passkey-kit 0.12.0 → 0.13.1

package/dist/storage/localStorage.js

@@ -0,0 +1,86 @@
+/**
+ * `localStorage` passkey storage adapter.
+ *
+ * Persists passkey records across page reloads in the browser. `localStorage`
+ * has a ~5MB limit and stores data unencrypted; for larger or more structured
+ * needs prefer {@link import("./indexeddb.js").IndexedDBStorage}.
+ */
+import { LOCALSTORAGE_CREDENTIALS_KEY } from "../constants.js";
+function serialize(passkey) {
+    return { ...passkey, publicKey: Array.from(passkey.publicKey) };
+}
+function deserialize(data) {
+    return { ...data, publicKey: new Uint8Array(data.publicKey) };
+}
+export class LocalStorageAdapter {
+    storageKey;
+    constructor(storageKey = LOCALSTORAGE_CREDENTIALS_KEY) {
+        this.storageKey = storageKey;
+    }
+    read() {
+        if (typeof localStorage === "undefined") {
+            throw new Error("localStorage is not available in this environment");
+        }
+        const data = localStorage.getItem(this.storageKey);
+        if (!data)
+            return new Map();
+        try {
+            const parsed = JSON.parse(data);
+            const map = new Map();
+            for (const [key, value] of Object.entries(parsed)) {
+                map.set(key, deserialize(value));
+            }
+            return map;
+        }
+        catch (error) {
+            // Corrupt storage: warn loudly rather than silently dropping the user's
+            // passkeys. Return empty so the app keeps working; do not overwrite.
+            console.error(`[PasskeyKit] Failed to parse stored passkeys at "${this.storageKey}"; treating storage as empty.`, error);
+            return new Map();
+        }
+    }
+    write(passkeys) {
+        const obj = {};
+        for (const [key, value] of passkeys.entries()) {
+            obj[key] = serialize(value);
+        }
+        localStorage.setItem(this.storageKey, JSON.stringify(obj));
+    }
+    async save(passkey) {
+        const passkeys = this.read();
+        passkeys.set(passkey.keyId, passkey);
+        this.write(passkeys);
+    }
+    async get(keyId) {
+        return this.read().get(keyId) ?? null;
+    }
+    async getByContract(contractId) {
+        const results = [];
+        for (const passkey of this.read().values()) {
+            if (passkey.contractId === contractId) {
+                results.push(passkey);
+            }
+        }
+        return results;
+    }
+    async getAll() {
+        return Array.from(this.read().values());
+    }
+    async delete(keyId) {
+        const passkeys = this.read();
+        passkeys.delete(keyId);
+        this.write(passkeys);
+    }
+    async update(keyId, updates) {
+        const passkeys = this.read();
+        const passkey = passkeys.get(keyId);
+        if (passkey) {
+            passkeys.set(keyId, { ...passkey, ...updates });
+            this.write(passkeys);
+        }
+    }
+    async clear() {
+        localStorage.removeItem(this.storageKey);
+    }
+}
+//# sourceMappingURL=localStorage.js.map

package/dist/storage/localStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localStorage.js","sourceRoot":"","sources":["../../src/storage/localStorage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAU/D,SAAS,SAAS,CAAC,OAAsB;IACvC,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB;IAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,UAAU,CAAS;IAE3B,YAAY,aAAqB,4BAA4B;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEO,IAAI;QACV,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsC,CAAC;YACrE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,OAAO,CAAC,KAAK,CACX,oDAAoD,IAAI,CAAC,UAAU,+BAA+B,EAClG,KAAK,CACN,CAAC;YACF,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAoC;QAChD,MAAM,GAAG,GAAsC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,OAA4D;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/storage/memory.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory passkey storage adapter.
+ *
+ * Useful for tests and server-side environments. Data is lost when the process
+ * restarts.
