@stellar/stellar-sdk 16.0.1 → 16.2.0

package/lib/esm/webauth/challenge_transaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"challenge_transaction.js","sources":["../../../src/webauth/challenge_transaction.ts"],"sourcesContent":["import {\n  Keypair,\n  Account,\n  TransactionBuilder,\n  BASE_FEE,\n  Operation,\n  Memo,\n  MemoNone,\n  MemoID,\n  FeeBumpTransaction,\n  TimeoutInfinite,\n  Transaction,\n  Networks,\n} from \"../base/index.js\";\nimport { InvalidChallengeError } from \"./errors.js\";\nimport { gatherTxSigners, verifyTxSignedBy } from \"./utils.js\";\nimport { Utils } from \"../utils.js\";\nimport { ServerApi } from \"../horizon/server_api.js\";\nimport { uint8ArrayToBase64 } from \"uint8array-extras\";\n\n/**\n * Returns a valid {@link https://stellar.org/protocol/sep-10 | SEP-10}\n * challenge transaction which you can use for Stellar Web Authentication.\n * @param serverKeypair - Keypair for server's signing account.\n * @param clientAccountID - The stellar account (G...) or muxed account\n *    (M...) that the wallet wishes to authenticate with the server.\n * @param homeDomain - The fully qualified domain name of the service\n *    requiring authentication\n * @param timeout - Challenge duration (default to 5 minutes).\n * @param networkPassphrase - The network passphrase. If you pass this\n *    argument then timeout is required.\n * @param webAuthDomain - The fully qualified domain name of the service\n *    issuing the challenge.\n * @param memo - The memo to attach to the challenge transaction. The\n *    memo must be of type `id`. If the `clientaccountID` is a muxed account,\n *    memos cannot be used.\n * @param clientDomain - The fully qualified domain of the client\n *    requesting the challenge. Only necessary when the 'client_domain'\n *    parameter is passed.\n * @param clientSigningKey - The public key assigned to the SIGNING_KEY\n *    attribute specified on the stellar.toml hosted on the client domain. Only\n *    necessary when the 'client_domain' parameter is passed.\n * @returns A base64 encoded string of the raw TransactionEnvelope xdr\n *    struct for the transaction.\n * @throws Will throw if `clientAccountID` is a muxed account, and `memo`\n *    is present.\n * @throws Will throw if `clientDomain` is provided, but\n *    `clientSigningKey` is missing\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Keypair, Networks, WebAuth } from 'stellar-sdk'\n *\n * let serverKeyPair = Keypair.fromSecret(\"server-secret\")\n * let challenge = WebAuth.buildChallengeTx(\n *    serverKeyPair,\n *    \"client-stellar-account-id\",\n *    \"stellar.org\",\n *    300,\n *    Networks.TESTNET);\n * ```\n */\nexport function buildChallengeTx(\n  serverKeypair: Keypair,\n  clientAccountID: string,\n  homeDomain: string,\n\n  timeout: number = 300,\n  networkPassphrase: string,\n  webAuthDomain: string,\n  memo: string | null = null,\n  clientDomain: string | null = null,\n  clientSigningKey: string | null = null,\n): string {\n  if (clientAccountID.startsWith(\"M\") && memo) {\n    throw Error(\"memo cannot be used if clientAccountID is a muxed account\");\n  }\n\n  const account = new Account(serverKeypair.publicKey(), \"-1\");\n  const now = Math.floor(Date.now() / 1000);\n\n  // A Base64 digit represents 6 bits, to generate a random 64 bytes\n  // base64 string, we need 48 random bytes = (64 * 6)/8\n  //\n  // Each Base64 digit is in ASCII and each ASCII characters when\n  // turned into binary represents 8 bits = 1 bytes.\n  const value = uint8ArrayToBase64(crypto.getRandomValues(new Uint8Array(48)));\n\n  const builder = new TransactionBuilder(account, {\n    fee: BASE_FEE,\n    networkPassphrase,\n    timebounds: {\n      minTime: now,\n      maxTime: now + timeout,\n    },\n  })\n    .addOperation(\n      Operation.manageData({\n        name: `${homeDomain} auth`,\n        value,\n        source: clientAccountID,\n      }),\n    )\n    .addOperation(\n      Operation.manageData({\n        name: \"web_auth_domain\",\n        value: webAuthDomain,\n        source: account.accountId(),\n      }),\n    );\n\n  if (clientDomain) {\n    if (!clientSigningKey) {\n      throw Error(\"clientSigningKey is required if clientDomain is provided\");\n    }\n    builder.addOperation(\n      Operation.manageData({\n        name: `client_domain`,\n        value: clientDomain,\n        source: clientSigningKey,\n      }),\n    );\n  }\n\n  if (memo) {\n    builder.addMemo(Memo.id(memo));\n  }\n\n  const transaction = builder.build();\n  transaction.sign(serverKeypair);\n\n  return transaction.toEnvelope().toXDR(\"base64\").toString();\n}\n\n/**\n * Reads a SEP-10 challenge transaction and returns the decoded transaction and\n * client account ID contained within.\n *\n * It also verifies that the transaction has been signed by the server.\n *\n * It does not verify that the transaction has been signed by the client or that\n * any signatures other than the server's on the transaction are valid. Use one\n * of the following functions to completely verify the transaction:\n *\n * - {@link WebAuth.verifyChallengeTxThreshold}\n * - {@link WebAuth.verifyChallengeTxSigners}\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks})\n * @param homeDomains - The home domain that is expected\n *    to be included in the first Manage Data operation's string key. If an\n *    array is provided, one of the domain names in the array must match.\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key.\n *    If no such operation is included, this parameter is not used.\n * @returns The actual transaction and the\n *    Stellar public key (master key) used to sign the Manage Data operation,\n *    the matched home domain, and the memo attached to the transaction, which\n *    will be null if not present.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n */\nexport function readChallengeTx(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): {\n  tx: Transaction;\n  clientAccountID: string;\n  matchedHomeDomain: string;\n  memo: string | null;\n} {\n  if (serverAccountID.startsWith(\"M\")) {\n    throw Error(\n      \"Invalid serverAccountID: multiplexed accounts are not supported.\",\n    );\n  }\n\n  let transaction;\n  try {\n    transaction = new Transaction(challengeTx, networkPassphrase);\n  } catch {\n    try {\n      transaction = new FeeBumpTransaction(challengeTx, networkPassphrase);\n    } catch {\n      throw new InvalidChallengeError(\n        \"Invalid challenge: unable to deserialize challengeTx transaction string\",\n      );\n    }\n    throw new InvalidChallengeError(\n      \"Invalid challenge: expected a Transaction but received a FeeBumpTransaction\",\n    );\n  }\n\n  // verify sequence number\n  const sequence = Number.parseInt(transaction.sequence, 10);\n\n  if (sequence !== 0) {\n    throw new InvalidChallengeError(\n      \"The transaction sequence number should be zero\",\n    );\n  }\n\n  // verify transaction source\n  if (transaction.source !== serverAccountID) {\n    throw new InvalidChallengeError(\n      \"The transaction source account is not equal to the server's account\",\n    );\n  }\n\n  // verify operation\n  if (transaction.operations.length < 1) {\n    throw new InvalidChallengeError(\n      \"The transaction should contain at least one operation\",\n    );\n  }\n\n  const [operation, ...subsequentOperations] = transaction.operations;\n\n  if (!operation.source) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation should contain a source account\",\n    );\n  }\n  const clientAccountID: string = operation.source!;\n\n  let memo: string | null = null;\n  if (transaction.memo.type !== MemoNone) {\n    if (clientAccountID.startsWith(\"M\")) {\n      throw new InvalidChallengeError(\n        \"The transaction has a memo but the client account ID is a muxed account\",\n      );\n    }\n    if (transaction.memo.type !== MemoID) {\n      throw new InvalidChallengeError(\n        \"The transaction's memo must be of type `id`\",\n      );\n    }\n    memo = transaction.memo.value as string;\n  }\n\n  if (operation.type !== \"manageData\") {\n    throw new InvalidChallengeError(\n      \"The transaction's operation type should be 'manageData'\",\n    );\n  }\n\n  // verify timebounds\n  if (\n    transaction.timeBounds &&\n    Number.parseInt(transaction.timeBounds?.maxTime, 10) === TimeoutInfinite\n  ) {\n    throw new InvalidChallengeError(\n      \"The transaction requires non-infinite timebounds\",\n    );\n  }\n\n  // give a small grace period for the transaction time to account for clock drift\n  if (!Utils.validateTimebounds(transaction, 60 * 5)) {\n    throw new InvalidChallengeError(\"The transaction has expired\");\n  }\n\n  if (operation.value === undefined) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation values should not be null\",\n    );\n  }\n\n  // verify base64\n  if (!operation.value) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation value should not be null\",\n    );\n  }\n\n  if (Buffer.from(operation.value.toString(), \"base64\").length !