
+        cursor += val.length;
+        if (typeof key.value !== "number" && typeof key.value !== "string") {
+          throw new Error("CBOR: unsupported map key type");
+        }
+        if (map.has(key.value)) {
+          throw new Error("CBOR: duplicate map key (non-canonical)");
+        }
+        map.set(key.value, val.value);
+      }
+      return { value: map, length: cursor - offset };
+    }
+    default:
+      throw new Error(`CBOR: unsupported major type ${major}`);
+  }
+}
+function decodeCborFirst(bytes) {
+  return decodeCbor(bytes, 0).value;
+}
+
+// src/webauthn/authData.ts
+var MIN_LENGTH = 37;
+function parseAuthenticatorData(authData) {
+  if (authData.length < MIN_LENGTH) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `authenticatorData is ${authData.length} bytes, expected at least ${MIN_LENGTH}`
+    );
+  }
+  const view = new DataView(authData.buffer, authData.byteOffset, authData.byteLength);
+  const rpIdHash = authData.slice(0, 32);
+  const bits = authData[32] ?? 0;
+  const flags = {
+    up: (bits & 1) !== 0,
+    uv: (bits & 4) !== 0,
+    be: (bits & 8) !== 0,
+    bs: (bits & 16) !== 0,
+    at: (bits & 64) !== 0,
+    ed: (bits & 128) !== 0,
+    bits
+  };
+  const signCount = view.getUint32(33, false);
+  const result = { rpIdHash, flags, signCount };
+  if (flags.at) {
+    if (authData.length < 55) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in attested data"
+      );
+    }
+    result.aaguid = authData.slice(37, 53);
+    const credIdLength = view.getUint16(53, false);
+    const credIdEnd = 55 + credIdLength;
+    if (authData.length < credIdEnd) {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        "authenticatorData truncated in credentialId"
+      );
+    }
+    result.credentialId = authData.slice(55, credIdEnd);
+    const rest = authData.slice(credIdEnd);
+    const { length } = decodeCbor(rest, 0);
+    result.credentialPublicKey = rest.slice(0, length);
+  }
+  return result;
+}
+function verifyRpIdHash(authData, rpId) {
+  const actual = parseAuthenticatorData(authData).rpIdHash;
+  const expected = sha256.sha256(utf8ToBytes(rpId));
+  if (!equalBytes(actual, expected)) {
+    throw new KitError(
+      "RP_ID_MISMATCH",
+      `authenticatorData rpIdHash does not match SHA-256("${rpId}")`
+    );
+  }
+}
+
+// src/webauthn/publicKey.ts
+var COSE_KTY = 1;
+var COSE_ALG = 3;
+var COSE_CRV = -1;
+var COSE_X = -2;
+var COSE_Y = -3;
+var KTY_EC2 = 2;
+var CRV_P256 = 1;
+function coseKeyToSec1(coseKey) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(coseKey);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode COSE key", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key is not a CBOR map");
+  }
+  const map = decoded;
+  const alg = map.get(COSE_ALG);
+  if (typeof alg !== "number") {
+    throw new KitError("ES256_NOT_SUPPORTED", `COSE alg ${String(alg)} is not ES256 (-7)`);
+  }
+  assertES256(alg);
+  if (map.get(COSE_KTY) !== KTY_EC2) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE kty ${String(map.get(COSE_KTY))} is not EC2 (2)`
+    );
+  }
+  if (map.get(COSE_CRV) !== CRV_P256) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      `COSE crv ${String(map.get(COSE_CRV))} is not P-256 (1)`
+    );
+  }
+  const x = map.get(COSE_X);
+  const y = map.get(COSE_Y);
+  if (!(x instanceof Uint8Array) || x.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key X coordinate is not 32 bytes");
+  }
+  if (!(y instanceof Uint8Array) || y.length !== 32) {
+    throw new KitError("INVALID_PUBLIC_KEY", "COSE key Y coordinate is not 32 bytes");
+  }
+  const sec1 = concatBytes(new Uint8Array([4]), x, y);
+  try {
+    nist.p256.Point.fromHex(sec1);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "public key is not a valid P-256 point", { cause });
+  }
+  return sec1;
+}
+function extractPublicKeyFromAuthData(authData) {
+  const parsed = parseAuthenticatorData(authData);
+  if (!parsed.credentialPublicKey) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      "authenticatorData has no attested credential public key"
+    );
+  }
+  return coseKeyToSec1(parsed.credentialPublicKey);
+}
+function extractPublicKeyFromAttestationObject(attestationObject) {
+  let decoded;
+  try {
+    decoded = decodeCborFirst(attestationObject);
+  } catch (cause) {
+    throw new KitError("INVALID_PUBLIC_KEY", "failed to CBOR-decode attestationObject", { cause });
+  }
+  if (!(decoded instanceof Map)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject is not a CBOR map");
+  }
+  const authData = decoded.get("authData");
+  if (!(authData instanceof Uint8Array)) {
+    throw new KitError("INVALID_PUBLIC_KEY", "attestationObject has no authData byte string");
+  }
+  return extractPublicKeyFromAuthData(authData);
+}
+
+// src/ceremonies/random.ts
+function randomBytes(length) {
+  const webcrypto = globalThis.crypto;
+  if (typeof webcrypto?.getRandomValues !== "function") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "no secure random source (globalThis.crypto.getRandomValues) is available in this environment"
+    );
+  }
+  const out = new Uint8Array(new ArrayBuffer(length));
+  webcrypto.getRandomValues(out);
+  return out;
+}
+
+// src/ceremonies/browserClient.ts
+function asKitError(error) {
+  if (error instanceof KitError) return error;
+  const name = typeof error === "object" && error !== null && "name" in error ? error.name : void 0;
+  if (name === "NotAllowedError") {
+    return new KitError("USER_CANCELLED", "The passkey prompt was dismissed.", { cause: error });
+  }
+  const message = error instanceof Error ? error.message : "WebAuthn request failed";
+  const detail = typeof name === "string" ? `${name}: ${message}` : message;
+  return new KitError("UNSUPPORTED_AUTHENTICATOR", detail, { cause: error });
+}
+function browserWebAuthnClient() {
+  const credentials = globalThis.navigator?.credentials;
+  if (!credentials) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "navigator.credentials is unavailable");
+  }
+  return {
+    async create(options) {
+      const publicKey = {
+        challenge: base64UrlToBytes(options.challenge),
+        rp: options.rp,
+        user: {