+ */
+import type { StorageAdapter, StoredPasskey } from "../types.js";
+export declare class MemoryStorage implements StorageAdapter {
+    private passkeys;
+    save(passkey: StoredPasskey): Promise<void>;
+    get(keyId: string): Promise<StoredPasskey | null>;
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    getAll(): Promise<StoredPasskey[]>;
+    delete(keyId: string): Promise<void>;
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/storage/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,qBAAa,aAAc,YAAW,cAAc;IAClD,OAAO,CAAC,QAAQ,CAAyC;IAEnD,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAU3D,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC;IAOV,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/storage/memory.js

@@ -0,0 +1,41 @@
+/**
+ * In-memory passkey storage adapter.
+ *
+ * Useful for tests and server-side environments. Data is lost when the process
+ * restarts.
+ */
+export class MemoryStorage {
+    passkeys = new Map();
+    async save(passkey) {
+        this.passkeys.set(passkey.keyId, { ...passkey });
+    }
+    async get(keyId) {
+        const passkey = this.passkeys.get(keyId);
+        return passkey ? { ...passkey } : null;
+    }
+    async getByContract(contractId) {
+        const results = [];
+        for (const passkey of this.passkeys.values()) {
+            if (passkey.contractId === contractId) {
+                results.push({ ...passkey });
+            }
+        }
+        return results;
+    }
+    async getAll() {
+        return Array.from(this.passkeys.values()).map((p) => ({ ...p }));
+    }
+    async delete(keyId) {
+        this.passkeys.delete(keyId);
+    }
+    async update(keyId, updates) {
+        const passkey = this.passkeys.get(keyId);
+        if (passkey) {
+            this.passkeys.set(keyId, { ...passkey, ...updates });
+        }
+    }
+    async clear() {
+        this.passkeys.clear();
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/storage/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAO,aAAa;IAChB,QAAQ,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEzD,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,OAA4D;QAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Core type definitions for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from "@simplewebauthn/browser";
+import type { PasskeyKitError } from "./errors.js";
+/**
+ * The three signer kinds the smart wallet understands.
+ */
+export type SignerKeyTag = "Policy" | "Ed25519" | "Secp256r1";
+/**
+ * A convenience wrapper describing which signer a key/limits entry refers to.
+ *
+ * The `value` is the string form the caller works with: a `C…`/`G…` address for
+ * `Policy`, a `G…` public key for `Ed25519`, or a base64url credential id for
+ * `Secp256r1`. The signing pipeline converts these into the contract's
+ * `SignerKey` ScVals.
+ */
+export declare class SignerKey {
+    key: SignerKeyTag;
+    value: string;
+    private constructor();
+    static Policy(policy: string): SignerKey;
+    static Ed25519(publicKey: string): SignerKey;
+    static Secp256r1(keyId: string): SignerKey;
+}
+/**
+ * Per-signer limits: a map of contract address → the signer keys that signer may
+ * co-authorize on that contract (`undefined` value = unrestricted on that
+ * contract). `undefined` for the whole map = a fully unlimited signer.
+ */
+export type SignerLimits = Map<string, SignerKey[] | undefined> | undefined;
+/**
+ * Storage durability for a signer entry.
+ */
+export declare enum SignerStore {
+    Persistent = "Persistent",
+    Temporary = "Temporary"
+}
+/**
+ * A persisted passkey → smart-wallet association.
+ *
+ * The `keyId` (base64url credential id) is essential for re-authenticating the
+ * passkey later; the `contractId` lets the kit reconnect a wallet from a keyId
+ * without an indexer round-trip.
+ */
+export interface StoredPasskey {
+    /** Base64URL-encoded credential id (the passkey keyId) — the unique key. */
+    keyId: string;
+    /** 65-byte uncompressed secp256r1 public key (0x04 prefix + x + y). */
+    publicKey: Uint8Array;
+    /** Smart-wallet contract address this passkey controls. */
+    contractId: string;
+    /** User-friendly label for this passkey. */
+    nickname?: string;
+    /** Unix-ms timestamp when the passkey was created. */
+    createdAt: number;
+    /** Unix-ms timestamp when the passkey was last used. */
+    lastUsedAt?: number;
+}
+/**
+ * Interface for passkey storage adapters.
