passkey-kit 0.12.0 → 0.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "A helper library for creating and using smart wallet accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven",
   "license": "MIT",
@@ -10,11 +10,11 @@
   "dependencies": {
     "@openzeppelin/relayer-plugin-channels": "^0.5.0",
     "@simplewebauthn/browser": "^13.2.0",
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "base64url": "^3.0.1",
     "buffer": "^6.0.3",
-    "passkey-kit-sdk": "0.7.2",
-    "sac-sdk": "0.4.2"
+    "passkey-kit-sdk": "0.7.3",
+    "sac-sdk": "0.4.3"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
@@ -23,8 +23,8 @@
   "workspaces": [
     "packages/*"
   ],
-  "engine": {
-    "node": ">=20"
+  "engines": {
+    "node": ">=22.18.0"
   },
   "repository": {
     "type": "git",
@@ -51,6 +51,7 @@
     "build:demo": "cd demo && pnpm --ignore-workspace install && pnpm run build",
     "deploy:demo": "npx wrangler pages deploy",
     "deploy:demo:prod": "npx wrangler pages deploy --env production",
+    "test:p27-auth": "bun bun_tests/9.index.ts",
     "build:sac": "pnpm --filter=sac-sdk run build",
     "build:pks": "pnpm --filter=passkey-kit-sdk run build",
     "build": "pnpm run build:sac && pnpm run build:pks && tsc",

package/packages/passkey-kit-sdk/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.2",
+  "version": "0.7.3",
   "name": "passkey-kit-sdk",
   "type": "module",
   "main": "src/index.ts",
@@ -9,10 +9,13 @@
     "build": "tsc"
   },
   "dependencies": {
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "buffer": "^6.0.3"
   },
   "devDependencies": {
     "typescript": "^5.9.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
   }
 }

package/packages/passkey-kit-sdk/src/index.ts

@@ -5,11 +5,11 @@ import {
   ClientOptions as ContractClientOptions,
   MethodOptions,
   Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 import type {
   u32,
   Option,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 
 if (typeof window !== 'undefined') {
   //@ts-ignore Buffer exists

package/packages/passkey-kit-sdk/types/index.d.ts

@@ -1,6 +1,6 @@
 import { Buffer } from "buffer";
-import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/minimal/contract';
-import type { u32, Option } from '@stellar/stellar-sdk/minimal/contract';
+import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/contract';
+import type { u32, Option } from '@stellar/stellar-sdk/contract';
 export declare const Errors: {
     1: {
         message: string;

package/packages/sac-sdk/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.2",
+  "version": "0.4.3",
   "name": "sac-sdk",
   "type": "module",
   "main": "src/index.ts",
@@ -9,10 +9,13 @@
     "build": "tsc"
   },
   "dependencies": {
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "buffer": "^6.0.3"
   },
   "devDependencies": {
     "typescript": "^5.9.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
   }
 }

package/packages/sac-sdk/src/index.ts

@@ -5,11 +5,11 @@ import {
   ClientOptions as ContractClientOptions,
   MethodOptions,
   Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 import type {
   u32,
   i128,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 
 if (typeof window !== 'undefined') {
   //@ts-ignore Buffer exists

package/packages/sac-sdk/types/index.d.ts

@@ -1,6 +1,6 @@
 import { Buffer } from "buffer";
-import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/minimal/contract';
-import type { u32, i128 } from '@stellar/stellar-sdk/minimal/contract';
+import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/contract';
+import type { u32, i128 } from '@stellar/stellar-sdk/contract';
 export interface Client {
     /**
      * Construct and simulate a allowance transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.

package/src/base.ts

@@ -1,4 +1,4 @@
-import { Server } from "@stellar/stellar-sdk/minimal/rpc"
+import { Server } from "@stellar/stellar-sdk/rpc"
 
 // TODO consider adding support for a signAuthEntry method that conforms to the ed25519 signature scheme of this passkey interface
 // once we do that we can clean the code a little with the `xdr.HashIdPreimage.envelopeTypeSorobanAuthorization` stuff