+          id: base64UrlToBytes(options.user.id),
+          name: options.user.name,
+          displayName: options.user.displayName
+        },
+        pubKeyCredParams: options.pubKeyCredParams,
+        authenticatorSelection: options.authenticatorSelection,
+        attestation: options.attestation,
+        timeout: options.timeout
+      };
+      let credential;
+      try {
+        credential = await credentials.create({ publicKey });
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "credential creation returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        attestationObject: new Uint8Array(response.attestationObject)
+      };
+    },
+    async get(options) {
+      const publicKey = {
+        rpId: options.rpId,
+        challenge: options.challenge ? new Uint8Array(options.challenge) : randomBytes(32),
+        allowCredentials: (options.allowCredentials ?? []).map((id) => ({
+          type: "public-key",
+          id: base64UrlToBytes(id)
+        })),
+        userVerification: options.userVerification
+      };
+      const request = { publicKey };
+      if (options.mediation) request.mediation = options.mediation;
+      let credential;
+      try {
+        credential = await credentials.get(request);
+      } catch (error) {
+        throw asKitError(error);
+      }
+      if (!credential) throw new KitError("USER_CANCELLED", "assertion returned null");
+      const response = credential.response;
+      return {
+        id: credential.id,
+        rawId: new Uint8Array(credential.rawId),
+        authenticatorData: new Uint8Array(response.authenticatorData),
+        clientDataJSON: new Uint8Array(response.clientDataJSON),
+        signature: new Uint8Array(response.signature)
+      };
+    }
+  };
+}
+function defaultCredentialStorage() {
+  const key = (rpId) => `stellar-passkey:${rpId}`;
+  const ls = globalThis.localStorage;
+  if (ls) {
+    return {
+      get: (rpId) => ls.getItem(key(rpId)),
+      set: (rpId, credentialId) => {
+        ls.setItem(key(rpId), credentialId);
+      }
+    };
+  }
+  const memory = /* @__PURE__ */ new Map();
+  return {
+    get: (rpId) => memory.get(rpId) ?? null,
+    set: (rpId, credentialId) => {
+      memory.set(rpId, credentialId);
+    }
+  };
+}
+
+// src/ceremonies/create.ts
+async function registerPasskey(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const creationOptions = buildCreateOptions({
+    rpId: options.rpId,
+    rpName: options.rpName,
+    userName: options.userName,
+    userId: options.userId,
+    challenge: options.challenge ?? randomBytes(32),
+    residentKey: options.residentKey,
+    userVerification: options.userVerification
+  });
+  const credential = await webauthn.create(creationOptions);
+  const publicKey = extractPublicKeyFromAttestationObject(credential.attestationObject);
+  return { credentialId: credential.id, publicKey };
+}
+async function createPasskey(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const { credentialId, publicKey } = await registerPasskey(options);
+  const { contractId } = await options.deployer.deploy({ publicKey, credentialId });
+  storage.set(options.rpId, credentialId);
+  return { contractId, credentialId, publicKey };
+}
+
+// src/webauthn/clientData.ts
+function encodeChallenge(challenge) {
+  return bytesToBase64Url(challenge);
+}
+function decodeChallenge(challenge) {
+  return base64UrlToBytes(challenge);
+}
+function parseClientDataJSON(clientDataJSON) {
+  let raw;
+  try {
+    raw = JSON.parse(bytesToUtf8(clientDataJSON));
+  } catch (cause) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not valid JSON", { cause });
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is not a JSON object");
+  }
+  const obj = raw;
+  const { type, challenge, origin, crossOrigin } = obj;
+  if (typeof type !== "string" || typeof challenge !== "string" || typeof origin !== "string") {
+    throw new KitError("UNSUPPORTED_AUTHENTICATOR", "clientDataJSON is missing required fields");
+  }
+  return {
+    type,
+    challenge,
+    origin,
+    crossOrigin: typeof crossOrigin === "boolean" ? crossOrigin : void 0
+  };
+}
+function verifyClientDataJSON(clientDataJSON, expected) {
+  const data = parseClientDataJSON(clientDataJSON);
+  if (data.type !== "webauthn.get") {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      `clientDataJSON.type "${data.type}" is not "webauthn.get"`
+    );
+  }
+  const allowed = Array.isArray(expected.origin) ? expected.origin : [expected.origin];
+  if (!allowed.includes(data.origin)) {
+    throw new KitError("ORIGIN_MISMATCH", `origin "${data.origin}" not in [${allowed.join(", ")}]`);
+  }
+  if (data.challenge !== expected.challenge) {
+    throw new KitError("CHALLENGE_MISMATCH", "clientDataJSON challenge does not match expected");
+  }
+  return data;
+}
+
+// src/soroban/address.ts
+function contractIdFromDeployerSalt(deployer, salt, networkPassphrase) {
+  let address;
+  try {
+    address = stellarSdk.Address.fromString(deployer).toScAddress();
+  } catch (cause) {
+    throw new KitError("CONTRACT_AUTH_FAILED", `invalid deployer address "${deployer}"`, { cause });
+  }
+  const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeContractId(
+    new stellarSdk.xdr.HashIdPreimageContractId({
+      networkId: stellarSdk.hash(Buffer.from(networkPassphrase)),
+      contractIdPreimage: stellarSdk.xdr.ContractIdPreimage.contractIdPreimageFromAddress(
+        new stellarSdk.xdr.ContractIdPreimageFromAddress({
+          address,
+          salt: Buffer.from(salt)
+        })
+      )
+    })
+  );
+  return stellarSdk.StrKey.encodeContract(stellarSdk.hash(preimage.toXDR()));
+}
+function deriveAccountAddress(options) {
+  const { factoryContractId, credentialId, networkPassphrase } = options;
+  if (credentialId.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveAccountAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(
+    factoryContractId,
+    stellarSdk.hash(Buffer.from(credentialId)),
+    // e.crypto().sha256(credential_id)
+    networkPassphrase
+  );
+}
+function deriveSmartWalletAddress(options) {
+  const raw = decodeChallenge(options.credentialId);
+  if (raw.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "deriveSmartWalletAddress: empty credential id");