+ *
+ * Implementations persist the passkey → wallet association in various backends
+ * (IndexedDB, localStorage, memory). See `./storage`.
+ */
+export interface StorageAdapter {
+    /** Save a new passkey record or overwrite an existing one (keyed by keyId). */
+    save(passkey: StoredPasskey): Promise<void>;
+    /** Get a passkey record by its keyId. */
+    get(keyId: string): Promise<StoredPasskey | null>;
+    /** Get all passkey records associated with a contract. */
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    /** Get every stored passkey record. */
+    getAll(): Promise<StoredPasskey[]>;
+    /** Delete a passkey record by its keyId. */
+    delete(keyId: string): Promise<void>;
+    /** Update mutable metadata on a stored passkey record. */
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    /** Remove every stored passkey record. */
+    clear(): Promise<void>;
+}
+/** Result of creating (deploying) a new smart wallet. */
+export interface CreateWalletResult {
+    /** The raw WebAuthn registration response. */
+    rawResponse: RegistrationResponseJSON;
+    /** Raw credential id bytes. */
+    keyId: Uint8Array;
+    /** Base64URL-encoded credential id. */
+    keyIdBase64: string;
+    /** Deployed smart-wallet contract address. */
+    contractId: string;
+    /** Signed deployment transaction, ready to submit (base64 XDR). */
+    signedTx: string;
+}
+/** Result of connecting to an existing smart wallet. */
+export interface ConnectWalletResult {
+    /** Raw WebAuthn authentication response, when a ceremony was performed. */
+    rawResponse?: AuthenticationResponseJSON;
+    /** Raw credential id bytes. */
+    keyId: Uint8Array;
+    /** Base64URL-encoded credential id. */
+    keyIdBase64: string;
+    /** Connected smart-wallet contract address. */
+    contractId: string;
+}
+/** Successful result of a submission operation. */
+export interface TransactionSuccess {
+    success: true;
+    /** Transaction hash (may be empty for a `skipWait` submission not yet polled). */
+    hash: string;
+    /** Ledger the transaction was included in, when known. */
+    ledger?: number;
+    /** Relayer transaction id, for polling a `skipWait` submission. */
+    transactionId?: string;
+}
+/**
+ * Failed result of a submission operation.
+ *
+ * Submission methods never throw for expected on-chain/relayer failures; they
+ * return this shape with a typed {@link PasskeyKitError} (a `ContractError` when
+ * an on-chain contract code was decoded). All other SDK methods throw.
+ */
+export interface TransactionFailure {
+    success: false;
+    /** The typed error describing the failure. Branch on `error.code`. */
+    error: PasskeyKitError;
+    /** Transaction hash, when one was assigned before the failure. */
+    hash?: string;
+}
+/** Result of a submission operation: a discriminated union on `success`. */
+export type TransactionResult = TransactionSuccess | TransactionFailure;
+/** How a transaction is submitted to the network. */
+export type SubmissionMethod = "relayer" | "rpc";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAMnD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE9D;;;;;;;GAOG;AACH,qBAAa,SAAS;IAEX,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,MAAM;IAFtB,OAAO;IAKP,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IAIxC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS;IAI5C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS;CAG3C;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AAE5E;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IAEd,uEAAuE;IACvE,SAAS,EAAE,UAAU,CAAC;IAEtB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IAEnB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAElB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,yCAAyC;IACzC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAElD,0DAA0D;IAC1D,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE5D,uCAAuC;IACvC,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEnC,4CAA4C;IAC5C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,0DAA0D;IAC1D,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,0CAA0C;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,wBAAwB,CAAC;IAEtC,+BAA+B;IAC/B,KAAK,EAAE,UAAU,CAAC;IAElB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IAEpB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IAEnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,0BAA0B,CAAC;IAEzC,+BAA+B;IAC/B,KAAK,EAAE,UAAU,CAAC;IAElB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IAEpB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC;IACf,sEAAsE;IACtE,KAAK,EAAE,eAAe,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,KAAK,CAAC"}

package/dist/types.js

@@ -0,0 +1,39 @@
+/**
+ * Core type definitions for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+/**
+ * A convenience wrapper describing which signer a key/limits entry refers to.