== 48) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation value should be a 64 bytes base64 random string\",\n    );\n  }\n\n  // verify homeDomains\n  if (!homeDomains) {\n    throw new InvalidChallengeError(\n      \"Invalid homeDomains: a home domain must be provided for verification\",\n    );\n  }\n\n  let matchedHomeDomain;\n\n  if (typeof homeDomains === \"string\") {\n    if (`${homeDomains} auth` === operation.name) {\n      matchedHomeDomain = homeDomains;\n    }\n  } else if (Array.isArray(homeDomains)) {\n    matchedHomeDomain = homeDomains.find(\n      (domain) => `${domain} auth` === operation.name,\n    );\n  } else {\n    throw new InvalidChallengeError(\n      `Invalid homeDomains: homeDomains type is ${typeof homeDomains} but should be a string or an array`,\n    );\n  }\n\n  if (!matchedHomeDomain) {\n    throw new InvalidChallengeError(\n      \"Invalid homeDomains: the transaction's operation key name does not match the expected home domain\",\n    );\n  }\n\n  // verify any subsequent operations are manage data ops and source account is the server\n  for (const op of subsequentOperations) {\n    if (op.type !== \"manageData\") {\n      throw new InvalidChallengeError(\n        \"The transaction has operations that are not of type 'manageData'\",\n      );\n    }\n    if (op.source !== serverAccountID && op.name !== \"client_domain\") {\n      throw new InvalidChallengeError(\n        \"The transaction has operations that are unrecognized\",\n      );\n    }\n    if (op.name === \"web_auth_domain\") {\n      if (op.value === undefined) {\n        throw new InvalidChallengeError(\n          \"'web_auth_domain' operation value should not be null\",\n        );\n      }\n      if (op.value.compare(Buffer.from(webAuthDomain))) {\n        throw new InvalidChallengeError(\n          `'web_auth_domain' operation value does not match ${webAuthDomain}`,\n        );\n      }\n    }\n  }\n\n  if (!verifyTxSignedBy(transaction, serverAccountID)) {\n    throw new InvalidChallengeError(\n      `Transaction not signed by server: '${serverAccountID}'`,\n    );\n  }\n\n  return { tx: transaction, clientAccountID, matchedHomeDomain, memo };\n}\n\n/**\n * Verifies that for a SEP 10 challenge transaction all signatures on the\n * transaction are accounted for. A transaction is verified if it is signed by\n * the server account, and all other signatures match a signer that has been\n * provided as an argument (as the accountIDs list). Additional signers can be\n * provided that do not have a signature, but all signatures must be matched to\n * a signer (accountIDs) for verification to succeed. If verification succeeds,\n * a list of signers that were found is returned, not including the server\n * account ID.\n *\n * Signers that are not prefixed as an address/account ID strkey (G...) will be\n * ignored.\n *\n * Errors will be raised if:\n * - The transaction is invalid according to\n * {@link WebAuth.readChallengeTx}.\n * - No client signatures are found on the transaction.\n * - One or more signatures in the transaction are not identifiable as the\n * server account or one of the signers provided in the arguments.\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks}).\n * @param signers - The signers public keys. This list should\n *    contain the public keys for all signers that have signed the transaction.\n * @param homeDomains - The home domain(s) that should\n *    be included in the first Manage Data operation's string key. Required in\n *    readChallengeTx().\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key,\n *    if present. Used in readChallengeTx().\n * @returns The list of signers public keys that have signed\n *    the transaction, excluding the server account ID.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Networks, TransactionBuilder, WebAuth }  from 'stellar-sdk';\n *\n * const serverKP = Keypair.random();\n * const clientKP1 = Keypair.random();\n * const clientKP2 = Keypair.random();\n *\n * // Challenge, possibly built in the server side\n * const challenge = WebAuth.buildChallengeTx(\n *   serverKP,\n *   clientKP1.publicKey(),\n *   \"SDF\",\n *   300,\n *   Networks.TESTNET\n * );\n *\n * // clock.tick(200);  // Simulates a 200 ms delay when communicating from server to client\n *\n * // Transaction gathered from a challenge, possibly from the client side\n * const transaction = TransactionBuilder.fromXDR(challenge, Networks.TESTNET);\n * transaction.sign(clientKP1, clientKP2);\n * const signedChallenge = transaction\n *         .toEnvelope()\n *         .toXDR(\"base64\")\n *         .toString();\n *\n * // The result below should be equal to [clientKP1.publicKey(), clientKP2.publicKey()]\n * WebAuth.verifyChallengeTxSigners(\n *    signedChallenge,\n *    serverKP.publicKey(),\n *    Networks.TESTNET,\n *    threshold,\n *    [clientKP1.publicKey(), clientKP2.publicKey()]\n * );\n * ```\n */\nexport function verifyChallengeTxSigners(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  signers: string[],\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): string[] {\n  // Read the transaction which validates its structure.\n  const { tx } = readChallengeTx(\n    challengeTx,\n    serverAccountID,\n    networkPassphrase,\n    homeDomains,\n    webAuthDomain,\n  );\n\n  // Ensure the server account ID is an address and not a seed.\n  let serverKP: Keypair;\n  try {\n    serverKP = Keypair.fromPublicKey(serverAccountID); // can throw 'Invalid Stellar public key'\n  } catch (err: any) {\n    throw new Error(\n      `Couldn't infer keypair from the provided 'serverAccountID': ${\n        err.message\n      }`,\n    );\n  }\n\n  // Deduplicate the client signers and ensure the server is not included\n  // anywhere we check or output the list of signers.\n  const clientSigners = new Set<string>();\n  for (const signer of signers) {\n    // Ignore the server signer if it is in the signers list. It's\n    // important when verifying signers of a challenge transaction that we\n    // only verify and return client signers. If an account has the server\n    // as a signer the server should not play a part in the authentication\n    // of the client.\n    if (signer === serverKP.publicKey()) {\n      continue;\n    }\n\n    // Ignore non-G... account/address signers.\n    if (signer.charAt(0) !== \"G\") {\n      continue;\n    }\n\n    clientSigners.add(signer);\n  }\n\n  // Don't continue if none of the signers provided are in the final list.\n  if (clientSigners.size === 0) {\n    throw new InvalidChallengeError(\n      \"No verifiable client signers provided, at least one G... address must be provided\",\n    );\n  }\n\n  let clientSigningKey;\n  for (const op of tx.operations) {\n    if (op.type === \"manageData\" && op.name === \"client_domain\") {\n      if (clientSigningKey) {\n        throw new InvalidChallengeError(\n          \"Found more than one client_domain operation\",\n        );\n      }\n      clientSigningKey = op.source;\n    }\n  }\n\n  // Verify all the transaction's signers (server and client) in one\n  // hit. We do this in one hit here even though the server signature was\n  // checked in the ReadChallengeTx to ensure that every signature and signer\n  // are consumed only once on the transaction.\n  const allSigners: string[] = [\n    serverKP.publicKey(),\n    ...Array.from(clientSigners),\n  ];\n  if (clientSigningKey) {\n    allSigners.push(clientSigningKey);\n  }\n\n  const signersFound: string[] = gatherTxSigners(tx, allSigners);\n\n  let serverSignatureFound = false;\n  let clientSigningKeySignatureFound = false;\n  for (const signer of signersFound) {\n    if (signer === serverKP.publicKey()) {\n      serverSignatureFound = true;\n    }\n    if (signer === clientSigningKey) {\n      clientSigningKeySignatureFound = true;\n    }\n  }\n\n  // Confirm we matched a signature to the server signer.\n  if (!serverSignatureFound) {\n    throw new InvalidChallengeError(\n      `Transaction not signed by server: '${serverKP.publicKey()}'`,\n    );\n  }\n\n  // Confirm we matched a signature to the client domain's signer\n  if (clientSigningKey && !clientSigningKeySignatureFound) {\n    throw new InvalidChallengeError(\n      \"Transaction not signed by the source account of the 'client_domain' \" +\n        \"ManageData operation\",\n    );\n  }\n\n  // Confirm we matched at least one given signer with the transaction signatures\n  if (signersFound.length === 1) {\n    throw new InvalidChallengeError(\n      \"None of the given signers match the transaction signatures\",\n    );\n  }\n\n  // Confirm all signatures, including the server signature, were consumed by a signer:\n  if (signersFound.length !== tx.signatures.length) {\n    throw new InvalidChallengeError(\"Transaction has unrecognized signatures\");\n  }\n\n  // Remove the server public key before returning\n  signersFound.splice(signersFound.indexOf(serverKP.publicKey()), 1);\n  if (clientSigningKey) {\n    // Remove the client domain public key public key before returning\n    signersFound.splice(signersFound.indexOf(clientSigningKey), 1);\n  }\n\n  if (signersFound.length === 0) {\n    throw new InvalidChallengeError(\n      \"None of the given signers match the transaction signatures\",\n    );\n  }\n\n  return signersFound;\n}\n\n/**\n * Verifies that for a SEP-10 challenge transaction all signatures on the\n * transaction are accounted for and that the signatures meet a threshold on an\n * account. A transaction is verified if it is signed by the server account, and\n * all other signatures match a signer that has been provided as an argument,\n * and those signatures meet a threshold on the account.\n *\n * Signers that are not prefixed as an address/account ID strkey (G...) will be\n * ignored.\n *\n * Errors will be raised if:\n * - The transaction is invalid according to\n * {@link WebAuth.readChallengeTx}.\n * - No client signatures are found on the transaction.