+  }
+  return contractIdFromDeployerSalt(options.deployer, sha256.sha256(raw), options.networkPassphrase);
+}
+var MAX_DER_LENGTH = 72;
+function derToCompact(der) {
+  if (der.length > MAX_DER_LENGTH) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `DER signature is ${der.length} bytes, exceeds max ${MAX_DER_LENGTH}`
+    );
+  }
+  try {
+    return nist.p256.Signature.fromDER(der).toCompactRawBytes();
+  } catch (cause) {
+    throw new KitError("INVALID_SIGNATURE_DER", "failed to parse DER signature", { cause });
+  }
+}
+function assertCompactLength(compactSignature) {
+  if (compactSignature.length !== 64) {
+    throw new KitError(
+      "INVALID_SIGNATURE_DER",
+      `compact signature must be 64 bytes, got ${compactSignature.length}`
+    );
+  }
+}
+function isLowS(compactSignature) {
+  assertCompactLength(compactSignature);
+  return !nist.p256.Signature.fromCompact(compactSignature).hasHighS();
+}
+function normalizeLowS(compactSignature) {
+  assertCompactLength(compactSignature);
+  return nist.p256.Signature.fromCompact(compactSignature).normalizeS().toCompactRawBytes();
+}
+function derToCompactLowS(der) {
+  return normalizeLowS(derToCompact(der));
+}
+
+// src/webauthn/payload.ts
+function reconstructSignedPayload(input) {
+  const clientDataHash = sha256.sha256(input.clientDataJSON);
+  return sha256.sha256(concatBytes(input.authenticatorData, clientDataHash));
+}
+function verifyAssertionSignature(input) {
+  const payload = reconstructSignedPayload(input);
+  const compact = input.signature.length === 64 ? input.signature : derToCompact(input.signature);
+  return nist.p256.verify(compact, payload, input.publicKey, { lowS: false, format: "compact" });
+}
+
+// src/ceremonies/browserSigner.ts
+function browserPasskeySigner(options) {
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  return async (challenge) => {
+    const assertion = await webauthn.get({
+      rpId: options.rpId,
+      challenge: base64UrlToBytes(challenge),
+      allowCredentials: options.allowCredentials ?? [],
+      userVerification: options.userVerification ?? "preferred"
+    });
+    return {
+      authenticatorData: assertion.authenticatorData,
+      clientDataJSON: assertion.clientDataJSON,
+      signature: assertion.signature,
+      credentialId: assertion.rawId
+    };
+  };
+}
+function authEntryChallengeBytes(entry, networkPassphrase) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const address = credentials.address();
+  const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+    new stellarSdk.xdr.HashIdPreimageSorobanAuthorization({
+      networkId: Buffer.from(stellarSdk.hash(Buffer.from(utf8ToBytes(networkPassphrase)))),
+      nonce: address.nonce(),
+      signatureExpirationLedger: address.signatureExpirationLedger(),
+      invocation: entry.rootInvocation()
+    })
+  );
+  return new Uint8Array(stellarSdk.hash(preimage.toXDR()));
+}
+function authEntryChallenge(entry, networkPassphrase) {
+  return bytesToBase64Url(authEntryChallengeBytes(entry, networkPassphrase));
+}
+function applyAssertionToEntry(entry, assertion) {
+  entry.credentials().address().signature(buildSignatureScVal(assertion));
+  return entry;
+}
+function buildSignatureScVal(assertion) {
+  return stellarSdk.xdr.ScVal.scvMap([
+    bytesField("authenticator_data", assertion.authenticatorData),
+    bytesField("client_data_json", assertion.clientDataJSON),
+    bytesField("signature", assertion.signature)
+  ]);
+}
+function bytesField(name, bytes) {
+  return new stellarSdk.xdr.ScMapEntry({
+    key: stellarSdk.xdr.ScVal.scvSymbol(name),
+    val: stellarSdk.xdr.ScVal.scvBytes(Buffer.from(bytes))
+  });
+}
+function buildSignerKeyScVal(credentialId) {
+  return stellarSdk.xdr.ScVal.scvVec([
+    stellarSdk.xdr.ScVal.scvSymbol("Secp256r1"),
+    stellarSdk.xdr.ScVal.scvBytes(Buffer.from(credentialId))
+  ]);
+}
+function buildSmartWalletSignatureVariant(assertion) {
+  return stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvSymbol("Secp256r1"), buildSignatureScVal(assertion)]);
+}
+function decomposeSignerKey(key) {
+  const vec = key.vec();
+  if (!vec || vec.length < 2) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "malformed SignerKey (expected an enum vec)");
+  }
+  const variant = vec[0].sym().toString();
+  const el = vec[1];
+  const payload = el.switch().name === "scvBytes" ? new Uint8Array(el.bytes()) : new Uint8Array(el.toXDR());
+  return { variant, payload };
+}
+function compareBytes(a, b) {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return a.length - b.length;
+}
+function compareSignerKeyScVal(a, b) {
+  const ka = decomposeSignerKey(a);
+  const kb = decomposeSignerKey(b);
+  if (ka.variant !== kb.variant) return ka.variant < kb.variant ? -1 : 1;
+  return compareBytes(ka.payload, kb.payload);
+}
+function applyAssertionToSmartWalletEntry(entry, assertion) {
+  const credentials = entry.credentials();
+  if (credentials.switch().name !== "sorobanCredentialsAddress") {
+    throw new KitError("CONTRACT_AUTH_FAILED", "auth entry has no address credentials to sign");
+  }
+  const key = buildSignerKeyScVal(assertion.credentialId);
+  const newEntry = new stellarSdk.xdr.ScMapEntry({ key, val: buildSmartWalletSignatureVariant(assertion) });
+  const current = credentials.address().signature();
+  let mapEntries;
+  switch (current.switch().name) {
+    case "scvVoid":
+      mapEntries = [newEntry];
+      break;
+    case "scvVec": {
+      const existing = current.vec()?.[0]?.map() ?? [];
+      mapEntries = existing.filter((e) => compareSignerKeyScVal(e.key(), key) !== 0);
+      mapEntries.push(newEntry);
+      break;
+    }
+    default:
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "unexpected existing signature shape for a smart-wallet entry"
+      );
+  }
+  mapEntries.sort((a, b) => compareSignerKeyScVal(a.key(), b.key()));
+  credentials.address().signature(stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvMap(mapEntries)]));
+  return entry;
+}
+
+// src/soroban/sign.ts
+function preflightAssertion(assertion, challenge, verify) {
+  let clientData;
+  if (verify.origin !== void 0) {
