passkey-kit 0.12.1 → 0.13.1

package/dist/server.js

@@ -0,0 +1,152 @@
+/**
+ * `PasskeyServer` — the SERVER-ONLY counterpart to {@link PasskeyKit}.
+ *
+ * It holds the relayer API key and therefore must never run in a browser
+ * bundle: it is exported exclusively from the `passkey-kit/server` subpath so a
+ * bundler can't pull it into client code, and its config must come from
+ * server-side environment variables (never `VITE_`-prefixed).
+ *
+ * Responsibilities: fee-sponsored submission via {@link RelayerClient} and
+ * convenience signer-discovery helpers that delegate to a {@link MercuryIndexer}
+ * over Mercury's keyless hosted passkey-indexer. (`MercuryIndexer` itself is
+ * keyless and browser-safe — exported from the main `passkey-kit` entry; these
+ * server methods are a thin convenience over it.)
+ *
+ * @packageDocumentation
+ */
+import { TransactionBuilder, } from "@stellar/stellar-sdk";
+import { Server } from "@stellar/stellar-sdk/rpc";
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract";
+import { RelayerClient } from "./relayer.js";
+import { ConfigurationError, IndexerError, RelayerError, PasskeyKitErrorCode, } from "./errors.js";
+import { failedTransaction } from "./contract-errors.js";
+import { MercuryIndexer } from "./indexer/index.js";
+import { SignerKey } from "./types.js";
+// Re-export the relayer surface so `passkey-kit/server` is the single
+// server-only entrypoint (secrets never reach the browser bundle).
+export { RelayerClient, } from "./relayer.js";
+/** Normalize any submittable input to a built {@link Transaction}. */
+function toBuiltTransaction(input, networkPassphrase) {
+    if (typeof input === "string") {
+        return TransactionBuilder.fromXDR(input, networkPassphrase);
+    }
+    if (input instanceof AssembledTransaction) {
+        if (!input.built) {
+            throw new RelayerError("AssembledTransaction has not been built/simulated yet", PasskeyKitErrorCode.RELAYER_REQUEST_FAILED);
+        }
+        return input.built;
+    }
+    return input;
+}
+/** Whether any invokeHostFunction op carries source-account auth. */
+function hasSourceAccountAuth(transaction) {
+    for (const op of transaction.operations) {
+        if (op.type !== "invokeHostFunction")
+            continue;
+        for (const entry of op.auth ?? []) {
+            if (entry.credentials().switch().name === "sorobanCredentialsSourceAccount") {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+export class PasskeyServer {
+    networkPassphrase;
+    rpc;
+    relayer;
+    mercury;
+    constructor(config) {
+        if (!config.networkPassphrase) {
+            throw new ConfigurationError("networkPassphrase is required", PasskeyKitErrorCode.MISSING_CONFIG);
+        }
+        this.networkPassphrase = config.networkPassphrase;
+        if (config.rpcUrl) {
+            this.rpc = new Server(config.rpcUrl);
+        }
+        if (config.relayer) {
+            this.relayer = new RelayerClient(config.relayer);
+        }
+        if (config.mercury) {
+            const mercury = MercuryIndexer.forNetwork({ url: config.mercury.url, rpc: this.rpc }, this.networkPassphrase);
+            if (!mercury) {
+                throw new ConfigurationError("Mercury has no hosted passkey-indexer for this network; pass mercury.url to point at a self-hosted instance", PasskeyKitErrorCode.INVALID_CONFIG);
+            }
+            this.mercury = mercury;
+        }
+    }
+    // -- Submission --------------------------------------------------------------
+    /**
+     * Submit a transaction via the relayer for fee sponsorship.
+     *
+     * invokeHostFunction transactions without source-account auth use the preferred
+     * `{ func, auth }` Soroban path; everything else (deploys, source-account auth)
+     * is fee-bumped via the `{ xdr }` envelope path. Never throws — returns a typed
+     * {@link TransactionResult}.