package/src/kit.ts

@@ -1,12 +1,138 @@
 import { Client as PasskeyClient, type Signature, type SignerKey as SDKSignerKey, type SignerLimits as SDKSignerLimits } from 'passkey-kit-sdk'
-import { StrKey, hash, xdr, Keypair, Address, TransactionBuilder, Operation } from '@stellar/stellar-sdk/minimal'
+import * as StellarSdk from '@stellar/stellar-sdk'
+import { StrKey, hash, xdr, Keypair, Address, TransactionBuilder, Operation } from '@stellar/stellar-sdk'
 import { startRegistration, startAuthentication, type AuthenticationResponseJSON, type AuthenticatorAttestationResponseJSON, type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser"
 import { Buffer } from 'buffer'
 import base64url from 'base64url'
 import type { SignerKey, SignerLimits, SignerStore } from './types'
 import { PasskeyBase } from './base'
-import { AssembledTransaction, basicNodeSigner, type AssembledTransactionOptions, type Tx } from '@stellar/stellar-sdk/minimal/contract'
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc'
+import { AssembledTransaction, basicNodeSigner, type AssembledTransactionOptions, type Spec as ContractSpec, type Tx } from '@stellar/stellar-sdk/contract'
+import type { Server } from '@stellar/stellar-sdk/rpc'
+
+type P27HashIdPreimage = typeof xdr.HashIdPreimage & {
+    envelopeTypeSorobanAuthorizationWithAddress?: (value: unknown) => xdr.HashIdPreimage
+}
+
+type P27Xdr = typeof xdr & {
+    HashIdPreimageSorobanAuthorizationWithAddress?: new (fields: {
+        networkId: Buffer
+        nonce: xdr.Int64
+        signatureExpirationLedger: number
+        invocation: xdr.SorobanAuthorizedInvocation
+        address: xdr.ScAddress
+    }) => unknown
+}
+
+type P27AuthSdk = typeof StellarSdk & {
+    buildAuthorizationEntryPreimage?: (
+        entry: xdr.SorobanAuthorizationEntry,
+        validUntilLedgerSeq: number,
+        networkPassphrase: string
+    ) => xdr.HashIdPreimage
+}
+
+type PasskeyClientWithSpec = PasskeyClient & {
+    spec: ContractSpec
+}
+
+export function getAddressCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanAddressCredentials {
+    const typedCredentials = credentials as unknown as {
+        address: () => xdr.SorobanAddressCredentials
+        addressV2?: () => xdr.SorobanAddressCredentials
+        addressWithDelegates?: () => {
+            addressCredentials: () => xdr.SorobanAddressCredentials
+        }
+    }
+
+    switch (credentials.switch().name as string) {
+        case 'sorobanCredentialsAddress':
+            return typedCredentials.address()
+        case 'sorobanCredentialsAddressV2':
+            if (!typedCredentials.addressV2) {
+                throw new Error(
+                    'ADDRESS_V2 credentials require an SDK with Protocol 27 credential support'
+                )
+            }
+            return typedCredentials.addressV2()
+        case 'sorobanCredentialsAddressWithDelegates':
+            if (!typedCredentials.addressWithDelegates) {
+                throw new Error(
+                    'ADDRESS_WITH_DELEGATES credentials require an SDK with Protocol 27 credential support'
+                )
+            }
+            return typedCredentials.addressWithDelegates().addressCredentials()
+    }
+
+    throw new Error(`Soroban credentials do not contain address credentials: ${credentials.switch().name}`)
+}
+
+export function usesAddressBoundPayload(credentials: xdr.SorobanCredentials): boolean {
+    const credentialType = credentials.switch().name as string
+    return credentialType === 'sorobanCredentialsAddressV2'
+        || credentialType === 'sorobanCredentialsAddressWithDelegates'
+}
+
+export function assertSignatureExpirationLedger(expiration: number): void {
+    if (!Number.isInteger(expiration) || expiration < 0 || expiration > 0xffffffff) {
+        throw new Error('Soroban signature expiration ledger must be a uint32 integer')
+    }
+}
+
+export function buildSignaturePayload(
+    networkPassphrase: string,
+    entry: xdr.SorobanAuthorizationEntry,
+    expiration: number
+): Buffer {
+    assertSignatureExpirationLedger(expiration)
+
+    const credentials = getAddressCredentials(entry.credentials())
+    const sdkAuth = StellarSdk as P27AuthSdk
+
+    if (sdkAuth.buildAuthorizationEntryPreimage) {
+        credentials.signatureExpirationLedger(expiration)
+        return hash(sdkAuth.buildAuthorizationEntryPreimage(
+            entry,
+            expiration,
+            networkPassphrase
+        ).toXDR())
+    }
+
+    if (usesAddressBoundPayload(entry.credentials())) {
+        const hashIdPreimage = xdr.HashIdPreimage as P27HashIdPreimage
+        const WithAddressPreimage = (xdr as P27Xdr).HashIdPreimageSorobanAuthorizationWithAddress
+
+        if (!hashIdPreimage.envelopeTypeSorobanAuthorizationWithAddress || !WithAddressPreimage) {
+            throw new Error(
+                'Address-bound Soroban auth credentials require an SDK with Protocol 27 auth preimage support'
+            )
+        }
+
+        credentials.signatureExpirationLedger(expiration)
+        const preimage = hashIdPreimage.envelopeTypeSorobanAuthorizationWithAddress(
+            new WithAddressPreimage({
+                networkId: hash(Buffer.from(networkPassphrase)),
+                nonce: credentials.nonce(),
+                signatureExpirationLedger: expiration,
+                invocation: entry.rootInvocation(),
+                address: credentials.address(),
+            })
+        )
+
+        return hash(preimage.toXDR())
+    }
+
+    credentials.signatureExpirationLedger(expiration)
+    const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+        new xdr.HashIdPreimageSorobanAuthorization({
+            networkId: hash(Buffer.from(networkPassphrase)),
+            nonce: credentials.nonce(),
+            signatureExpirationLedger: expiration,
+            invocation: entry.rootInvocation()
+        })
+    )
+
+    return hash(preimage.toXDR())
+}
 