+    clientData = verifyClientDataJSON(assertion.clientDataJSON, {
+      origin: verify.origin,
+      challenge
+    });
+  } else {
+    clientData = parseClientDataJSON(assertion.clientDataJSON);
+    if (clientData.type !== "webauthn.get") {
+      throw new KitError(
+        "UNSUPPORTED_AUTHENTICATOR",
+        `clientDataJSON.type "${clientData.type}" is not "webauthn.get"`
+      );
+    }
+    if (clientData.challenge !== challenge) {
+      throw new KitError("CHALLENGE_MISMATCH", "assertion challenge does not match the auth entry");
+    }
+  }
+  if (clientData.crossOrigin === true && !verify.allowCrossOrigin) {
+    throw new KitError(
+      "ORIGIN_MISMATCH",
+      "assertion was made in a cross-origin context (crossOrigin=true)"
+    );
+  }
+  const parsed = parseAuthenticatorData(assertion.authenticatorData);
+  if (!parsed.flags.up) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the User-Present (UP) flag"
+    );
+  }
+  if (verify.requireUserVerification && !parsed.flags.uv) {
+    throw new KitError(
+      "UNSUPPORTED_AUTHENTICATOR",
+      "assertion is missing the required User-Verified (UV) flag"
+    );
+  }
+  if (verify.rpId !== void 0) {
+    verifyRpIdHash(assertion.authenticatorData, verify.rpId);
+  }
+  if (verify.publicKey !== void 0) {
+    const ok = verifyAssertionSignature({
+      publicKey: verify.publicKey,
+      authenticatorData: assertion.authenticatorData,
+      clientDataJSON: assertion.clientDataJSON,
+      signature: assertion.signature
+    });
+    if (!ok) {
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "assertion signature failed pre-flight verification"
+      );
+    }
+  }
+}
+async function signEntryInPlace(entry, options) {
+  if (options.signatureExpirationLedger !== void 0) {
+    const creds = entry.credentials();
+    if (creds.switch().name === "sorobanCredentialsAddress") {
+      creds.address().signatureExpirationLedger(options.signatureExpirationLedger);
+    }
+  }
+  const challenge = authEntryChallenge(entry, options.networkPassphrase);
+  const assertion = await options.sign(challenge);
+  if (options.verify) preflightAssertion(assertion, challenge, options.verify);
+  const signature = assertion.signature.length === 64 ? assertion.signature : derToCompactLowS(assertion.signature);
+  const normalized = {
+    credentialId: assertion.credentialId,
+    authenticatorData: assertion.authenticatorData,
+    clientDataJSON: assertion.clientDataJSON,
+    signature
+  };
+  if (options.target === "smart-wallet") {
+    applyAssertionToSmartWalletEntry(entry, normalized);
+  } else {
+    applyAssertionToEntry(entry, normalized);
+  }
+}
+async function signAuthEntry(entryXdr, options) {
+  const entry = stellarSdk.xdr.SorobanAuthorizationEntry.fromXDR(entryXdr, "base64");
+  await signEntryInPlace(entry, options);
+  return entry.toXDR("base64");
+}
+function operationsForSigning(envelope) {
+  const kind = envelope.switch().name;
+  if (kind === "envelopeTypeTx") return envelope.v1().tx().operations();
+  if (kind === "envelopeTypeTxFeeBump") {
+    const inner = envelope.feeBump().tx().innerTx();
+    if (inner.switch().name !== "envelopeTypeTx") {
+      throw new KitError(
+        "CONTRACT_AUTH_FAILED",
+        "signTransaction: fee-bump inner transaction is not a v1 transaction"
+      );
+    }
+    return inner.v1().tx().operations();
+  }
+  throw new KitError(
+    "CONTRACT_AUTH_FAILED",
+    `signTransaction: unsupported envelope type "${kind}" (expected v1 or fee-bump)`
+  );
+}
+async function signTransaction(txXdr, options) {
+  const envelope = stellarSdk.xdr.TransactionEnvelope.fromXDR(txXdr, "base64");
+  for (const op of operationsForSigning(envelope)) {
+    if (op.body().switch().name !== "invokeHostFunction") continue;
+    const entries = op.body().invokeHostFunctionOp().auth();
+    for (const entry of entries) {
+      if (entry.credentials().switch().name !== "sorobanCredentialsAddress") continue;
+      await signEntryInPlace(entry, options);
+    }
+  }
+  return envelope.toXDR("base64");
+}
+function noneTuple() {
+  return stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvVoid()]);
+}
+function expirationScVal(expiration) {
+  if (expiration === void 0) return noneTuple();
+  const ts = BigInt(expiration);
+  if (ts < 0n) {
+    throw new KitError(
+      "CONTRACT_AUTH_FAILED",
+      "signer expiration must be a non-negative UNIX-seconds timestamp (v1)"
+    );
+  }
+  return stellarSdk.xdr.ScVal.scvVec([stellarSdk.nativeToScVal(ts, { type: "u64" })]);
+}
+function storageScVal(storage = "Persistent") {
+  return stellarSdk.xdr.ScVal.scvVec([stellarSdk.xdr.ScVal.scvSymbol(storage)]);
+}
+function buildSecp256r1Signer(spec) {
+  if (spec.credentialId.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "buildSecp256r1Signer: empty credential id");
+  }
+  if (spec.publicKey.length !== 65 || spec.publicKey[0] !== 4) {
+    throw new KitError(
+      "INVALID_PUBLIC_KEY",
+      "buildSecp256r1Signer: publicKey must be a 65-byte SEC-1 uncompressed point (0x04-prefixed)"
+    );
+  }
+  return stellarSdk.xdr.ScVal.scvVec([
+    stellarSdk.xdr.ScVal.scvSymbol("Secp256r1"),
+    stellarSdk.xdr.ScVal.scvBytes(Buffer.from(spec.credentialId)),
+    stellarSdk.xdr.ScVal.scvBytes(Buffer.from(spec.publicKey)),
+    expirationScVal(spec.expiration),
+    // SignerExpiration
+    noneTuple(),
+    // SignerLimits(None)
+    storageScVal(spec.storage)
+    // SignerStorage
+  ]);
+}
+function contractCall(contractId, method, ...args) {
+  let contract;
+  try {
+    contract = new stellarSdk.Contract(contractId);
+  } catch (cause) {
+    throw new KitError("CONTRACT_AUTH_FAILED", `invalid smart-wallet contract id "${contractId}"`, {
+      cause
+    });
+  }
+  return contract.call(method, ...args);
+}
+function buildAddSignerOperation(options) {
+  const signerScVal = options.signer instanceof stellarSdk.xdr.ScVal ? options.signer : buildSecp256r1Signer(options.signer);
+  return contractCall(options.walletContractId, "add_signer", signerScVal);
+}
+function buildRemoveSignerOperation(options) {
+  if (options.credentialId.length === 0) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "buildRemoveSignerOperation: empty credential id");