\n * - One or more signatures in the transaction are not identifiable as the\n * server account or one of the signers provided in the arguments.\n * - The signatures are all valid but do not meet the threshold.\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks}).\n * @param threshold - The required signatures threshold for verifying\n *    this transaction.\n * @param signerSummary - a map of all\n *    authorized signers to their weights. It's used to validate if the\n *    transaction signatures have met the given threshold.\n * @param homeDomains - The home domain(s) that should\n *    be included in the first Manage Data operation's string key. Required in\n *    `verifyChallengeTxSigners() => readChallengeTx()`.\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key,\n *    if present. Used in `verifyChallengeTxSigners() => readChallengeTx()`.\n * @returns The list of signers public keys that have signed\n *    the transaction, excluding the server account ID, given that the threshold\n *    was met.\n * @throws Will throw if the collective\n *    weight of the transaction's signers does not meet the necessary threshold\n *    to verify this transaction.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Networks, TransactionBuilder, WebAuth } from 'stellar-sdk';\n *\n * const serverKP = Keypair.random();\n * const clientKP1 = Keypair.random();\n * const clientKP2 = Keypair.random();\n *\n * // Challenge, possibly built in the server side\n * const challenge = WebAuth.buildChallengeTx(\n *   serverKP,\n *   clientKP1.publicKey(),\n *   \"SDF\",\n *   300,\n *   Networks.TESTNET\n * );\n *\n * // clock.tick(200);  // Simulates a 200 ms delay when communicating from server to client\n *\n * // Transaction gathered from a challenge, possibly from the client side\n * const transaction = TransactionBuilder.fromXDR(challenge, Networks.TESTNET);\n * transaction.sign(clientKP1, clientKP2);\n * const signedChallenge = transaction\n *         .toEnvelope()\n *         .toXDR(\"base64\")\n *         .toString();\n *\n * // Defining the threshold and signerSummary\n * const threshold = 3;\n * const signerSummary = [\n *    {\n *      key: this.clientKP1.publicKey(),\n *      weight: 1,\n *    },\n *    {\n *      key: this.clientKP2.publicKey(),\n *      weight: 2,\n *    },\n *  ];\n *\n * // The result below should be equal to [clientKP1.publicKey(), clientKP2.publicKey()]\n * WebAuth.verifyChallengeTxThreshold(\n *    signedChallenge,\n *    serverKP.publicKey(),\n *    Networks.TESTNET,\n *    threshold,\n *    signerSummary\n * );\n * ```\n */\nexport function verifyChallengeTxThreshold(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  threshold: number,\n  signerSummary: ServerApi.AccountRecordSigners[],\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): string[] {\n  const signers = signerSummary.map((signer) => signer.key);\n\n  const signersFound = verifyChallengeTxSigners(\n    challengeTx,\n    serverAccountID,\n    networkPassphrase,\n    signers,\n    homeDomains,\n    webAuthDomain,\n  );\n\n  let weight = 0;\n  for (const signer of signersFound) {\n    const sigWeight = signerSummary.find((s) => s.key === signer)?.weight || 0;\n    weight += sigWeight;\n  }\n\n  if (weight < threshold) {\n    throw new InvalidChallengeError(\n      `signers with weight ${weight} do not meet threshold ${threshold}\"`,\n    );\n  }\n\n  return signersFound;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DO,SAAS,gBAAA,CACd,aAAA,EACA,eAAA,EACA,UAAA,EAEA,OAAA,GAAkB,GAAA,EAClB,iBAAA,EACA,aAAA,EACA,IAAA,GAAsB,IAAA,EACtB,YAAA,GAA8B,IAAA,EAC9B,mBAAkC,IAAA,EAC1B;AACR,EAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,EAAM;AAC3C,IAAA,MAAM,MAAM,2DAA2D,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,aAAA,CAAc,SAAA,IAAa,IAAI,CAAA;AAC3D,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAOxC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA;AAE3E,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAA,EAAS;AAAA,IAC9C,GAAA,EAAK,QAAA;AAAA,IACL,iBAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,GAAA;AAAA,MACT,SAAS,GAAA,GAAM;AAAA;AACjB,GACD,CAAA,CACE,YAAA;AAAA,IACC,UAAU,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,GAAG,UAAU,CAAA,KAAA,CAAA;AAAA,MACnB,KAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT;AAAA,GACH,CACC,YAAA;AAAA,IACC,UAAU,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA,EAAO,aAAA;AAAA,MACP,MAAA,EAAQ,QAAQ,SAAA;AAAU,KAC3B;AAAA,GACH;AAEF,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,MAAA,MAAM,MAAM,0DAA0D,CAAA;AAAA,IACxE;AACA,IAAA,OAAA,CAAQ,YAAA;AAAA,MACN,UAAU,UAAA,CAAW;AAAA,QACnB,IAAA,EAAM,CAAA,aAAA,CAAA;AAAA,QACN,KAAA,EAAO,YAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACT;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,EAAA,CAAG,IAAI,CAAC,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,WAAA,GAAc,QAAQ,KAAA,EAAM;AAClC,EAAA,WAAA,CAAY,KAAK,aAAa,CAAA;AAE9B,EAAA,OAAO,YAAY,UAAA,EAAW,CAAE,KAAA,CAAM,QAAQ,EAAE,QAAA,EAAS;AAC3D;AA8BO,SAAS,eAAA,CACd,WAAA,EACA,eAAA,EACA,iBAAA,EACA,aACA,aAAA,EAMA;AACA,EAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,KAAA;AAAA,MACJ;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,WAAA,GAAc,IAAI,WAAA,CAAY,WAAA,EAAa,iBAAiB,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,IAAI,kBAAA,CAAmB,WAAA,EAAa,iBAAiB,CAAA;AAAA,IACrE,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,WAAA,CAAY,UAAU,EAAE,CAAA;AAEzD,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,WAAW,eAAA,EAAiB;AAC1C,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,SAAA,EAAW,GAAG,oBAAoB,IAAI,WAAA,CAAY,UAAA;AAEzD,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,kBAA0B,SAAA,CAAU,MAAA;AAE1C,EAAA,IAAI,IAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU;AACtC,IAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAA,KAAS,MAAA,EAAQ;AACpC,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,GAAO,YAAY,IAAA,CAAK,KAAA;AAAA,EAC1B;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,YAAA,EAAc;AACnC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IACE,WAAA,CAAY,cACZ,MAAA,CAAO,QAAA,CAAS,YAAY,UAAA,EAAY,OAAA,EAAS,EAAE,CAAA,KAAM,eAAA,EACzD;AACA,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,KAAA,CAAM,kBAAA,CAAmB,WAAA,EAAa,EAAA,GAAK,CAAC,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,sBAAsB,6BAA6B,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,SAAA,CAAU,UAAU,MAAA,EAAW;AACjC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,SAAA,CAAU,KAAA,CAAM,UAAS,EAAG,QAAQ,CAAA,CAAE,MAAA,KAAW,EAAA,EAAI;AACnE,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,iBAAA;AAEJ,EAAA,IAAI,OAAO,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAI,CAAA,EAAG,WAAW,CAAA,KAAA,CAAA,KAAY,SAAA,CAAU,IAAA,EAAM;AAC5C,MAAA,iBAAA,GAAoB,WAAA;AAAA,IACtB;AAAA,EACF,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AACrC,IAAA,iBAAA,GAAoB,WAAA,CAAY,IAAA;AAAA,MAC9B,CAAC,MAAA,KAAW,CAAA,EAAG,MAAM,YAAY,SAAA,CAAU;AAAA,KAC7C;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,OAAO,WAAW,CAAA,mCAAA;AAAA,KAChE;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,MAAM,oBAAA,EAAsB;AACrC,IAAA,IAAI,EAAA,CAAG,SAAS,YAAA,EAAc;AAC5B,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,EAAA,CAAG,MAAA,KAAW,eAAA,IAAmB,EAAA,CAAG,SAAS,eAAA,EAAiB;AAChE,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,EAAA,CAAG,SAAS,iBAAA,EAAmB;AACjC,MAAA,IAAI,EAAA,CAAG,UAAU,MAAA,EAAW;AAC1B,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,GAAG,KAAA,CAAM,OAAA,CAAQ,OAAO,IAAA,CAAK,aAAa,CAAC,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR,oDAAoD,aAAa,CAAA;AAAA,SACnE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,gBAAA,CAAiB,WAAA,EAAa,eAAe,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,sCAAsC,eAAe,CAAA,CAAA;AAAA,KACvD;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,WAAA,EAAa,eAAA,EAAiB,mBAAmB,IAAA,EAAK;AACrE;AAyEO,SAAS,yBACd,WAAA,EACA,eAAA,EACA,iBAAA,EACA,OAAA,EACA,aACA,aAAA,EACU;AAEV,EAAA,MAAM,EAAE,IAAG,GAAI,eAAA;AAAA,IACb,WAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,OAAA,CAAQ,cAAc,eAAe,CAAA;AAAA,EAClD,SAAS,GAAA,EAAU;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,4DAAA,EACE,IAAI,OACN,CAAA;AAAA,KACF;AAAA,EACF;AAIA,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAY;AACtC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAM5B,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,SAAA,EAAU,EAAG;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,GAAA,EAAK;AAC5B,MAAA;AAAA,IACF;AAEA,IAAA,aAAA,CAAc,IAAI,MAAM,CAAA;AAAA,EAC1B;AAGA,EAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,gBAAA;AACJ,EAAA,KAAA,MAAW,EAAA,IAAM,GAAG,UAAA,EAAY;AAC9B,IAAA,IAAI,EAAA,CAAG,IAAA,KAAS,YAAA,IAAgB,EAAA,CAAG,SAAS,eAAA,EAAiB;AAC3D,MAAA,IAAI,gBAAA,EAAkB;AACpB,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,gBAAA,GAAmB,EAAA,CAAG,MAAA;AAAA,IACxB;AAAA,EACF;AAMA,EAAA,MAAM,UAAA,GAAuB;AAAA,IAC3B,SAAS,SAAA,EAAU;AAAA,IACnB,GAAG,KAAA,CAAM,IAAA,CAAK,aAAa;AAAA,GAC7B;AACA,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,EAClC;AAEA,EAAA,MAAM,YAAA,GAAyB,eAAA,CAAgB,EAAA,EAAI,UAAU,CAAA;AAE7D,EAAA,IAAI,oBAAA,GAAuB,KAAA;AAC3B,EAAA,IAAI,8BAAA,GAAiC,KAAA;AACrC,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,SAAA,EAAU,EAAG;AACnC,MAAA,oBAAA,GAAuB,IAAA;AAAA,IACzB;AACA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAC/B,MAAA,8BAAA,GAAiC,IAAA;AAAA,IACnC;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,oBAAA,EAAsB;AACzB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA;AAAA,KAC5D;AAAA,EACF;AAGA,EAAA,IAAI,gBAAA,IAAoB,CAAC,8BAAA,EAAgC;AACvD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ;AAChD,IAAA,MAAM,IAAI,sBAAsB,yCAAyC,CAAA;AAAA,EAC3E;AAGA,EAAA,YAAA,CAAa,OAAO,YAAA,CAAa,OAAA,CAAQ,SAAS,SAAA,EAAW,GAAG,CAAC,CAAA;AACjE,EAAA,IAAI,gBAAA,EAAkB;AAEpB,IAAA,YAAA,CAAa,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,GAAG,CAAC,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;AA2FO,SAAS,2BACd,WAAA,EACA,eAAA,EACA,mBACA,SAAA,EACA,aAAA,EACA,aACA,aAAA,EACU;AACV,EAAA,MAAM,UAAU,aAAA,CAAc,GAAA,CAAI,CAAC,MAAA,KAAW,OAAO,GAAG,CAAA;AAExD,EAAA,MAAM,YAAA,GAAe,wBAAA;AAAA,IACnB,WAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,MAAM,SAAA,GAAY,cAAc,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,GAAA,KAAQ,MAAM,CAAA,EAAG,MAAA,IAAU,CAAA;AACzE,IAAA,MAAA,IAAU,SAAA;AAAA,EACZ;AAEA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,MAAM,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAA;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;;;;"}