 // TODO we should allow setting the rpId in the constructor so we don't have to keep setting it for every call
 // e.g. if you want to sign with a smol.xyz key on next.smol.xyz key you have to set rpId over and over again
@@ -28,6 +154,10 @@ export class PasskeyKit extends PasskeyBase {
     public networkPassphrase: string
     public wallet: PasskeyClient | undefined
 
+    private get walletSpec(): ContractSpec {
+        return (this.wallet as PasskeyClientWithSpec).spec
+    }
+
     constructor(options: {
         rpcUrl: string,
         networkPassphrase: string,
@@ -247,7 +377,12 @@ export class PasskeyKit extends PasskeyBase {
         if ([keyId, keypair, policy].filter((arg) => !!arg).length > 1)
             throw new Error('Exactly one of `options.keyId`, `options.keypair`, or `options.policy` must be provided.');
 
-        const credentials = entry.credentials().address();
+        const credentialType = entry.credentials().switch().name as string
+        if (credentialType === 'sorobanCredentialsAddressWithDelegates') {
+            throw new Error('ADDRESS_WITH_DELEGATES auth entries are not supported by passkey signing yet')
+        }
+
+        const credentials = getAddressCredentials(entry.credentials());
 
         if (!expiration) {
             expiration = credentials.signatureExpirationLedger()
@@ -255,21 +390,11 @@ export class PasskeyKit extends PasskeyBase {
             if (!expiration) {
                 const { sequence } = await this.rpc.getLatestLedger()
                 expiration = sequence + this.timeoutInSeconds / 5; // assumes 5 second ledger time
+                expiration = Math.ceil(expiration)
             }
         }
 
-        credentials.signatureExpirationLedger(expiration)
-
-        const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
-            new xdr.HashIdPreimageSorobanAuthorization({
-                networkId: hash(Buffer.from(this.networkPassphrase)),
-                nonce: credentials.nonce(),
-                signatureExpirationLedger: credentials.signatureExpirationLedger(),
-                invocation: entry.rootInvocation()
-            })
-        )
-
-        const payload = hash(preimage.toXDR())
+        const payload = buildSignaturePayload(this.networkPassphrase, entry, expiration)
 
         // let signatures: Signatures
         let key: SDKSignerKey
@@ -367,8 +492,8 @@ export class PasskeyKit extends PasskeyBase {
         const scValType = xdr.ScSpecTypeDef.scSpecTypeUdt(
             new xdr.ScSpecTypeUdt({ name: "Signature" }),
         );
-        const scKey = this.wallet!.spec.nativeToScVal(key, scKeyType);
-        const scVal = val ? this.wallet!.spec.nativeToScVal(val, scValType) : xdr.ScVal.scvVoid();
+        const scKey = this.walletSpec.nativeToScVal(key, scKeyType);
+        const scVal = val ? this.walletSpec.nativeToScVal(val, scValType) : xdr.ScVal.scvVoid();
         const scEntry = new xdr.ScMapEntry({
             key: scKey,
             val: scVal,
@@ -434,7 +559,7 @@ export class PasskeyKit extends PasskeyBase {
     ) {
         if (!(txn instanceof AssembledTransaction)) {
             try {
-                txn = AssembledTransaction.fromXDR(this.wallet!.options, typeof txn === 'string' ? txn : txn.toXDR(), this.wallet!.spec);
+                txn = AssembledTransaction.fromXDR(this.wallet!.options, typeof txn === 'string' ? txn : txn.toXDR(), this.walletSpec);
             } catch {
                 if (!(txn instanceof AssembledTransaction)) {
                     const built = TransactionBuilder.fromXDR(typeof txn === 'string' ? txn : txn.toXDR(), this.networkPassphrase);
@@ -695,4 +820,4 @@ export class PasskeyKit extends PasskeyBase {
 
         return concatSignature;
     }
-}
+}

package/src/sac.ts

@@ -1,6 +1,6 @@
 import { Client as SacClient } from 'sac-sdk'
 import { PasskeyBase } from "./base"
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc'
+import type { Server } from '@stellar/stellar-sdk/rpc'
 