+  }
+  return contractCall(
+    options.walletContractId,
+    "remove_signer",
+    buildSignerKeyScVal(options.credentialId)
+  );
+}
+function fail(reason) {
+  return { success: false, challengeBound: false, signatureValid: false, reason };
+}
+function verifySecp256r1StructMap(structMap, publicKey, signaturePayload) {
+  const field = (name) => {
+    const e = structMap.find((x) => x.key().sym().toString() === name);
+    return e ? new Uint8Array(e.val().bytes()) : void 0;
+  };
+  const authenticatorData = field("authenticator_data");
+  const clientDataJSON = field("client_data_json");
+  const signature = field("signature");
+  if (!authenticatorData || !clientDataJSON || !signature) {
+    return { ok: false, challengeBound: false, signatureValid: false, reason: "missing fields" };
+  }
+  if (signature.length !== 64) {
+    return {
+      ok: false,
+      challengeBound: false,
+      signatureValid: false,
+      reason: "not 64-byte compact"
+    };
+  }
+  let challengeBound = false;
+  try {
+    const cdj = JSON.parse(bytesToUtf8(clientDataJSON));
+    challengeBound = cdj.challenge === bytesToBase64Url(signaturePayload);
+  } catch {
+    challengeBound = false;
+  }
+  const digest = sha256.sha256(concatBytes(authenticatorData, sha256.sha256(clientDataJSON)));
+  const signatureValid = nist.p256.verify(signature, digest, publicKey, {
+    lowS: false,
+    format: "compact"
+  });
+  return { ok: challengeBound && signatureValid, challengeBound, signatureValid };
+}
+function referenceCheckAuth(entry, publicKey, networkPassphrase) {
+  if (entry.credentials().switch().name !== "sorobanCredentialsAddress") {
+    return fail("no address credentials");
+  }
+  const structMap = entry.credentials().address().signature().map();
+  if (!structMap) return fail("signature is not a Secp256r1Signature map");
+  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);
+  const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);
+  return { success: r.ok, challengeBound: r.challengeBound, signatureValid: r.signatureValid };
+}
+function referenceSmartWalletCheckAuth(entry, publicKeyFor, networkPassphrase) {
+  if (entry.credentials().switch().name !== "sorobanCredentialsAddress") {
+    return { success: false, signers: [], reason: "no address credentials" };
+  }
+  const sig = entry.credentials().address().signature();
+  const map = sig.switch().name === "scvVec" ? sig.vec()?.[0]?.map() : void 0;
+  if (!map) {
+    return { success: false, signers: [], reason: "signature is not a Signatures(Map) vec" };
+  }
+  if (map.length === 0) return { success: false, signers: [], reason: "empty signatures map" };
+  const signaturePayload = authEntryChallengeBytes(entry, networkPassphrase);
+  const signers = [];
+  let allOk = true;
+  for (const e of map) {
+    const keyVec = e.key().vec();
+    const idBytes = keyVec?.[1]?.bytes();
+    const credentialId = idBytes ? Buffer.from(idBytes).toString("hex") : "";
+    const structMap = e.val().vec()?.[1]?.map();
+    const publicKey = publicKeyFor(credentialId);
+    if (!structMap || !publicKey) {
+      allOk = false;
+      signers.push({ credentialId, challengeBound: false, signatureValid: false });
+      continue;
+    }
+    const r = verifySecp256r1StructMap(structMap, publicKey, signaturePayload);
+    if (!r.ok) allOk = false;
+    signers.push({
+      credentialId,
+      challengeBound: r.challengeBound,
+      signatureValid: r.signatureValid
+    });
+  }
+  return { success: allOk, signers };
+}
+function directSubmission(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  const attempts = options.pollAttempts ?? 30;
+  const intervalMs = options.pollIntervalMs ?? 1e3;
+  return {
+    async send(signedTxXdr) {
+      const tx = stellarSdk.TransactionBuilder.fromXDR(signedTxXdr, options.networkPassphrase);
+      let sent;
+      try {
+        sent = await server.sendTransaction(tx);
+      } catch (cause) {
+        throw new KitError("NETWORK_ERROR", "failed to submit transaction to soroban-rpc", {
+          cause
+        });
+      }
+      if (sent.status === "ERROR") {
+        return {
+          status: "FAILED",
+          hash: sent.hash,
+          errorResultXdr: sent.errorResult?.toXDR("base64")
+        };
+      }
+      let final;
+      try {
+        final = await server.pollTransaction(sent.hash, {
+          attempts,
+          sleepStrategy: () => intervalMs
+        });
+      } catch (cause) {
+        throw new KitError(
+          "NETWORK_ERROR",
+          `transaction ${sent.hash} was not confirmed after ${String(attempts)} polls`,
+          { cause }
+        );
+      }
+      if (final.status === stellarSdk.rpc.Api.GetTransactionStatus.NOT_FOUND) {
+        throw new KitError(
+          "NETWORK_ERROR",
+          `transaction ${sent.hash} still NOT_FOUND after ${String(attempts)} polls`
+        );
+      }
+      const success = final.status === stellarSdk.rpc.Api.GetTransactionStatus.SUCCESS;
+      return {
+        status: success ? "SUCCESS" : "FAILED",
+        hash: sent.hash,
+        returnValue: success ? final.returnValue : void 0
+      };
+    }
+  };
+}
+
+// src/soroban/submit.ts
+var DEFAULT_EXPIRATION_OFFSET = 60;
+async function sendSmartWalletTx(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  let source;
+  try {
+    source = stellarSdk.Keypair.fromSecret(options.sourceSecret);
+  } catch (cause) {
+    throw new KitError("CONTRACT_AUTH_FAILED", "invalid fee-source secret", { cause });
+  }
+  const account = await server.getAccount(source.publicKey());
+  const tx = new stellarSdk.TransactionBuilder(account, {
+    fee: options.fee ?? "2000000",
+    networkPassphrase: options.networkPassphrase
+  }).addOperation(options.operation).setTimeout(options.timeoutSeconds ?? 120).build();
+  const recSim = await server.simulateTransaction(tx);
+  if (!stellarSdk.rpc.Api.isSimulationSuccess(recSim)) {
+    const detail = "error" in recSim ? String(recSim.error) : "unknown simulation error";
+    throw new KitError(
+      "CONTRACT_AUTH_FAILED",
+      `smart-wallet tx simulation failed: ${detail.slice(0, 300)}`
+    );
+  }