+     */
+    async send(input, options) {
+        if (!this.relayer) {
+            return failedTransaction(new RelayerError("Relayer is not configured on this PasskeyServer", PasskeyKitErrorCode.RELAYER_NOT_CONFIGURED));
+        }
+        let built;
+        try {
+            built = toBuiltTransaction(input, this.networkPassphrase);
+        }
+        catch (err) {
+            return failedTransaction(err instanceof RelayerError
+                ? err
+                : new RelayerError(err instanceof Error ? err.message : String(err), PasskeyKitErrorCode.RELAYER_REQUEST_FAILED));
+        }
+        const op = built.operations[0];
+        if (op?.type === "invokeHostFunction" && !hasSourceAccountAuth(built)) {
+            const invokeOp = op;
+            const func = invokeOp.func.toXDR("base64");
+            const auth = (invokeOp.auth ?? []).map((entry) => entry.toXDR("base64"));
+            return this.relayer.send(func, auth, options);
+        }
+        return this.relayer.sendTransaction(built.toXDR(), options);
+    }
+    /** Poll a `skipWait` submission by its relayer transaction id. */
+    getTransaction(transactionId) {
+        if (!this.relayer) {
+            return Promise.resolve(failedTransaction(new RelayerError("Relayer is not configured on this PasskeyServer", PasskeyKitErrorCode.RELAYER_NOT_CONFIGURED)));
+        }
+        return this.relayer.getTransaction(transactionId);
+    }
+    // -- Indexer (convenience delegation to the keyless Mercury passkey-indexer) --
+    requireMercury() {
+        if (!this.mercury) {
+            throw new IndexerError("Mercury indexer is not configured on this PasskeyServer", PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED);
+        }
+        return this.mercury;
+    }
+    /**
+     * Enumerate a wallet's signers via Mercury. Temporary signers whose ledger
+     * entry has been evicted are flagged `status: "evicted"` when this server was
+     * given an `rpcUrl` (the indexer can't observe TTL eviction directly).
+     */
+    getSigners(contractId) {
+        return this.requireMercury().getSigners(contractId);
+    }
+    /**
+     * Reverse lookup: find the wallet(s) a signer belongs to via Mercury.
+     *
+     * @returns the confirmed address at `index`, or `undefined` if there are none.
+     */
+    async getContractId(options, index = 0) {
+        const provided = [options.keyId, options.publicKey, options.policy].filter(Boolean);
+        if (provided.length !== 1) {
+            throw new IndexerError("Provide exactly one of keyId, publicKey, or policy", PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+        }
+        let key;
+        if (options.keyId)
+            key = SignerKey.Secp256r1(options.keyId);
+        else if (options.publicKey)
+            key = SignerKey.Ed25519(options.publicKey);
+        else
+            key = SignerKey.Policy(options.policy);
+        const wallets = await this.requireMercury().findWallets(key);
+        return wallets[index];
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAEL,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAuD,MAAM,cAAc,CAAC;AAClG,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,sEAAsE;AACtE,mEAAmE;AACnE,OAAO,EACL,aAAa,GAGd,MAAM,cAAc,CAAC;AAwBtB,sEAAsE;AACtE,SAAS,kBAAkB,CACzB,KAA2D,EAC3D,iBAAyB;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAgB,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,uDAAuD,EACvD,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,SAAS,oBAAoB,CAAC,WAAwB;IACpD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,IAAI,KAAK,oBAAoB;YAAE,SAAS;QAC/C,KAAK,MAAM,KAAK,IAAK,EAAmC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACpE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC5E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,aAAa;IACf,iBAAiB,CAAS;IAC1B,GAAG,CAAU;IAEL,OAAO,CAAiB;IACxB,OAAO,CAAkB;IAE1C,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,EAC/B,mBAAmB,CAAC,cAAc,CACnC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAElD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CACvC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAC1C,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,kBAAkB,CAC1B,6GAA6G,EAC7G,mBAAmB,CAAC,cAAc,CACnC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAED,+EAA+E;IAE/E;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CACR,KAA2D,EAC3D,OAA8B;QAE9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,iBAAiB,CACtB,IAAI,YAAY,CACd,iDAAiD,EACjD,mBAAmB,CAAC,sBAAsB,CAC3C,CACF,CAAC;QACJ,CAAC;QAED,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,iBAAiB,CACtB,GAAG,YAAY,YAAY;gBACzB,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,IAAI,YAAY,CACd,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,mBAAmB,CAAC,sBAAsB,CAC3C,CACN,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,oBAAoB,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAG,EAAkC,CAAC;YACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,kEAAkE;IAClE,cAAc,CAAC,aAAqB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,OAAO,CACpB,iBAAiB,CACf,IAAI,YAAY,CACd,iDAAiD,EACjD,mBAAmB,CAAC,sBAAsB,CAC3C,CACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAExE,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CACpB,yDAAyD,EACzD,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,UAAkB;QAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgE,EAChE,KAAK,GAAG,CAAC;QAET,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CACxE,OAAO,CACR,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CACpB,oDAAoD,EACpD,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,GAAc,CAAC;QACnB,IAAI,OAAO,CAAC,KAAK;YAAE,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACvD,IAAI,OAAO,CAAC,SAAS;YAAE,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;;YAClE,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/signers.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Typed signer abstraction for the flat `Signatures` map.