+{"version":3,"file":"challenge_transaction.js","sources":["../../../src/webauth/challenge_transaction.ts"],"sourcesContent":["import {\n  Keypair,\n  Account,\n  TransactionBuilder,\n  BASE_FEE,\n  Operation,\n  Memo,\n  MemoNone,\n  MemoID,\n  FeeBumpTransaction,\n  TimeoutInfinite,\n  Transaction,\n  Networks,\n} from \"../base/index.js\";\nimport { InvalidChallengeError } from \"./errors.js\";\nimport { gatherTxSigners, verifyTxSignedBy } from \"./utils.js\";\nimport { Utils } from \"../utils.js\";\nimport { ServerApi } from \"../horizon/server_api.js\";\nimport { uint8ArrayToBase64 } from \"uint8array-extras\";\n\n/**\n * Returns a valid {@link https://stellar.org/protocol/sep-10 | SEP-10}\n * challenge transaction which you can use for Stellar Web Authentication.\n * @param serverKeypair - Keypair for server's signing account.\n * @param clientAccountID - The stellar account (G...) or muxed account\n *    (M...) that the wallet wishes to authenticate with the server.\n * @param homeDomain - The fully qualified domain name of the service\n *    requiring authentication\n * @param timeout - Challenge duration (default to 5 minutes).\n * @param networkPassphrase - The network passphrase. If you pass this\n *    argument then timeout is required.\n * @param webAuthDomain - The fully qualified domain name of the service\n *    issuing the challenge.\n * @param memo - The memo to attach to the challenge transaction. The\n *    memo must be of type `id`. If the `clientaccountID` is a muxed account,\n *    memos cannot be used.\n * @param clientDomain - The fully qualified domain of the client\n *    requesting the challenge. Only necessary when the 'client_domain'\n *    parameter is passed.\n * @param clientSigningKey - The public key assigned to the SIGNING_KEY\n *    attribute specified on the stellar.toml hosted on the client domain. Only\n *    necessary when the 'client_domain' parameter is passed.\n * @returns A base64 encoded string of the raw TransactionEnvelope xdr\n *    struct for the transaction.\n * @throws Will throw if `clientAccountID` is a muxed account, and `memo`\n *    is present.\n * @throws Will throw if `clientDomain` is provided, but\n *    `clientSigningKey` is missing\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Keypair, Networks, WebAuth } from 'stellar-sdk'\n *\n * let serverKeyPair = Keypair.fromSecret(\"server-secret\")\n * let challenge = WebAuth.buildChallengeTx(\n *    serverKeyPair,\n *    \"client-stellar-account-id\",\n *    \"stellar.org\",\n *    300,\n *    Networks.TESTNET);\n * ```\n */\nexport function buildChallengeTx(\n  serverKeypair: Keypair,\n  clientAccountID: string,\n  homeDomain: string,\n\n  timeout: number = 300,\n  networkPassphrase: string,\n  webAuthDomain: string,\n  memo: string | null = null,\n  clientDomain: string | null = null,\n  clientSigningKey: string | null = null,\n): string {\n  if (clientAccountID.startsWith(\"M\") && memo) {\n    throw Error(\"memo cannot be used if clientAccountID is a muxed account\");\n  }\n\n  const account = new Account(serverKeypair.publicKey(), \"-1\");\n  const now = Math.floor(Date.now() / 1000);\n\n  // A Base64 digit represents 6 bits, to generate a random 64 bytes\n  // base64 string, we need 48 random bytes = (64 * 6)/8\n  //\n  // Each Base64 digit is in ASCII and each ASCII characters when\n  // turned into binary represents 8 bits = 1 bytes.\n  const value = uint8ArrayToBase64(crypto.getRandomValues(new Uint8Array(48)));\n\n  const builder = new TransactionBuilder(account, {\n    fee: BASE_FEE,\n    networkPassphrase,\n    timebounds: {\n      minTime: now,\n      maxTime: now + timeout,\n    },\n  })\n    .addOperation(\n      Operation.manageData({\n        name: `${homeDomain} auth`,\n        value,\n        source: clientAccountID,\n      }),\n    )\n    .addOperation(\n      Operation.manageData({\n        name: \"web_auth_domain\",\n        value: webAuthDomain,\n        source: account.accountId(),\n      }),\n    );\n\n  if (clientDomain) {\n    if (!clientSigningKey) {\n      throw Error(\"clientSigningKey is required if clientDomain is provided\");\n    }\n    builder.addOperation(\n      Operation.manageData({\n        name: `client_domain`,\n        value: clientDomain,\n        source: clientSigningKey,\n      }),\n    );\n  }\n\n  if (memo) {\n    builder.addMemo(Memo.id(memo));\n  }\n\n  const transaction = builder.build();\n  transaction.sign(serverKeypair);\n\n  return transaction.toEnvelope().toXDR(\"base64\").toString();\n}\n\n/**\n * Reads a SEP-10 challenge transaction and returns the decoded transaction and\n * client account ID contained within.\n *\n * It also verifies that the transaction has been signed by the server.\n *\n * It does not verify that the transaction has been signed by the client or that\n * any signatures other than the server's on the transaction are valid. Use one\n * of the following functions to completely verify the transaction:\n *\n * - {@link WebAuth.verifyChallengeTxThreshold}\n * - {@link WebAuth.verifyChallengeTxSigners}\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks})\n * @param homeDomains - The home domain that is expected\n *    to be included in the first Manage Data operation's string key. If an\n *    array is provided, one of the domain names in the array must match.\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key.\n *    If no such operation is included, this parameter is not used.\n * @returns The actual transaction and the\n *    Stellar public key (master key) used to sign the Manage Data operation,\n *    the matched home domain, and the memo attached to the transaction, which\n *    will be null if not present.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n */\nexport function readChallengeTx(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): {\n  tx: Transaction;\n  clientAccountID: string;\n  matchedHomeDomain: string;\n  memo: string | null;\n} {\n  if (serverAccountID.startsWith(\"M\")) {\n    throw Error(\n      \"Invalid serverAccountID: multiplexed accounts are not supported.\",\n    );\n  }\n\n  let transaction;\n  try {\n    transaction = new Transaction(challengeTx, networkPassphrase);\n  } catch {\n    try {\n      transaction = new FeeBumpTransaction(challengeTx, networkPassphrase);\n    } catch {\n      throw new InvalidChallengeError(\n        \"Invalid challenge: unable to deserialize challengeTx transaction string\",\n      );\n    }\n    throw new InvalidChallengeError(\n      \"Invalid challenge: expected a Transaction but received a FeeBumpTransaction\",\n    );\n  }\n\n  // verify sequence number\n  const sequence = Number.parseInt(transaction.sequence, 10);\n\n  if (sequence !== 0) {\n    throw new InvalidChallengeError(\n      \"The transaction sequence number should be zero\",\n    );\n  }\n\n  // verify transaction source\n  if (transaction.source !== serverAccountID) {\n    throw new InvalidChallengeError(\n      \"The transaction source account is not equal to the server's account\",\n    );\n  }\n\n  // verify operation\n  if (transaction.operations.length < 1) {\n    throw new InvalidChallengeError(\n      \"The transaction should contain at least one operation\",\n    );\n  }\n\n  const [operation, ...subsequentOperations] = transaction.operations;\n\n  if (!operation.source) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation should contain a source account\",\n    );\n  }\n  const clientAccountID: string = operation.source!;\n\n  let memo: string | null = null;\n  if (transaction.memo.type !== MemoNone) {\n    if (clientAccountID.startsWith(\"M\")) {\n      throw new InvalidChallengeError(\n        \"The transaction has a memo but the client account ID is a muxed account\",\n      );\n    }\n    if (transaction.memo.type !== MemoID) {\n      throw new InvalidChallengeError(\n        \"The transaction's memo must be of type `id`\",\n      );\n    }\n    memo = transaction.memo.value as string;\n  }\n\n  if (operation.type !== \"manageData\") {\n    throw new InvalidChallengeError(\n      \"The transaction's operation type should be 'manageData'\",\n    );\n  }\n\n  // verify timebounds\n  if (\n    transaction.timeBounds &&\n    Number.parseInt(transaction.timeBounds?.maxTime, 10) === TimeoutInfinite\n  ) {\n    throw new InvalidChallengeError(\n      \"The transaction requires non-infinite timebounds\",\n    );\n  }\n\n  // give a small grace period for the transaction time to account for clock drift\n  if (!Utils.validateTimebounds(transaction, 60 * 5)) {\n    throw new InvalidChallengeError(\"The transaction has expired\");\n  }\n\n  if (operation.value === undefined) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation values should not be null\",\n    );\n  }\n\n  // verify base64\n  if (!operation.value) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation value should not be null\",\n    );\n  }\n\n  if (Buffer.from(operation.value.toString(), \"base64\").length !