+  const prepared = stellarSdk.rpc.assembleTransaction(tx, recSim).build();
+  const signatureExpirationLedger = (await server.getLatestLedger()).sequence + (options.signatureExpirationLedgerOffset ?? DEFAULT_EXPIRATION_OFFSET);
+  const signedAuthXdr = await signTransaction(prepared.toXDR(), {
+    networkPassphrase: options.networkPassphrase,
+    sign: options.sign,
+    target: "smart-wallet",
+    signatureExpirationLedger,
+    verify: options.verify
+  });
+  const signedTx = stellarSdk.TransactionBuilder.fromXDR(signedAuthXdr, options.networkPassphrase);
+  const enfSim = await server.simulateTransaction(signedTx);
+  if (!stellarSdk.rpc.Api.isSimulationSuccess(enfSim)) {
+    const detail = "error" in enfSim ? String(enfSim.error) : "unknown simulation error";
+    throw new KitError(
+      "CONTRACT_AUTH_FAILED",
+      `signed smart-wallet tx failed enforcing simulation (auth rejected?): ${detail.slice(0, 300)}`
+    );
+  }
+  const finalTx = stellarSdk.rpc.assembleTransaction(signedTx, enfSim).build();
+  finalTx.sign(source);
+  const submission = options.submission ?? directSubmission({
+    rpcUrl: options.rpcUrl,
+    networkPassphrase: options.networkPassphrase,
+    allowHttp: options.allowHttp
+  });
+  return submission.send(finalTx.toXDR());
+}
+
+// src/ceremonies/connect.ts
+async function probeConditionalMediation() {
+  const pkc = globalThis.PublicKeyCredential;
+  if (!pkc?.isConditionalMediationAvailable) return false;
+  try {
+    return await pkc.isConditionalMediationAvailable();
+  } catch {
+    return false;
+  }
+}
+async function connect(options) {
+  const storage = options.storage ?? defaultCredentialStorage();
+  const credentialId = storage.get(options.rpId);
+  if (!credentialId) return null;
+  const silentSupported = options.silentMediationSupported ?? await probeConditionalMediation();
+  if (silentSupported) {
+    const webauthn = options.webauthn ?? browserWebAuthnClient();
+    try {
+      await webauthn.get({
+        rpId: options.rpId,
+        allowCredentials: [credentialId],
+        mediation: "silent"
+      });
+    } catch {
+    }
+  }
+  const accounts = await options.indexer.resolveByCredential(credentialId);
+  const contractId = accounts[0]?.contractId;
+  return contractId ? { contractId, credentialId } : null;
+}
+
+// src/ceremonies/recover.ts
+async function recover(options) {
+  assertUserActivation(options.userActivation);
+  const webauthn = options.webauthn ?? browserWebAuthnClient();
+  const assertion = await webauthn.get({
+    rpId: options.rpId,
+    allowCredentials: [],
+    challenge: options.challenge ?? randomBytes(32)
+  });
+  const accounts = await options.indexer.resolveByCredential(assertion.id);
+  return accounts.map((account) => ({
+    contractId: account.contractId,
+    credentialId: assertion.id
+  }));
+}
+
+// src/ceremonies/addDevice.ts
+function toRawCredentialId(id) {
+  return typeof id === "string" ? decodeChallenge(id) : id;
+}
+async function addSigner(options) {
+  const { walletContractId, newSigner, ...wiring } = options;
+  const operation = buildAddSignerOperation({
+    walletContractId,
+    signer: {
+      credentialId: toRawCredentialId(newSigner.credentialId),
+      publicKey: newSigner.publicKey,
+      expiration: newSigner.expiration,
+      storage: newSigner.storage
+    }
+  });
+  return sendSmartWalletTx({ ...wiring, operation });
+}
+async function removeSigner(options) {
+  const { walletContractId, credentialId, ...wiring } = options;
+  const operation = buildRemoveSignerOperation({
+    walletContractId,
+    credentialId: toRawCredentialId(credentialId)
+  });
+  return sendSmartWalletTx({ ...wiring, operation });
+}
+
+// src/adapters/http.ts
+var sleep = (ms) => ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+function isTransientStatus(status) {
+  return status === 429 || status >= 500;
+}
+async function httpPost(url, init, retry) {
+  const attempts = Math.max(1, retry?.retries ?? 1);
+  const backoffMs = retry?.backoffMs ?? 300;
+  for (let i = 1; i <= attempts; i++) {
+    try {
+      const response = await fetch(url, {
+        method: "POST",
+        headers: init.headers,
+        body: init.body
+      });
+      if (isTransientStatus(response.status) && i < attempts) {
+        await sleep(backoffMs * i);
+        continue;
+      }
+      return response;
+    } catch (cause) {
+      if (i < attempts) {
+        await sleep(backoffMs * i);
+        continue;
+      }
+      throw new KitError("NETWORK_ERROR", `POST to ${url} failed`, { cause });
+    }
+  }
+  throw new KitError("NETWORK_ERROR", `POST to ${url} failed`);
+}
+
+// src/adapters/launchtube.ts
+function launchtubeSubmission(options) {
+  return {
+    async send(signedTxXdr) {
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      if (options.token) headers["authorization"] = `Bearer ${options.token}`;
+      const response = await httpPost(
+        options.url,
+        { headers, body: new URLSearchParams({ xdr: signedTxXdr }).toString() },
+        options.retry
+      );
+      const body = await response.json().catch(() => ({}));
+      if (!response.ok || body.status === "FAILED" || body.error) {
+        return { status: "FAILED", hash: body.hash ?? "", errorResultXdr: body.errorResultXdr };
+      }
+      return { status: "SUCCESS", hash: body.hash ?? "", returnValue: body };
+    }
+  };
+}
+
+// src/adapters/ozRelayer.ts
+function openzeppelinRelayerSubmission(options) {
+  return {
+    async send(signedTxXdr) {
+      const headers = { "content-type": "application/json" };
+      if (options.apiKey) headers["authorization"] = `Bearer ${options.apiKey}`;
+      const response = await httpPost(
+        options.url,
+        { headers, body: JSON.stringify({ transaction_xdr: signedTxXdr }) },
+        options.retry
+      );
+      const body = await response.json().catch(() => ({}));
+      if (!response.ok || body.status === "failed") {
+        return { status: "FAILED", hash: body.hash ?? "", errorResultXdr: body.errorResultXdr };
+      }
+      return { status: "SUCCESS", hash: body.hash ?? "", returnValue: body };
+    }
+  };
+}
+
+// src/adapters/eventsPaging.ts
+var EVENTS_PAGE_LIMIT = 1e4;
+var MAX_EVENT_PAGES = 40;