+ *
+ * The `value` is the string form the caller works with: a `C…`/`G…` address for
+ * `Policy`, a `G…` public key for `Ed25519`, or a base64url credential id for
+ * `Secp256r1`. The signing pipeline converts these into the contract's
+ * `SignerKey` ScVals.
+ */
+export class SignerKey {
+    key;
+    value;
+    constructor(key, value) {
+        this.key = key;
+        this.value = value;
+    }
+    static Policy(policy) {
+        return new SignerKey("Policy", policy);
+    }
+    static Ed25519(publicKey) {
+        return new SignerKey("Ed25519", publicKey);
+    }
+    static Secp256r1(keyId) {
+        return new SignerKey("Secp256r1", keyId);
+    }
+}
+/**
+ * Storage durability for a signer entry.
+ */
+export var SignerStore;
+(function (SignerStore) {
+    SignerStore["Persistent"] = "Persistent";
+    SignerStore["Temporary"] = "Temporary";
+})(SignerStore || (SignerStore = {}));
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IAEX;IACA;IAFT,YACS,GAAiB,EACjB,KAAa;QADb,QAAG,GAAH,GAAG,CAAc;QACjB,UAAK,GAAL,KAAK,CAAQ;IACnB,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,MAAc;QAC1B,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,SAAiB;QAC9B,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAa;QAC5B,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF;AASD;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,sCAAuB,CAAA;AACzB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB"}

package/dist/utils.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Cryptographic and derivation helpers for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+import type { RegistrationResponseJSON } from "@simplewebauthn/browser";
+/**
+ * Derive a smart-wallet contract address from a passkey credential id.
+ *
+ * The wallet's contract id is deterministic: `salt = sha256(keyId)` and the
+ * deployer address salts a `ContractIdPreimageFromAddress`. This determinism is
+ * load-bearing — the indexer reverse-lookup (keyId → wallet) re-derives the
+ * address the same way — so this function is pinned with golden vectors in
+ * `utils.test.ts`. Any change to the derivation breaks the tests instead of
+ * silently shifting deployed addresses.
+ *
+ * @param keyId - The raw credential id bytes
+ * @param deployerPublicKey - The deployer's `G…` public key
+ * @param networkPassphrase - The network passphrase
+ * @returns The derived contract address (`C…`)
+ */
+export declare function deriveContractAddress(keyId: Buffer, deployerPublicKey: string, networkPassphrase: string): string;
+/**
+ * Extract the 65-byte uncompressed secp256r1 public key from a WebAuthn
+ * registration (attestation) response.
+ *
+ * Tries, in order:
+ * 1. `response.publicKey` when it is already a raw uncompressed EC point.
+ * 2. `response.publicKey` decoded from SPKI via WebCrypto (`crypto.subtle`),
+ *    which is the correct, non-magic-offset way to normalize the DER-encoded
+ *    SubjectPublicKeyInfo most authenticators return.
+ * 3. Parsing the COSE key out of `authenticatorData` / `attestationObject`.
+ *
+ * @throws {WebAuthnError} If the public key cannot be extracted.
+ */
+export declare function extractPublicKeyFromAttestation(response: RegistrationResponseJSON["response"]): Promise<Uint8Array>;
+/**
+ * Convert a DER-encoded ECDSA signature to Stellar's compact `r || s` form with
+ * a low-S value (S <= n/2), as required by the secp256r1 host function.
+ *
+ * @param derSignature - The DER-encoded signature
+ * @returns 64-byte compact signature (`r || s`)
+ */
+export declare function compactSignature(derSignature: Buffer): Uint8Array;
+/**
+ * Generate a cryptographically-random base64url challenge for a WebAuthn
+ * ceremony.
+ *
+ * Replaces the old hard-coded `"stellaristhebetterblockchain"` challenge.