== 48) {\n    throw new InvalidChallengeError(\n      \"The transaction's operation value should be a 64 bytes base64 random string\",\n    );\n  }\n\n  // verify homeDomains\n  if (!homeDomains) {\n    throw new InvalidChallengeError(\n      \"Invalid homeDomains: a home domain must be provided for verification\",\n    );\n  }\n\n  let matchedHomeDomain;\n\n  if (typeof homeDomains === \"string\") {\n    if (`${homeDomains} auth` === operation.name) {\n      matchedHomeDomain = homeDomains;\n    }\n  } else if (Array.isArray(homeDomains)) {\n    matchedHomeDomain = homeDomains.find(\n      (domain) => `${domain} auth` === operation.name,\n    );\n  } else {\n    throw new InvalidChallengeError(\n      `Invalid homeDomains: homeDomains type is ${typeof homeDomains} but should be a string or an array`,\n    );\n  }\n\n  if (!matchedHomeDomain) {\n    throw new InvalidChallengeError(\n      \"Invalid homeDomains: the transaction's operation key name does not match the expected home domain\",\n    );\n  }\n\n  // verify any subsequent operations are manage data ops and source account is the server\n  for (const op of subsequentOperations) {\n    if (op.type !== \"manageData\") {\n      throw new InvalidChallengeError(\n        \"The transaction has operations that are not of type 'manageData'\",\n      );\n    }\n    if (op.source !== serverAccountID && op.name !== \"client_domain\") {\n      throw new InvalidChallengeError(\n        \"The transaction has operations that are unrecognized\",\n      );\n    }\n    if (op.name === \"web_auth_domain\") {\n      if (op.value === undefined) {\n        throw new InvalidChallengeError(\n          \"'web_auth_domain' operation value should not be null\",\n        );\n      }\n      if (op.value.compare(Buffer.from(webAuthDomain))) {\n        throw new InvalidChallengeError(\n          `'web_auth_domain' operation value does not match ${webAuthDomain}`,\n        );\n      }\n    }\n  }\n\n  if (!verifyTxSignedBy(transaction, serverAccountID)) {\n    throw new InvalidChallengeError(\n      `Transaction not signed by server: '${serverAccountID}'`,\n    );\n  }\n\n  return { tx: transaction, clientAccountID, matchedHomeDomain, memo };\n}\n\n/**\n * Verifies that for a SEP 10 challenge transaction all signatures on the\n * transaction are accounted for. A transaction is verified if it is signed by\n * the server account, and all other signatures match a signer that has been\n * provided as an argument (as the accountIDs list). Additional signers can be\n * provided that do not have a signature, but all signatures must be matched to\n * a signer (accountIDs) for verification to succeed. If verification succeeds,\n * a list of signers that were found is returned, not including the server\n * account ID.\n *\n * Signers that are not prefixed as an address/account ID strkey (G...) will be\n * ignored.\n *\n * Errors will be raised if:\n * - The transaction is invalid according to\n * {@link WebAuth.readChallengeTx}.\n * - No client signatures are found on the transaction.\n * - One or more signatures in the transaction are not identifiable as the\n * server account or one of the signers provided in the arguments.\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks}).\n * @param signers - The signers public keys. This list should\n *    contain the public keys for all signers that have signed the transaction.\n * @param homeDomains - The home domain(s) that should\n *    be included in the first Manage Data operation's string key. Required in\n *    readChallengeTx().\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key,\n *    if present. Used in readChallengeTx().\n * @returns The list of signers public keys that have signed\n *    the transaction, excluding the server account ID.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Networks, TransactionBuilder, WebAuth }  from 'stellar-sdk';\n *\n * const serverKP = Keypair.random();\n * const clientKP1 = Keypair.random();\n * const clientKP2 = Keypair.random();\n *\n * // Challenge, possibly built in the server side\n * const challenge = WebAuth.buildChallengeTx(\n *   serverKP,\n *   clientKP1.publicKey(),\n *   \"SDF\",\n *   300,\n *   Networks.TESTNET\n * );\n *\n * // clock.tick(200);  // Simulates a 200 ms delay when communicating from server to client\n *\n * // Transaction gathered from a challenge, possibly from the client side\n * const transaction = TransactionBuilder.fromXDR(challenge, Networks.TESTNET);\n * transaction.sign(clientKP1, clientKP2);\n * const signedChallenge = transaction\n *         .toEnvelope()\n *         .toXDR(\"base64\")\n *         .toString();\n *\n * // The result below should be equal to [clientKP1.publicKey(), clientKP2.publicKey()]\n * WebAuth.verifyChallengeTxSigners(\n *    signedChallenge,\n *    serverKP.publicKey(),\n *    Networks.TESTNET,\n *    threshold,\n *    [clientKP1.publicKey(), clientKP2.publicKey()]\n * );\n * ```\n */\nexport function verifyChallengeTxSigners(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  signers: string[],\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): string[] {\n  // Read the transaction which validates its structure.\n  const { tx } = readChallengeTx(\n    challengeTx,\n    serverAccountID,\n    networkPassphrase,\n    homeDomains,\n    webAuthDomain,\n  );\n\n  // Ensure the server account ID is an address and not a seed.\n  let serverKP: Keypair;\n  try {\n    serverKP = Keypair.fromPublicKey(serverAccountID); // can throw 'Invalid Stellar public key'\n  } catch (err: any) {\n    throw new Error(\n      `Couldn't infer keypair from the provided 'serverAccountID': ${\n        err.message\n      }`,\n    );\n  }\n\n  // Deduplicate the client signers and ensure the server is not included\n  // anywhere we check or output the list of signers.\n  const clientSigners = new Set<string>();\n  for (const signer of signers) {\n    // Ignore the server signer if it is in the signers list. It's\n    // important when verifying signers of a challenge transaction that we\n    // only verify and return client signers. If an account has the server\n    // as a signer the server should not play a part in the authentication\n    // of the client.\n    if (signer === serverKP.publicKey()) {\n      continue;\n    }\n\n    // Ignore non-G... account/address signers.\n    if (signer.charAt(0) !== \"G\") {\n      continue;\n    }\n\n    clientSigners.add(signer);\n  }\n\n  // Don't continue if none of the signers provided are in the final list.\n  if (clientSigners.size === 0) {\n    throw new InvalidChallengeError(\n      \"No verifiable client signers provided, at least one G... address must be provided\",\n    );\n  }\n\n  let clientSigningKey;\n  for (const op of tx.operations) {\n    if (op.type === \"manageData\" && op.name === \"client_domain\") {\n      if (clientSigningKey) {\n        throw new InvalidChallengeError(\n          \"Found more than one client_domain operation\",\n        );\n      }\n      clientSigningKey = op.source;\n    }\n  }\n\n  // Verify all the transaction's signers (server and client) in one\n  // hit. We do this in one hit here even though the server signature was\n  // checked in the ReadChallengeTx to ensure that every signature and signer\n  // are consumed only once on the transaction.\n  const allSigners: string[] = [\n    serverKP.publicKey(),\n    ...Array.from(clientSigners),\n  ];\n  if (clientSigningKey) {\n    allSigners.push(clientSigningKey);\n  }\n\n  const signersFound: string[] = gatherTxSigners(tx, allSigners);\n\n  let serverSignatureFound = false;\n  let clientSigningKeySignatureFound = false;\n  for (const signer of signersFound) {\n    if (signer === serverKP.publicKey()) {\n      serverSignatureFound = true;\n    }\n    if (signer === clientSigningKey) {\n      clientSigningKeySignatureFound = true;\n    }\n  }\n\n  // Confirm we matched a signature to the server signer.\n  if (!serverSignatureFound) {\n    throw new InvalidChallengeError(\n      `Transaction not signed by server: '${serverKP.publicKey()}'`,\n    );\n  }\n\n  // Confirm we matched a signature to the client domain's signer\n  if (clientSigningKey && !clientSigningKeySignatureFound) {\n    throw new InvalidChallengeError(\n      \"Transaction not signed by the source account of the 'client_domain' \" +\n        \"ManageData operation\",\n    );\n  }\n\n  // Confirm we matched at least one given signer with the transaction signatures\n  if (signersFound.length === 1) {\n    throw new InvalidChallengeError(\n      \"None of the given signers match the transaction signatures\",\n    );\n  }\n\n  // Confirm all signatures, including the server signature, were consumed by a signer:\n  if (signersFound.length !== tx.signatures.length) {\n    throw new InvalidChallengeError(\"Transaction has unrecognized signatures\");\n  }\n\n  // Remove the server public key before returning\n  signersFound.splice(signersFound.indexOf(serverKP.publicKey()), 1);\n  if (clientSigningKey) {\n    // Remove the client domain public key public key before returning\n    signersFound.splice(signersFound.indexOf(clientSigningKey), 1);\n  }\n\n  if (signersFound.length === 0) {\n    throw new InvalidChallengeError(\n      \"None of the given signers match the transaction signatures\",\n    );\n  }\n\n  return signersFound;\n}\n\n/**\n * Verifies that for a SEP-10 challenge transaction all signatures on the\n * transaction are accounted for and that the signatures meet a threshold on an\n * account. A transaction is verified if it is signed by the server account, and\n * all other signatures match a signer that has been provided as an argument,\n * and those signatures meet a threshold on the account.