+function cursorLedger(cursor) {
+  try {
+    const toid = cursor.split("-")[0];
+    if (!toid) return null;
+    return Number(BigInt(toid) >> 32n);
+  } catch {
+    return null;
+  }
+}
+function parseOldestLedger(error) {
+  const raw = typeof error === "object" && error !== null && "message" in error ? error.message : error;
+  const message = typeof raw === "string" ? raw : String(raw);
+  const match = /ledger range:\s*(\d+)\s*-\s*\d+/.exec(message);
+  return match ? Number(match[1]) : null;
+}
+async function collectEventsToTip(server, filters, startLedger) {
+  const events = [];
+  let start = startLedger;
+  let cursor;
+  let previousCursor;
+  for (let page = 0; page < MAX_EVENT_PAGES; page++) {
+    let response;
+    try {
+      response = await server.getEvents(
+        cursor ? { filters, cursor, limit: EVENTS_PAGE_LIMIT } : { filters, startLedger: start, limit: EVENTS_PAGE_LIMIT }
+      );
+    } catch (error) {
+      const oldest = parseOldestLedger(error);
+      if (!cursor && oldest != null && start <= oldest) {
+        start = oldest + 2;
+        continue;
+      }
+      throw error;
+    }
+    events.push(...response.events);
+    previousCursor = cursor;
+    cursor = response.cursor;
+    if (!cursor || cursor === previousCursor) break;
+    const scanned = cursorLedger(cursor);
+    if (scanned != null && scanned >= response.latestLedger) break;
+  }
+  return events;
+}
+
+// src/adapters/events.ts
+function decodeNative(scv) {
+  try {
+    return stellarSdk.scValToNative(scv);
+  } catch {
+    return void 0;
+  }
+}
+var LEDGERS_PER_DAY = 17280;
+function defaultMatch(event, credentialId) {
+  try {
+    const topics = event.topic ?? [];
+    if (topics.length >= 2) {
+      const tag = decodeNative(topics[0]);
+      const credRaw = decodeNative(topics[1]);
+      const cred = credRaw instanceof Uint8Array ? new TextDecoder().decode(credRaw) : String(credRaw ?? "");
+      if (tag === "deployed" && cred === credentialId) {
+        const addr2 = decodeNative(event.value);
+        if (typeof addr2 === "string" && addr2.startsWith("C")) return { contractId: addr2 };
+      }
+    }
+    const haystack = [event.value, ...topics].map((v) => v.toXDR("base64")).join("|");
+    if (!haystack.includes(credentialId)) return null;
+    const addr = decodeNative(event.value);
+    if (typeof addr === "string" && addr.startsWith("C")) return { contractId: addr };
+    return event.contractId ? { contractId: event.contractId.toString() } : null;
+  } catch {
+    return null;
+  }
+}
+function eventsIndexer(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  const match = options.matchEvent ?? defaultMatch;
+  return {
+    async resolveByCredential(credentialId) {
+      const startLedger = options.startLedger ?? Math.max(1, (await server.getLatestLedger()).sequence - LEDGERS_PER_DAY);
+      const events = await collectEventsToTip(
+        server,
+        [{ type: "contract", contractIds: [options.factoryContractId] }],
+        startLedger
+      );
+      const accounts = [];
+      for (const event of events) {
+        const resolved = match(event, credentialId);
+        if (resolved) accounts.push(resolved);
+      }
+      return accounts;
+    }
+  };
+}
+
+// src/adapters/mercury.ts
+function mercuryIndexer(options) {
+  const parse = options.parse ?? ((json) => {
+    const rows = json.accounts ?? [];
+    return rows.flatMap((r) => r.contractId ? [{ contractId: r.contractId }] : []);
+  });
+  return {
+    async resolveByCredential(credentialId) {
+      const headers = { "content-type": "application/json" };
+      if (options.token) headers["authorization"] = `Bearer ${options.token}`;
+      const response = await httpPost(
+        options.url,
+        { headers, body: JSON.stringify({ credentialId }) },
+        options.retry
+      );
+      if (!response.ok) {
+        throw new KitError(
+          "NETWORK_ERROR",
+          `mercury indexer returned HTTP ${String(response.status)}`
+        );
+      }
+      return parse(await response.json().catch(() => ({})));
+    }
+  };
+}
+
+// src/adapters/defaults.ts
+function defaultAdapters(options) {
+  return {
+    submission: directSubmission({
+      rpcUrl: options.rpcUrl,
+      networkPassphrase: options.networkPassphrase,
+      allowHttp: options.allowHttp
+    }),
+    indexer: eventsIndexer({
+      rpcUrl: options.rpcUrl,
+      factoryContractId: options.factoryContractId,
+      allowHttp: options.allowHttp
+    })
+  };
+}
+function factoryDeployer(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  const source = stellarSdk.Keypair.fromSecret(options.sourceSecret);
+  return {
+    async deploy(input) {
+      const pk = stellarSdk.nativeToScVal(Buffer.from(input.publicKey), { type: "bytes" });
+      const cred = stellarSdk.nativeToScVal(Buffer.from(new TextEncoder().encode(input.credentialId)), {
+        type: "bytes"
+      });
+      const account = await server.getAccount(source.publicKey());
+      const tx = new stellarSdk.TransactionBuilder(account, {
+        fee: options.fee ?? "2000000",
+        networkPassphrase: options.networkPassphrase
+      }).addOperation(new stellarSdk.Contract(options.factoryContractId).call("deploy", pk, cred)).setTimeout(120).build();
+      const sim = await server.simulateTransaction(tx);
+      if (!stellarSdk.rpc.Api.isSimulationSuccess(sim)) {
+        throw new KitError("CONTRACT_AUTH_FAILED", "factory deploy simulation failed");
+      }
+      const prepared = stellarSdk.rpc.assembleTransaction(tx, sim).build();
+      prepared.sign(source);
+      const sent = await server.sendTransaction(prepared);
+      if (sent.status === "ERROR") {
+        throw new KitError("NETWORK_ERROR", "factory deploy submit error");
+      }
+      const final = await server.pollTransaction(sent.hash);
+      if (final.status !== stellarSdk.rpc.Api.GetTransactionStatus.SUCCESS) {
+        throw new KitError("CONTRACT_AUTH_FAILED", `factory deploy ${final.status}`);
+      }
+      const ret = final.returnValue;
+      const contractId = ret ? String(stellarSdk.scValToNative(ret)) : "";
+      return { contractId, txHash: sent.hash };
+    }
+  };
+}