+ */
+export declare function generateChallenge(): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAcxE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,MAAM,EACzB,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAcR;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,GAC7C,OAAO,CAAC,UAAU,CAAC,CAsFrB;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAyBjE;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAI1C"}

package/dist/utils.js

@@ -0,0 +1,153 @@
+/**
+ * Cryptographic and derivation helpers for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+import { StrKey, hash, xdr, Address } from "@stellar/stellar-sdk";
+import base64url from "./base64url.js";
+import { SECP256R1_PUBLIC_KEY_SIZE, SECP256R1_CURVE_ORDER, UNCOMPRESSED_PUBKEY_PREFIX, WEBAUTHN_CHALLENGE_SIZE, } from "./constants.js";
+import { WebAuthnError, PasskeyKitErrorCode } from "./errors.js";
+// ============================================================================
+// Deterministic contract-address derivation
+// ============================================================================
+/**
+ * Derive a smart-wallet contract address from a passkey credential id.
+ *
+ * The wallet's contract id is deterministic: `salt = sha256(keyId)` and the
+ * deployer address salts a `ContractIdPreimageFromAddress`. This determinism is
+ * load-bearing — the indexer reverse-lookup (keyId → wallet) re-derives the
+ * address the same way — so this function is pinned with golden vectors in
+ * `utils.test.ts`. Any change to the derivation breaks the tests instead of
+ * silently shifting deployed addresses.
+ *
+ * @param keyId - The raw credential id bytes
+ * @param deployerPublicKey - The deployer's `G…` public key
+ * @param networkPassphrase - The network passphrase
+ * @returns The derived contract address (`C…`)
+ */
+export function deriveContractAddress(keyId, deployerPublicKey, networkPassphrase) {
+    const preimage = xdr.HashIdPreimage.envelopeTypeContractId(new xdr.HashIdPreimageContractId({
+        networkId: hash(Buffer.from(networkPassphrase)),
+        contractIdPreimage: xdr.ContractIdPreimage.contractIdPreimageFromAddress(new xdr.ContractIdPreimageFromAddress({
+            address: Address.fromString(deployerPublicKey).toScAddress(),
+            salt: hash(keyId),
+        })),
+    }));
+    return StrKey.encodeContract(hash(preimage.toXDR()));
+}
+// ============================================================================
+// WebAuthn public-key extraction
+// ============================================================================
+/**
+ * Extract the 65-byte uncompressed secp256r1 public key from a WebAuthn
+ * registration (attestation) response.
+ *
+ * Tries, in order:
+ * 1. `response.publicKey` when it is already a raw uncompressed EC point.
+ * 2. `response.publicKey` decoded from SPKI via WebCrypto (`crypto.subtle`),
+ *    which is the correct, non-magic-offset way to normalize the DER-encoded
+ *    SubjectPublicKeyInfo most authenticators return.
+ * 3. Parsing the COSE key out of `authenticatorData` / `attestationObject`.
+ *
+ * @throws {WebAuthnError} If the public key cannot be extracted.
+ */
+export async function extractPublicKeyFromAttestation(response) {
+    let publicKey;
+    if (response.publicKey) {
+        const encodedPublicKey = base64url.toBuffer(response.publicKey);
+        if (encodedPublicKey.length === SECP256R1_PUBLIC_KEY_SIZE &&
+            encodedPublicKey[0] === UNCOMPRESSED_PUBKEY_PREFIX) {
+            publicKey = encodedPublicKey;
+        }
+        else if (typeof crypto?.subtle !== "undefined") {
+            try {
+                const imported = await crypto.subtle.importKey("spki", new Uint8Array(encodedPublicKey), { name: "ECDSA", namedCurve: "P-256" }, true, []);
+                const rawKey = await crypto.subtle.exportKey("raw", imported);
+                publicKey = Buffer.from(new Uint8Array(rawKey));
+            }
+            catch {
+                publicKey = encodedPublicKey.subarray(encodedPublicKey.length - SECP256R1_PUBLIC_KEY_SIZE);
+            }
+        }
+        else {
+            publicKey = encodedPublicKey.subarray(encodedPublicKey.length - SECP256R1_PUBLIC_KEY_SIZE);
+        }
+    }
+    // Validate it is a proper uncompressed EC point; otherwise fall back to the
+    // COSE key embedded in authenticatorData / attestationObject.