\n *\n * Signers that are not prefixed as an address/account ID strkey (G...) will be\n * ignored.\n *\n * Errors will be raised if:\n * - The transaction is invalid according to\n * {@link WebAuth.readChallengeTx}.\n * - No client signatures are found on the transaction.\n * - One or more signatures in the transaction are not identifiable as the\n * server account or one of the signers provided in the arguments.\n * - The signatures are all valid but do not meet the threshold.\n * @param challengeTx - SEP0010 challenge transaction in base64.\n * @param serverAccountID - The server's stellar account (public key).\n * @param networkPassphrase - The network passphrase, e.g.: 'Test SDF\n *    Network ; September 2015' (see {@link Networks}).\n * @param threshold - The required signatures threshold for verifying\n *    this transaction.\n * @param signerSummary - a map of all\n *    authorized signers to their weights. It's used to validate if the\n *    transaction signatures have met the given threshold.\n * @param homeDomains - The home domain(s) that should\n *    be included in the first Manage Data operation's string key. Required in\n *    `verifyChallengeTxSigners() => readChallengeTx()`.\n * @param webAuthDomain - The home domain that is expected to be included\n *    as the value of the Manage Data operation with the 'web_auth_domain' key,\n *    if present. Used in `verifyChallengeTxSigners() => readChallengeTx()`.\n * @returns The list of signers public keys that have signed\n *    the transaction, excluding the server account ID, given that the threshold\n *    was met.\n * @throws Will throw if the collective\n *    weight of the transaction's signers does not meet the necessary threshold\n *    to verify this transaction.\n * @see {@link https://stellar.org/protocol/sep-10 | SEP-10: Stellar Web Auth}\n * @example\n * ```ts\n * import { Networks, TransactionBuilder, WebAuth } from 'stellar-sdk';\n *\n * const serverKP = Keypair.random();\n * const clientKP1 = Keypair.random();\n * const clientKP2 = Keypair.random();\n *\n * // Challenge, possibly built in the server side\n * const challenge = WebAuth.buildChallengeTx(\n *   serverKP,\n *   clientKP1.publicKey(),\n *   \"SDF\",\n *   300,\n *   Networks.TESTNET\n * );\n *\n * // clock.tick(200);  // Simulates a 200 ms delay when communicating from server to client\n *\n * // Transaction gathered from a challenge, possibly from the client side\n * const transaction = TransactionBuilder.fromXDR(challenge, Networks.TESTNET);\n * transaction.sign(clientKP1, clientKP2);\n * const signedChallenge = transaction\n *         .toEnvelope()\n *         .toXDR(\"base64\")\n *         .toString();\n *\n * // Defining the threshold and signerSummary\n * const threshold = 3;\n * const signerSummary = [\n *    {\n *      key: this.clientKP1.publicKey(),\n *      weight: 1,\n *    },\n *    {\n *      key: this.clientKP2.publicKey(),\n *      weight: 2,\n *    },\n *  ];\n *\n * // The result below should be equal to [clientKP1.publicKey(), clientKP2.publicKey()]\n * WebAuth.verifyChallengeTxThreshold(\n *    signedChallenge,\n *    serverKP.publicKey(),\n *    Networks.TESTNET,\n *    threshold,\n *    signerSummary\n * );\n * ```\n */\nexport function verifyChallengeTxThreshold(\n  challengeTx: string,\n  serverAccountID: string,\n  networkPassphrase: string,\n  threshold: number,\n  signerSummary: ServerApi.AccountRecordSigners[],\n  homeDomains: string | string[],\n  webAuthDomain: string,\n): string[] {\n  const signers = signerSummary.map((signer) => signer.key);\n\n  const signersFound = verifyChallengeTxSigners(\n    challengeTx,\n    serverAccountID,\n    networkPassphrase,\n    signers,\n    homeDomains,\n    webAuthDomain,\n  );\n\n  let weight = 0;\n  for (const signer of signersFound) {\n    const sigWeight = signerSummary.find((s) => s.key === signer)?.weight || 0;\n    weight += sigWeight;\n  }\n\n  if (weight < threshold) {\n    throw new InvalidChallengeError(\n      `signers with weight ${weight} do not meet threshold ${threshold}\"`,\n    );\n  }\n\n  return signersFound;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;AA8DO,SAAS,gBAAA,CACd,aAAA,EACA,eAAA,EACA,UAAA,EAEA,OAAA,GAAkB,GAAA,EAClB,iBAAA,EACA,aAAA,EACA,IAAA,GAAsB,IAAA,EACtB,YAAA,GAA8B,IAAA,EAC9B,mBAAkC,IAAA,EAC1B;AACR,EAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,EAAM;AAC3C,IAAA,MAAM,MAAM,2DAA2D,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,aAAA,CAAc,SAAA,IAAa,IAAI,CAAA;AAC3D,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAOxC,EAAA,MAAM,KAAA,GAAQ,mBAAmB,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAC,CAAA;AAE3E,EAAA,MAAM,OAAA,GAAU,IAAI,kBAAA,CAAmB,OAAA,EAAS;AAAA,IAC9C,GAAA,EAAK,QAAA;AAAA,IACL,iBAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,GAAA;AAAA,MACT,SAAS,GAAA,GAAM;AAAA;AACjB,GACD,CAAA,CACE,YAAA;AAAA,IACC,UAAU,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,GAAG,UAAU,CAAA,KAAA,CAAA;AAAA,MACnB,KAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT;AAAA,GACH,CACC,YAAA;AAAA,IACC,UAAU,UAAA,CAAW;AAAA,MACnB,IAAA,EAAM,iBAAA;AAAA,MACN,KAAA,EAAO,aAAA;AAAA,MACP,MAAA,EAAQ,QAAQ,SAAA;AAAU,KAC3B;AAAA,GACH;AAEF,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,MAAA,MAAM,MAAM,0DAA0D,CAAA;AAAA,IACxE;AACA,IAAA,OAAA,CAAQ,YAAA;AAAA,MACN,UAAU,UAAA,CAAW;AAAA,QACnB,IAAA,EAAM,CAAA,aAAA,CAAA;AAAA,QACN,KAAA,EAAO,YAAA;AAAA,QACP,MAAA,EAAQ;AAAA,OACT;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,EAAA,CAAG,IAAI,CAAC,CAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,WAAA,GAAc,QAAQ,KAAA,EAAM;AAClC,EAAA,WAAA,CAAY,KAAK,aAAa,CAAA;AAE9B,EAAA,OAAO,YAAY,UAAA,EAAW,CAAE,KAAA,CAAM,QAAQ,EAAE,QAAA,EAAS;AAC3D;AA8BO,SAAS,eAAA,CACd,WAAA,EACA,eAAA,EACA,iBAAA,EACA,aACA,aAAA,EAMA;AACA,EAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,KAAA;AAAA,MACJ;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,WAAA,GAAc,IAAI,WAAA,CAAY,WAAA,EAAa,iBAAiB,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,IAAI,kBAAA,CAAmB,WAAA,EAAa,iBAAiB,CAAA;AAAA,IACrE,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,WAAA,CAAY,UAAU,EAAE,CAAA;AAEzD,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,WAAW,eAAA,EAAiB;AAC1C,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,SAAA,EAAW,GAAG,oBAAoB,IAAI,WAAA,CAAY,UAAA;AAEzD,EAAA,IAAI,CAAC,UAAU,MAAA,EAAQ;AACrB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,kBAA0B,SAAA,CAAU,MAAA;AAE1C,EAAA,IAAI,IAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAA,KAAS,QAAA,EAAU;AACtC,IAAA,IAAI,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAA,KAAS,MAAA,EAAQ;AACpC,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,GAAO,YAAY,IAAA,CAAK,KAAA;AAAA,EAC1B;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,YAAA,EAAc;AACnC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IACE,WAAA,CAAY,cACZ,MAAA,CAAO,QAAA,CAAS,YAAY,UAAA,EAAY,OAAA,EAAS,EAAE,CAAA,KAAM,eAAA,EACzD;AACA,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,KAAA,CAAM,kBAAA,CAAmB,WAAA,EAAa,EAAA,GAAK,CAAC,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,sBAAsB,6BAA6B,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,SAAA,CAAU,UAAU,MAAA,EAAW;AACjC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,UAAU,KAAA,EAAO;AACpB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,SAAA,CAAU,KAAA,CAAM,UAAS,EAAG,QAAQ,CAAA,CAAE,MAAA,KAAW,EAAA,EAAI;AACnE,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,iBAAA;AAEJ,EAAA,IAAI,OAAO,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAI,CAAA,EAAG,WAAW,CAAA,KAAA,CAAA,KAAY,SAAA,CAAU,IAAA,EAAM;AAC5C,MAAA,iBAAA,GAAoB,WAAA;AAAA,IACtB;AAAA,EACF,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AACrC,IAAA,iBAAA,GAAoB,WAAA,CAAY,IAAA;AAAA,MAC9B,CAAC,MAAA,KAAW,CAAA,EAAG,MAAM,YAAY,SAAA,CAAU;AAAA,KAC7C;AAAA,EACF,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,OAAO,WAAW,CAAA,mCAAA;AAAA,KAChE;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,MAAM,oBAAA,EAAsB;AACrC,IAAA,IAAI,EAAA,CAAG,SAAS,YAAA,EAAc;AAC5B,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,EAAA,CAAG,MAAA,KAAW,eAAA,IAAmB,EAAA,CAAG,SAAS,eAAA,EAAiB;AAChE,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,EAAA,CAAG,SAAS,iBAAA,EAAmB;AACjC,MAAA,IAAI,EAAA,CAAG,UAAU,MAAA,EAAW;AAC1B,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,GAAG,KAAA,CAAM,OAAA,CAAQ,OAAO,IAAA,CAAK,aAAa,CAAC,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR,oDAAoD,aAAa,CAAA;AAAA,SACnE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,gBAAA,CAAiB,WAAA,EAAa,eAAe,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,sCAAsC,eAAe,CAAA,CAAA;AAAA,KACvD;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,WAAA,EAAa,eAAA,EAAiB,mBAAmB,IAAA,EAAK;AACrE;AAyEO,SAAS,yBACd,WAAA,EACA,eAAA,EACA,iBAAA,EACA,OAAA,EACA,aACA,aAAA,EACU;AAEV,EAAA,MAAM,EAAE,IAAG,GAAI,eAAA;AAAA,IACb,WAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,OAAA,CAAQ,cAAc,eAAe,CAAA;AAAA,EAClD,SAAS,GAAA,EAAU;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,4DAAA,EACE,IAAI,OACN,CAAA;AAAA,KACF;AAAA,EACF;AAIA,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAY;AACtC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAM5B,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,SAAA,EAAU,EAAG;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,GAAA,EAAK;AAC5B,MAAA;AAAA,IACF;AAEA,IAAA,aAAA,CAAc,IAAI,MAAM,