+var SMART_WALLET_V1_WASM_HASH = "84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319";
+function smartWalletV1Deployer(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  const source = stellarSdk.Keypair.fromSecret(options.deployerSecret);
+  const wasmHash = options.wasmHash ?? SMART_WALLET_V1_WASM_HASH;
+  return {
+    async deploy(input) {
+      const raw = decodeChallenge(input.credentialId);
+      const contractId = deriveSmartWalletAddress({
+        deployer: source.publicKey(),
+        credentialId: input.credentialId,
+        networkPassphrase: options.networkPassphrase
+      });
+      const op = stellarSdk.Operation.createCustomContract({
+        address: stellarSdk.Address.fromString(source.publicKey()),
+        wasmHash: Buffer.from(wasmHash, "hex"),
+        salt: Buffer.from(sha256.sha256(raw)),
+        constructorArgs: [buildSecp256r1Signer({ credentialId: raw, publicKey: input.publicKey })]
+      });
+      const account = await server.getAccount(source.publicKey());
+      const tx = new stellarSdk.TransactionBuilder(account, {
+        fee: options.fee ?? "10000000",
+        networkPassphrase: options.networkPassphrase
+      }).addOperation(op).setTimeout(120).build();
+      const sim = await server.simulateTransaction(tx);
+      if (!stellarSdk.rpc.Api.isSimulationSuccess(sim)) {
+        throw new KitError("CONTRACT_AUTH_FAILED", "smart-wallet v1 deploy simulation failed");
+      }
+      const prepared = stellarSdk.rpc.assembleTransaction(tx, sim).build();
+      prepared.sign(source);
+      const sent = await server.sendTransaction(prepared);
+      if (sent.status === "ERROR") {
+        throw new KitError("NETWORK_ERROR", "smart-wallet v1 deploy submit error");
+      }
+      const final = await server.pollTransaction(sent.hash);
+      if (final.status !== stellarSdk.rpc.Api.GetTransactionStatus.SUCCESS) {
+        throw new KitError("CONTRACT_AUTH_FAILED", `smart-wallet v1 deploy ${final.status}`);
+      }
+      return { contractId, txHash: sent.hash };
+    }
+  };
+}
+var LEDGERS_PER_DAY2 = 17280;
+function smartWalletV1Indexer(options) {
+  const server = new stellarSdk.rpc.Server(options.rpcUrl, {
+    allowHttp: options.allowHttp ?? options.rpcUrl.startsWith("http://")
+  });
+  return {
+    async resolveByCredential(credentialId) {
+      const raw = decodeChallenge(credentialId);
+      const filters = [
+        {
+          type: "contract",
+          topics: [
+            [
+              stellarSdk.xdr.ScVal.scvSymbol("signer_added").toXDR("base64"),
+              buildSignerKeyScVal(raw).toXDR("base64")
+            ]
+          ]
+        }
+      ];
+      const startLedger = options.startLedger ?? Math.max(1, (await server.getLatestLedger()).sequence - LEDGERS_PER_DAY2);
+      const events = await collectEventsToTip(server, filters, startLedger);
+      const seen = /* @__PURE__ */ new Set();
+      const accounts = [];
+      for (const event of events) {
+        const contractId = event.contractId?.toString();
+        if (contractId && !seen.has(contractId)) {
+          seen.add(contractId);
+          accounts.push({ contractId });
+        }
+      }
+      return accounts;
+    }
+  };
+}
+
+exports.BATTLE_TESTED_ANCHORS = BATTLE_TESTED_ANCHORS;
+exports.KIT_ERROR_CODES = KIT_ERROR_CODES;
+exports.KitError = KitError;
+exports.SMART_WALLET_V1_WASM_HASH = SMART_WALLET_V1_WASM_HASH;
+exports.addSigner = addSigner;
+exports.applyAssertionToEntry = applyAssertionToEntry;
+exports.applyAssertionToSmartWalletEntry = applyAssertionToSmartWalletEntry;
+exports.assertES256 = assertES256;
+exports.assertUserActivation = assertUserActivation;
+exports.authEntryChallenge = authEntryChallenge;
+exports.authEntryChallengeBytes = authEntryChallengeBytes;
+exports.browserPasskeySigner = browserPasskeySigner;
+exports.browserWebAuthnClient = browserWebAuthnClient;
+exports.buildAddSignerOperation = buildAddSignerOperation;
+exports.buildCreateOptions = buildCreateOptions;
+exports.buildRemoveSignerOperation = buildRemoveSignerOperation;
+exports.buildSecp256r1Signer = buildSecp256r1Signer;
+exports.buildSignerKeyScVal = buildSignerKeyScVal;
+exports.buildSmartWalletSignatureVariant = buildSmartWalletSignatureVariant;
+exports.compareSignerKeyScVal = compareSignerKeyScVal;
+exports.connect = connect;
+exports.coseKeyToSec1 = coseKeyToSec1;
+exports.createPasskey = createPasskey;
+exports.decodeChallenge = decodeChallenge;
+exports.defaultAdapters = defaultAdapters;
+exports.defaultCredentialStorage = defaultCredentialStorage;
+exports.derToCompact = derToCompact;
+exports.derToCompactLowS = derToCompactLowS;
+exports.deriveAccountAddress = deriveAccountAddress;
+exports.deriveSmartWalletAddress = deriveSmartWalletAddress;
+exports.directSubmission = directSubmission;
+exports.encodeChallenge = encodeChallenge;
+exports.eventsIndexer = eventsIndexer;
+exports.extractPublicKeyFromAttestationObject = extractPublicKeyFromAttestationObject;
+exports.extractPublicKeyFromAuthData = extractPublicKeyFromAuthData;
+exports.factoryDeployer = factoryDeployer;
+exports.isKitError = isKitError;
+exports.isLowS = isLowS;
+exports.launchtubeSubmission = launchtubeSubmission;
+exports.mercuryIndexer = mercuryIndexer;
+exports.normalizeLowS = normalizeLowS;
+exports.openzeppelinRelayerSubmission = openzeppelinRelayerSubmission;
+exports.parseAuthenticatorData = parseAuthenticatorData;
+exports.parseClientDataJSON = parseClientDataJSON;
+exports.reconstructSignedPayload = reconstructSignedPayload;
+exports.recover = recover;
+exports.referenceCheckAuth = referenceCheckAuth;
+exports.referenceSmartWalletCheckAuth = referenceSmartWalletCheckAuth;
+exports.registerPasskey = registerPasskey;
+exports.removeSigner = removeSigner;
+exports.sendSmartWalletTx = sendSmartWalletTx;
+exports.signAuthEntry = signAuthEntry;
+exports.signTransaction = signTransaction;
+exports.smartWalletV1Deployer = smartWalletV1Deployer;
+exports.smartWalletV1Indexer = smartWalletV1Indexer;
+exports.verifyAssertionSignature = verifyAssertionSignature;
+exports.verifyClientDataJSON = verifyClientDataJSON;
+exports.verifyRpIdHash = verifyRpIdHash;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map