+    if (!publicKey ||
+        publicKey[0] !== UNCOMPRESSED_PUBKEY_PREFIX ||
+        publicKey.length !== SECP256R1_PUBLIC_KEY_SIZE) {
+        let x;
+        let y;
+        if (response.authenticatorData) {
+            const authenticatorData = base64url.toBuffer(response.authenticatorData);
+            const credentialIdLength = (authenticatorData[53] << 8) | authenticatorData[54];
+            x = authenticatorData.subarray(65 + credentialIdLength, 97 + credentialIdLength);
+            y = authenticatorData.subarray(100 + credentialIdLength, 132 + credentialIdLength);
+        }
+        else if (response.attestationObject) {
+            const attestationObject = base64url.toBuffer(response.attestationObject);
+            // COSE key structure prefix for an ES256 (P-256) key.
+            const publicKeyPrefixSlice = Buffer.from([
+                0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20,
+            ]);
+            let startIndex = attestationObject.indexOf(publicKeyPrefixSlice);
+            if (startIndex === -1) {
+                throw new WebAuthnError("Could not locate the COSE public key in the attestation object", PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED);
+            }
+            startIndex = startIndex + publicKeyPrefixSlice.length;
+            x = attestationObject.subarray(startIndex, 32 + startIndex);
+            y = attestationObject.subarray(35 + startIndex, 67 + startIndex);
+        }
+        else {
+            throw new WebAuthnError("Could not extract a public key from the attestation response", PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED);
+        }
+        publicKey = Buffer.from([UNCOMPRESSED_PUBKEY_PREFIX, ...x, ...y]);
+    }
+    return new Uint8Array(publicKey);
+}
+// ============================================================================
+// Signature encoding
+// ============================================================================
+/**
+ * Convert a DER-encoded ECDSA signature to Stellar's compact `r || s` form with
+ * a low-S value (S <= n/2), as required by the secp256r1 host function.
+ *
+ * @param derSignature - The DER-encoded signature
+ * @returns 64-byte compact signature (`r || s`)
+ */
+export function compactSignature(derSignature) {
+    // DER: 0x30 [total-len] 0x02 [r-len] [r] 0x02 [s-len] [s]
+    let offset = 2; // skip 0x30 and the total length
+    const rLength = derSignature[offset + 1];
+    const r = derSignature.subarray(offset + 2, offset + 2 + rLength);
+    offset += 2 + rLength;
+    const sLength = derSignature[offset + 1];
+    const s = derSignature.subarray(offset + 2, offset + 2 + sLength);
+    const rBigInt = BigInt("0x" + r.toString("hex"));
+    let sBigInt = BigInt("0x" + s.toString("hex"));
+    // Enforce low-S.
+    const halfN = SECP256R1_CURVE_ORDER / 2n;
+    if (sBigInt > halfN) {
+        sBigInt = SECP256R1_CURVE_ORDER - sBigInt;
+    }
+    const rPadded = Buffer.from(rBigInt.toString(16).padStart(64, "0"), "hex");
+    const sLowS = Buffer.from(sBigInt.toString(16).padStart(64, "0"), "hex");
+    return new Uint8Array(Buffer.concat([rPadded, sLowS]));
+}
+// ============================================================================
+// WebAuthn challenge
+// ============================================================================
+/**
+ * Generate a cryptographically-random base64url challenge for a WebAuthn
+ * ceremony.
+ *
+ * Replaces the old hard-coded `"stellaristhebetterblockchain"` challenge.