CAAA;AAAA,EAC1B;AAGA,EAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,gBAAA;AACJ,EAAA,KAAA,MAAW,EAAA,IAAM,GAAG,UAAA,EAAY;AAC9B,IAAA,IAAI,EAAA,CAAG,IAAA,KAAS,YAAA,IAAgB,EAAA,CAAG,SAAS,eAAA,EAAiB;AAC3D,MAAA,IAAI,gBAAA,EAAkB;AACpB,QAAA,MAAM,IAAI,qBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,gBAAA,GAAmB,EAAA,CAAG,MAAA;AAAA,IACxB;AAAA,EACF;AAMA,EAAA,MAAM,UAAA,GAAuB;AAAA,IAC3B,SAAS,SAAA,EAAU;AAAA,IACnB,GAAG,KAAA,CAAM,IAAA,CAAK,aAAa;AAAA,GAC7B;AACA,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,EAClC;AAEA,EAAA,MAAM,YAAA,GAAyB,eAAA,CAAgB,EAAA,EAAI,UAAU,CAAA;AAE7D,EAAA,IAAI,oBAAA,GAAuB,KAAA;AAC3B,EAAA,IAAI,8BAAA,GAAiC,KAAA;AACrC,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,KAAW,QAAA,CAAS,SAAA,EAAU,EAAG;AACnC,MAAA,oBAAA,GAAuB,IAAA;AAAA,IACzB;AACA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAC/B,MAAA,8BAAA,GAAiC,IAAA;AAAA,IACnC;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,oBAAA,EAAsB;AACzB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA;AAAA,KAC5D;AAAA,EACF;AAGA,EAAA,IAAI,gBAAA,IAAoB,CAAC,8BAAA,EAAgC;AACvD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AAGA,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ;AAChD,IAAA,MAAM,IAAI,sBAAsB,yCAAyC,CAAA;AAAA,EAC3E;AAGA,EAAA,YAAA,CAAa,OAAO,YAAA,CAAa,OAAA,CAAQ,SAAS,SAAA,EAAW,GAAG,CAAC,CAAA;AACjE,EAAA,IAAI,gBAAA,EAAkB;AAEpB,IAAA,YAAA,CAAa,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,GAAG,CAAC,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;AA2FO,SAAS,2BACd,WAAA,EACA,eAAA,EACA,mBACA,SAAA,EACA,aAAA,EACA,aACA,aAAA,EACU;AACV,EAAA,MAAM,UAAU,aAAA,CAAc,GAAA,CAAI,CAAC,MAAA,KAAW,OAAO,GAAG,CAAA;AAExD,EAAA,MAAM,YAAA,GAAe,wBAAA;AAAA,IACnB,WAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,MAAM,SAAA,GAAY,cAAc,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,GAAA,KAAQ,MAAM,CAAA,EAAG,MAAA,IAAU,CAAA;AACzE,IAAA,MAAA,IAAU,SAAA;AAAA,EACZ;AAEA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,oBAAA,EAAuB,MAAM,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAA;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;;;;"}

package/lib/esm/webauth/utils.js

@@ -1,24 +1,5 @@
-import '../node_modules/.pnpm/@stellar_js-xdr@4.0.0/node_modules/@stellar/js-xdr/src/int.js';
-import '../node_modules/.pnpm/@stellar_js-xdr@4.0.0/node_modules/@stellar/js-xdr/src/hyper.js';
-import '../node_modules/.pnpm/@stellar_js-xdr@4.0.0/node_modules/@stellar/js-xdr/src/unsigned-int.js';
-import '../node_modules/.pnpm/@stellar_js-xdr@4.0.0/node_modules/@stellar/js-xdr/src/unsigned-hyper.js';
-import '../node_modules/.pnpm/@stellar_js-xdr@4.0.0/node_modules/@stellar/js-xdr/src/xdr-type.js';
-import 'buffer';
-import '../base/generated/curr_generated.js';
-import '@noble/hashes/sha2.js';
-import '../base/signing.js';
-import { Keypair } from '../base/keypair.js';
-import 'base32.js';
-import '../base/util/continued_fraction.js';
-import '../base/util/bignumber.js';
-import '../base/transaction_builder.js';
-import '../base/muxed_account.js';
-import '../base/scval.js';
-import '../base/numbers/uint128.js';
-import '../base/numbers/uint256.js';
-import '../base/numbers/int128.js';
-import '../base/numbers/int256.js';
 import { InvalidChallengeError } from './errors.js';
+import { Keypair } from '../base/keypair.js';
 
 function gatherTxSigners(transaction, signers) {
   const hashedSignatureBase = transaction.hash();

package/lib/esm/webauth/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sources":["../../../src/webauth/utils.ts"],"sourcesContent":["/**\n * Stellar Web Authentication\n * @see {@link https://stellar.org/protocol-10 | SEP-10 Specification}\n */\n\nimport { FeeBumpTransaction, Keypair, Transaction } from \"../base/index.js\";\nimport { InvalidChallengeError } from \"./errors.js\";\n/**\n * Checks if a transaction has been signed by one or more of the given signers,\n * returning a list of non-repeated signers that were found to have signed the\n * given transaction.\n *\n * @param transaction - The signed transaction.\n * @param signers - The signer's public keys.\n * @returns A list of signers that were found to have signed\n *    the transaction.\n *\n * @example\n * ```ts\n * let keypair1 = Keypair.random();\n * let keypair2 = Keypair.random();\n * const account = new StellarSdk.Account(keypair1.publicKey(), \"-1\");\n *\n * const transaction = new TransactionBuilder(account, { fee: 100 })\n *    .setTimeout(30)\n *    .build();\n *\n * transaction.sign(keypair1, keypair2)\n * WebAuth.gatherTxSigners(transaction, [keypair1.publicKey(), keypair2.publicKey()])\n * ```\n */\nexport function gatherTxSigners(\n  transaction: FeeBumpTransaction | Transaction,\n  signers: string[],\n): string[] {\n  const hashedSignatureBase = transaction.hash();\n\n  const txSignatures = [...transaction.signatures]; // shallow copy for safe splicing\n  const signersFound = new Set<string>();\n\n  for (const signer of signers) {\n    if (txSignatures.length === 0) {\n      break;\n    }\n\n    let keypair: Keypair;\n    try {\n      keypair = Keypair.fromPublicKey(signer); // This can throw a few different errors\n    } catch (err: any) {\n      throw new InvalidChallengeError(\n        `Signer is not a valid address: ${err.message}`,\n      );\n    }\n\n    for (let i = 0; i < txSignatures.length; i++) {\n      const decSig = txSignatures[i];\n\n      if (!decSig.hint().equals(keypair.signatureHint())) {\n        continue;\n      }\n\n      if (keypair.verify(hashedSignatureBase, decSig.signature())) {\n        signersFound.add(signer);\n        txSignatures.splice(i, 1);\n        break;\n      }\n    }\n  }\n\n  return Array.from(signersFound);\n}\n\n/**\n * Verifies if a transaction was signed by the given account id.\n *\n * @param transaction - The signed transaction.\n * @param accountID - The signer's public key.\n * @returns Whether or not `accountID` was found to have signed the\n *    transaction.\n *\n * @example\n * ```ts\n * let keypair = Keypair.random();\n * const account = new StellarSdk.Account(keypair.publicKey(), \"-1\");\n *\n * const transaction = new TransactionBuilder(account, { fee: 100 })\n *    .setTimeout(30)\n *    .build();\n *\n * transaction.sign(keypair)\n * WebAuth.verifyTxSignedBy(transaction, keypair.publicKey())\n * ```\n */\nexport function verifyTxSignedBy(\n  transaction: FeeBumpTransaction | Transaction,\n  accountID: string,\n): boolean {\n  return gatherTxSigners(transaction, [accountID]).length !== 0;\n}\n\n/**\n * A parsed and validated challenge transaction, and some of its constituent details.\n */\nexport type ChallengeTxDetails = {\n  /** The challenge transaction. */\n  tx: Transaction;\n  /** The Stellar public key (master key) used to sign the Manage Data operation. */\n  clientAccountId: string;\n  /** The matched home domain. */\n  matchedHomeDomain: string;\n  /** The memo attached to the transaction, which will be null if not present */\n  memo?: string;\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+BO,SAAS,eAAA,CACd,aACA,OAAA,EACU;AACV,EAAA,MAAM,mBAAA,GAAsB,YAAY,IAAA,EAAK;AAE7C,EAAA,MAAM,YAAA,GAAe,CAAC,GAAG,WAAA,CAAY,UAAU,CAAA;AAC/C,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AAErC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,OAAA,CAAQ,cAAc,MAAM,CAAA;AAAA,IACxC,SAAS,GAAA,EAAU;AACjB,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,CAAA,+BAAA,EAAkC,IAAI,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AAEA,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,MAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAE7B,MAAA,IAAI,CAAC,OAAO,IAAA,EAAK,CAAE,OAAO,OAAA,CAAQ,aAAA,EAAe,CAAA,EAAG;AAClD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,QAAQ,MAAA,CAAO,mBAAA,EAAqB,MAAA,CAAO,SAAA,EAAW,CAAA,EAAG;AAC3D,QAAA,YAAA,CAAa,IAAI,MAAM,CAAA;AACvB,QAAA,YAAA,CAAa,MAAA,CAAO,GAAG,CAAC,CAAA;AACxB,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,YAAY,CAAA;AAChC;AAuBO,SAAS,gBAAA,CACd,aACA,SAAA,EACS;AACT,EAAA,OAAO,gBAAgB,WAAA,EAAa,CAAC,SAAS,CAAC,EAAE,MAAA,KAAW,CAAA;AAC9D;;;;"}
+{"version":3,"file":"utils.js","sources":["../../../src/webauth/utils.ts"],"sourcesContent":["/**\n * Stellar Web Authentication\n * @see {@link https://stellar.org/protocol-10 | SEP-10 Specification}\n */\n\nimport { FeeBumpTransaction, Keypair, Transaction } from \"../base/index.js\";\nimport { InvalidChallengeError } from \"./errors.js\";\n/**\n * Checks if a transaction has been signed by one or more of the given signers,\n * returning a list of non-repeated signers that were found to have signed the\n * given transaction.\n *\n * @param transaction - The signed transaction.\n * @param signers - The signer's public keys.\n * @returns A list of signers that were found to have signed\n *    the transaction.\n *\n * @example\n * ```ts\n * let keypair1 = Keypair.random();\n * let keypair2 = Keypair.random();\n * const account = new StellarSdk.Account(keypair1.publicKey(), \"-1\");\n *\n * const transaction = new TransactionBuilder(account, { fee: 100 })\n *    .setTimeout(30)\n *    .build();\n *\n * transaction.sign(keypair1, keypair2)\n * WebAuth.gatherTxSigners(transaction, [keypair1.publicKey(), keypair2.publicKey()])\n * ```\n */\nexport function gatherTxSigners(\n  transaction: FeeBumpTransaction | Transaction,\n  signers: string[],\n): string[] {\n  const hashedSignatureBase = transaction.hash();\n\n  const txSignatures = [...transaction.signatures]; // shallow copy for safe splicing\n  const signersFound = new Set<string>();\n\n  for (const signer of signers) {\n    if (txSignatures.length === 0) {\n      break;\n    }\n\n    let keypair: Keypair;\n    try {\n      keypair = Keypair.fromPublicKey(signer); // This can throw a few different errors\n    } catch (err: any) {\n      throw new InvalidChallengeError(\n        `Signer is not a valid address: ${err.message}`,\n      );\n    }\n\n    for (let i = 0; i < txSignatures.length; i++) {\n      const decSig = txSignatures[i];\n\n      if (!decSig.hint().equals(keypair.signatureHint())) {\n        continue;\n      }\n\n      if (keypair.verify(hashedSignatureBase, decSig.signature())) {\n        signersFound.add(signer);\n        txSignatures.splice(i, 1);\n        break;\n      }\n    }\n  }\n\n  return Array.from(signersFound);\n}\n\n/**\n * Verifies if a transaction was signed by the given account id.