 export class SACClient extends PasskeyBase {
     declare rpc: Server

package/src/server.ts

@@ -1,10 +1,10 @@
-import { xdr } from "@stellar/stellar-sdk/minimal"
+import { xdr } from "@stellar/stellar-sdk"
 import { PasskeyBase } from "./base"
 import base64url from "base64url"
-import type { Tx } from "@stellar/stellar-sdk/minimal/contract"
+import type { Tx } from "@stellar/stellar-sdk/contract"
 import type { Signer } from "./types"
-import { AssembledTransaction } from "@stellar/stellar-sdk/minimal/contract"
-import { Durability } from "@stellar/stellar-sdk/minimal/rpc"
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract"
+import { Durability } from "@stellar/stellar-sdk/rpc"
 import { ChannelsClient } from "@openzeppelin/relayer-plugin-channels"
 
 export class PasskeyServer extends PasskeyBase {

package/types/base.d.ts

@@ -1,4 +1,4 @@
-import { Server } from "@stellar/stellar-sdk/minimal/rpc";
+import { Server } from "@stellar/stellar-sdk/rpc";
 export declare class PasskeyBase {
     rpcUrl: string | undefined;
     rpc: Server | undefined;

package/types/kit.d.ts

@@ -1,11 +1,16 @@
 import { Client as PasskeyClient } from 'passkey-kit-sdk';
-import { xdr, Keypair } from '@stellar/stellar-sdk/minimal';
+import * as StellarSdk from '@stellar/stellar-sdk';
+import { xdr, Keypair } from '@stellar/stellar-sdk';
 import { startRegistration, startAuthentication, type AuthenticationResponseJSON, type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser";
 import { Buffer } from 'buffer';
 import type { SignerKey, SignerLimits, SignerStore } from './types';
 import { PasskeyBase } from './base';
-import { AssembledTransaction, type Tx } from '@stellar/stellar-sdk/minimal/contract';
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc';
+import { AssembledTransaction, type Tx } from '@stellar/stellar-sdk/contract';
+import type { Server } from '@stellar/stellar-sdk/rpc';
+export declare function getAddressCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanAddressCredentials;
+export declare function usesAddressBoundPayload(credentials: xdr.SorobanCredentials): boolean;
+export declare function assertSignatureExpirationLedger(expiration: number): void;
+export declare function buildSignaturePayload(networkPassphrase: string, entry: xdr.SorobanAuthorizationEntry, expiration: number): Buffer;
 export declare class PasskeyKit extends PasskeyBase {
     rpc: Server;
     rpcUrl: string;
@@ -17,6 +22,7 @@ export declare class PasskeyKit extends PasskeyBase {
     keyId: string | undefined;
     networkPassphrase: string;
     wallet: PasskeyClient | undefined;
+    private get walletSpec();
     constructor(options: {
         rpcUrl: string;
         networkPassphrase: string;
@@ -35,7 +41,7 @@ export declare class PasskeyKit extends PasskeyBase {
         keyId: Buffer<ArrayBufferLike>;
         keyIdBase64: string;
         contractId: string;
-        signedTx: Tx;
+        signedTx: StellarSdk.Transaction;
     }>;
     createKey(app: string, user: string, settings?: {
         rpId?: string;
@@ -70,14 +76,14 @@ export declare class PasskeyKit extends PasskeyBase {
         keypair?: Keypair;
         policy?: string;
         expiration?: number;
-    }): Promise<AssembledTransaction<T>>;
-    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updateSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    remove(signer: SignerKey): Promise<AssembledTransaction<null>>;
+    }): Promise<StellarSdk.contract.AssembledTransaction<T>>;
+    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updateSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    remove(signer: SignerKey): Promise<StellarSdk.contract.AssembledTransaction<null>>;
     private secp256r1;
     private ed25519;
     private policy;

package/types/sac.d.ts

@@ -1,6 +1,6 @@
 import { Client as SacClient } from 'sac-sdk';
 import { PasskeyBase } from "./base";
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc';
+import type { Server } from '@stellar/stellar-sdk/rpc';
 export declare class SACClient extends PasskeyBase {
     rpc: Server;
     rpcUrl: string;

package/types/server.d.ts

@@ -1,7 +1,7 @@
 import { PasskeyBase } from "./base";
-import type { Tx } from "@stellar/stellar-sdk/minimal/contract";
+import type { Tx } from "@stellar/stellar-sdk/contract";
 import type { Signer } from "./types";
-import { AssembledTransaction } from "@stellar/stellar-sdk/minimal/contract";
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract";
 export declare class PasskeyServer extends PasskeyBase {
     private relayerApiKey;
     private mercuryJwt;