+ */
+export function generateChallenge() {
+    const bytes = new Uint8Array(WEBAUTHN_CHALLENGE_SIZE);
+    crypto.getRandomValues(bytes);
+    return base64url.encode(Buffer.from(bytes));
+}
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjE,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,iBAAyB,EACzB,iBAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,sBAAsB,CACxD,IAAI,GAAG,CAAC,wBAAwB,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CACtE,IAAI,GAAG,CAAC,6BAA6B,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SAClB,CAAC,CACH;KACF,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAA8C;IAE9C,IAAI,SAA6B,CAAC;IAElC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEhE,IACE,gBAAgB,CAAC,MAAM,KAAK,yBAAyB;YACrD,gBAAgB,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAClD,CAAC;YACD,SAAS,GAAG,gBAAgB,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,MAAM,EACN,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAChC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,EAAE,CACH,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CACnC,gBAAgB,CAAC,MAAM,GAAG,yBAAyB,CACpD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CACnC,gBAAgB,CAAC,MAAM,GAAG,yBAAyB,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IACE,CAAC,SAAS;QACV,SAAS,CAAC,CAAC,CAAC,KAAK,0BAA0B;QAC3C,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAC9C,CAAC;QACD,IAAI,CAAS,CAAC;QACd,IAAI,CAAS,CAAC;QAEd,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YACzE,MAAM,kBAAkB,GACtB,CAAC,iBAAiB,CAAC,EAAE,CAAE,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAE,CAAC;YAEzD,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAC5B,EAAE,GAAG,kBAAkB,EACvB,EAAE,GAAG,kBAAkB,CACxB,CAAC;YACF,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAC5B,GAAG,GAAG,kBAAkB,EACxB,GAAG,GAAG,kBAAkB,CACzB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAEzE,sDAAsD;YACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC;gBACvC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;aAC3D,CAAC,CAAC;YACH,IAAI,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjE,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,aAAa,CACrB,gEAAgE,EAChE,mBAAmB,CAAC,4BAA4B,CACjD,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC;YAEtD,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;YAC5D,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,aAAa,CACrB,8DAA8D,EAC9D,mBAAmB,CAAC,4BAA4B,CACjD,CAAC;QACJ,CAAC;QAED,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,0DAA0D;IAC1D,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,iCAAiC;IAEjD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/C,iBAAiB;IACjB,MAAM,KAAK,GAAG,qBAAqB,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACpB,OAAO,GAAG,qBAAqB,GAAG,OAAO,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAEzE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACtD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/validation.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Client-side input validation.
+ *
+ * Produces clear {@link ValidationError}s before submission instead of opaque
+ * on-chain or WebCrypto failures. The smart wallet imposes no signer-count caps
+ * (unlike a policy-based account), so validation here is about shapes and
+ * ranges: addresses, amounts, expirations, and secp256r1 public keys.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Validate that a string is a Stellar account (`G…`) or contract (`C…`) address.
+ *
+ * @throws {ValidationError} If the address is missing or malformed.
+ */
+export declare function validateAddress(address: string, fieldName?: string): void;
+/**
+ * Validate that an amount is a positive, finite number.
+ *
+ * @throws {ValidationError} If the amount is not a positive number.
+ */
+export declare function validateAmount(amount: number, fieldName?: string): void;
+/**
+ * Validate a signer expiration.
+ *
+ * Must be a non-negative integer within `u32` bounds when provided; `undefined`
+ * means "no expiration". (Unix-second timestamps fit in `u32` through the year
+ * 2106, so this bound holds whether the contract interprets the value as a
+ * ledger sequence or a UNIX timestamp.)
+ *
+ * @throws {ValidationError} If the expiration is out of range.
+ */
+export declare function validateExpiration(expiration: number | undefined, fieldName?: string): void;
+/**
+ * Validate a secp256r1 public key: 65 bytes, uncompressed (`0x04`) prefix.
+ *
+ * @throws {ValidationError} If the key is not a valid uncompressed EC point.
+ */
+export declare function validateSecp256r1PublicKey(publicKey: Uint8Array, fieldName?: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,SAAY,GACpB,IAAI,CAmBN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAW,GAAG,IAAI,CAezE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,SAAe,GACvB,IAAI,CAaN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,UAAU,EACrB,SAAS,SAAc,GACtB,IAAI,CAeN"}