\n *\n * @param transaction - The signed transaction.\n * @param accountID - The signer's public key.\n * @returns Whether or not `accountID` was found to have signed the\n *    transaction.\n *\n * @example\n * ```ts\n * let keypair = Keypair.random();\n * const account = new StellarSdk.Account(keypair.publicKey(), \"-1\");\n *\n * const transaction = new TransactionBuilder(account, { fee: 100 })\n *    .setTimeout(30)\n *    .build();\n *\n * transaction.sign(keypair)\n * WebAuth.verifyTxSignedBy(transaction, keypair.publicKey())\n * ```\n */\nexport function verifyTxSignedBy(\n  transaction: FeeBumpTransaction | Transaction,\n  accountID: string,\n): boolean {\n  return gatherTxSigners(transaction, [accountID]).length !== 0;\n}\n\n/**\n * A parsed and validated challenge transaction, and some of its constituent details.\n */\nexport type ChallengeTxDetails = {\n  /** The challenge transaction. */\n  tx: Transaction;\n  /** The Stellar public key (master key) used to sign the Manage Data operation. */\n  clientAccountId: string;\n  /** The matched home domain. */\n  matchedHomeDomain: string;\n  /** The memo attached to the transaction, which will be null if not present */\n  memo?: string;\n};\n"],"names":[],"mappings":";;;AA+BO,SAAS,eAAA,CACd,aACA,OAAA,EACU;AACV,EAAA,MAAM,mBAAA,GAAsB,YAAY,IAAA,EAAK;AAE7C,EAAA,MAAM,YAAA,GAAe,CAAC,GAAG,WAAA,CAAY,UAAU,CAAA;AAC/C,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AAErC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,OAAA,CAAQ,cAAc,MAAM,CAAA;AAAA,IACxC,SAAS,GAAA,EAAU;AACjB,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,CAAA,+BAAA,EAAkC,IAAI,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AAEA,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,MAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAE7B,MAAA,IAAI,CAAC,OAAO,IAAA,EAAK,CAAE,OAAO,OAAA,CAAQ,aAAA,EAAe,CAAA,EAAG;AAClD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,QAAQ,MAAA,CAAO,mBAAA,EAAqB,MAAA,CAAO,SAAA,EAAW,CAAA,EAAG;AAC3D,QAAA,YAAA,CAAa,IAAI,MAAM,CAAA;AACvB,QAAA,YAAA,CAAa,MAAA,CAAO,GAAG,CAAC,CAAA;AACxB,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,YAAY,CAAA;AAChC;AAuBO,SAAS,gBAAA,CACd,aACA,SAAA,EACS;AACT,EAAA,OAAO,gBAAgB,WAAA,EAAa,CAAC,SAAS,CAAC,EAAE,MAAA,KAAW,CAAA;AAC9D;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stellar/stellar-sdk",
-  "version": "16.0.1",
+  "version": "16.2.0",
   "type": "module",
   "packageManager": "pnpm@10.28.0",
   "description": "A library for working with the Stellar network, including communication with the Horizon and Soroban RPC servers.",
@@ -40,6 +40,12 @@
       "require": "./lib/cjs/index.js",
       "default": "./lib/esm/index.js"
     },
+    "./base": {
+      "types": "./lib/esm/base/index.d.ts",
+      "import": "./lib/esm/base/index.js",
+      "require": "./lib/cjs/base/index.js",
+      "default": "./lib/esm/base/index.js"
+    },
     "./contract": {
       "types": "./lib/esm/contract/index.d.ts",
       "import": "./lib/esm/contract/index.js",
@@ -91,29 +97,32 @@
     "postbuild:lib:axios": "node config/write-module-type.js lib/axios/cjs commonjs",
     "clean": "rm -rf lib/ dist/ coverage/ jsdoc/ test/e2e/.soroban",
     "clean:bundle-size": "rm -rf node_modules lib/ dist/ coverage/ jsdoc/ test/e2e/.soroban",
-    "docs": "pnpm docs:reference && pnpm docs:llms && pnpm docs:robots && pnpm docs:htaccess && pnpm docs:site",
+    "docs": "pnpm docs:snippets:check && pnpm docs:reference && pnpm docs:llms && pnpm docs:robots && pnpm docs:htaccess && pnpm docs:site",
     "docs:reference": "tsx scripts/build-docs.ts",
+    "docs:snippets:check": "tsx scripts/check-snippets.ts && tsc -p test/guides/tsconfig.json",
     "docs:llms": "tsx scripts/build-llms.ts",
     "docs:robots": "tsx scripts/build-robots.ts",
     "docs:htaccess": "tsx scripts/build-htaccess.ts",
     "docs:site": "astro build && tsx scripts/build-md-siblings.ts",
     "docs:dev": "astro dev",
     "docs:preview": "astro preview",
-    "test": "pnpm run test:node && pnpm run test:node:axios && pnpm run test:integration && pnpm run test:browser",
-    "test:all": "pnpm run test:node && pnpm run test:node:axios && pnpm run test:integration && pnpm run test:browser && pnpm run test:e2e",
+    "test": "pnpm run docs:snippets:check && pnpm run test:node && pnpm run test:node:axios && pnpm run test:integration && pnpm run test:browser",
+    "test:all": "pnpm run test:node && pnpm run test:node:axios && pnpm run test:integration && pnpm run test:guides && pnpm run test:browser && pnpm run test:e2e",
     "test:e2e": "./test/e2e/initialize.sh && vitest run --config config/vitest.config.e2e.ts --coverage",
     "test:node": "vitest run test/unit --config config/vitest.config.ts --coverage",
     "test:node:axios": "cross-env TRANSPORT=axios vitest run test/unit --config config/vitest.config.ts",
     "test:e2e:noeval": "NODE_OPTIONS=--disallow-code-generation-from-strings pnpm run test:e2e",
     "test:integration": "vitest run test/integration --config config/vitest.config.ts --coverage",
+    "test:guides": "pnpm run docs:snippets:check && vitest run --config config/vitest.config.guides.ts --no-file-parallelism",
+    "test:guides:local": "cross-env GUIDES_TARGET=local vitest run --config config/vitest.config.guides.ts --no-file-parallelism",
     "test:browser": "pnpm run build:lib && vitest run --config config/vitest.config.browser.ts test/unit --coverage",
     "test:browser:axios": "pnpm run build:lib:axios && cross-env TRANSPORT=axios vitest run --config config/vitest.config.browser.ts test/unit",
     "fmt": "pnpm run _prettier && eslint src/ --fix",
-    "preversion": "pnpm run clean && pnpm run _prettier && pnpm run build:prod && pnpm run test",
+    "preversion": "pnpm run clean && pnpm run _prettier && pnpm run build:prod && pnpm run test && pnpm run test:guides",
     "prepare": "pnpm run build:prod && pnpm run setup && husky",
     "download-sac-spec": "node scripts/download-sac-spec.js",
     "_build": "pnpm run clean && pnpm run build:lib:all && pnpm run build:types:all",
-    "_prettier": "prettier --ignore-path config/.prettierignore --write './src/**/*.ts' './test/**/*.{js,ts}'"
+    "_prettier": "prettier --ignore-path config/.prettierignore --write './src/**/*.ts' './test/**/*.{js,ts}' './examples/**/*.ts'"
   },
   "lint-staged": {
     "**/*.{js,json,ts}": [
@@ -124,11 +133,13 @@
     "node": ">=22.0.0"
   },
   "devDependencies": {
+    "@astrojs/markdown-remark": "^7.2.0",
     "@astrojs/sitemap": "^3.7.3",
-    "@astrojs/starlight": "^0.39.2",
+    "@astrojs/starlight": "^0.41.3",
     "@eslint/compat": "^1.4.1",
     "@eslint/js": "^9.39.4",
-    "@rollup/plugin-commonjs": "^29.0.2",
+    "@noble/curves": "^2.2.0",
+    "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-inject": "^5.0.5",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-replace": "^6.0.2",
@@ -137,19 +148,19 @@
     "@types/json-schema": "^7.0.15",
     "@types/node": "^22.19.17",
     "@types/sha.js": "^2.4.4",
-    "@vitest/browser": "^4.1.7",
-    "@vitest/browser-playwright": "^4.1.7",
-    "@vitest/coverage-istanbul": "4.1.7",
-    "@vitest/coverage-v8": "^4.1.7",
-    "@vitest/ui": "^4.1.7",
-    "astro": "^6.4.2",
+    "@vitest/browser": "^4.1.9",
+    "@vitest/browser-playwright": "^4.1.9",
+    "@vitest/coverage-istanbul": "4.1.9",
+    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/ui": "^4.1.9",
+    "astro": "^7.1.0",
     "browserify-zlib": "^0.2.0",
     "cross-env": "^10.1.0",
     "dotenv": "^17.4.2",
     "esbuild": "^0.27.7",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-tsdoc": "^0.5.2",
@@ -157,38 +168,32 @@
     "globals": "^17.5.0",
     "husky": "^9.1.7",
     "jsdom": "^29.1.1",
-    "lint-staged": "^15.5.1",
+    "lint-staged": "^17.0.8",
     "lodash": "^4.18.1",
     "msw": "^2.14.6",
-    "playwright": "^1.60.0",
-    "prettier": "^3.8.3",
-    "rollup": "^4.60.4",
+    "playwright": "^1.61.0",
+    "prettier": "^3.8.4",
+    "rollup": "^4.62.0",
     "rollup-plugin-esbuild": "^6.2.1",
     "rollup-plugin-polyfill-node": "^0.13.0",
-    "tsx": "^4.22.3",
+    "tsx": "^4.22.4",
     "typedoc": "^0.28.19",
     "typescript": "5.9.3",
-    "typescript-eslint": "^8.60.0",
-    "vitest": "^4.1.7"
+    "typescript-eslint": "^8.61.1",
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "@noble/ed25519": "^3.1.0",
     "@noble/hashes": "^2.2.0",
     "@stellar/js-xdr": "4.0.0",
-    "axios": "1.16.1",
+    "axios": "1.18.0",
     "base32.js": "^0.1.0",
-    "bignumber.js": "^11.1.1",
+    "bignumber.js": "^11.1.4",
     "buffer": "^6.0.3",
     "commander": "^14.0.3",
     "eventsource": "^4.1.0",
     "feaxios": "^0.0.23",
     "smol-toml": "^1.6.1",
     "uint8array-extras": "^1.5.0"
-  },
-  "overrides": {
-    "chalk": "5.3.0",
-    "strip-ansi": "7.1.0",
-    "color-convert": "2.0.1",
-    "color-name": "1.1.4"
   }
 }