+ *
+ * A {@link Signer} knows how to authenticate a signature payload (the 32-byte
+ * hash from `buildSignaturePayload`) and produce the on-chain
+ * `(SignerKey, Signature)` pair the wallet's `__check_auth` expects. This
+ * replaces the old `sign({ keyId | keypair | policy })` option trio, where the
+ * caller had to pass exactly one of three mutually-exclusive fields, with three
+ * explicit signer classes:
+ *
+ * - {@link PasskeySigner} — a WebAuthn secp256r1 passkey (default).
+ * - {@link Ed25519Signer} — a local Stellar keypair.
+ * - {@link PolicySigner} — a policy contract co-signer (no signature bytes).
+ *
+ * @packageDocumentation
+ */
+import { Keypair } from "@stellar/stellar-sdk";
+import type { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON } from "@simplewebauthn/browser";
+import type { Signature as SDKSignature, SignerKey as SDKSignerKey } from "passkey-kit-sdk";
+/** The WebAuthn `startAuthentication` surface a {@link PasskeySigner} needs. */
+export interface WebAuthnAuthenticator {
+    startAuthentication(args: {
+        optionsJSON: PublicKeyCredentialRequestOptionsJSON;
+    }): Promise<AuthenticationResponseJSON>;
+}
+/** Ambient context passed to every {@link Signer.sign} call by the kit. */
+export interface SignerContext {
+    /** WebAuthn Relying Party id (domain); defaults to the current origin. */
+    rpId?: string;
+    /** The WebAuthn implementation (overridable for tests). */
+    webAuthn: WebAuthnAuthenticator;
+    /** The connected wallet's default passkey keyId (base64url), when known. */
+    defaultKeyId?: string;
+}
+/** The on-chain `(SignerKey, Signature)` pair a signer produces. */
+export interface PreparedSignature {
+    key: SDKSignerKey;
+    /** `undefined` for policy signers (the map stores `scvVoid` for the value). */
+    value: SDKSignature | undefined;
+}
+/** A signer for the wallet's flat `Signatures` map. */
+export interface Signer {
+    /** Authenticate a signature payload into an on-chain signature pair. */
+    sign(payload: Buffer, context: SignerContext): Promise<PreparedSignature> | PreparedSignature;
+}
+/**
+ * An Ed25519 signer backed by a local Stellar keypair.
+ */
+export declare class Ed25519Signer implements Signer {
+    private readonly keypair;
+    constructor(keypair: Keypair);
+    /**
+     * Build an {@link Ed25519Signer} from a Stellar secret key (`S…`).
+     *
+     * @throws {ValidationError} If the secret key is invalid.
+     */
+    static fromSecret(secretKey: string): Ed25519Signer;
+    /** The signer's `G…` public key. */
+    get address(): string;
+    sign(payload: Buffer): PreparedSignature;
+}
+/**
+ * A policy signer: a policy contract co-authorizes the entry. The map value is
+ * `scvVoid`; the wallet calls the policy's `policy__` during `__check_auth`.
+ */
+export declare class PolicySigner implements Signer {
+    private readonly policy;
+    constructor(policy: string);
+    sign(): PreparedSignature;
+}
+/**
+ * A WebAuthn secp256r1 passkey signer.
+ *
+ * Pass a specific `keyId` to require that credential, `"any"` to let the
+ * authenticator pick a discoverable credential, or omit it to use the kit's
+ * connected passkey ({@link SignerContext.defaultKeyId}).
+ */
+export declare class PasskeySigner implements Signer {
+    private readonly keyId;
+    constructor(keyId?: "any" | string | Uint8Array);
+    sign(payload: Buffer, context: SignerContext): Promise<PreparedSignature>;
+}
+//# sourceMappingURL=signers.d.ts.map

package/dist/signers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers.d.ts","sourceRoot":"","sources":["../src/signers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EACV,0BAA0B,EAC1B,qCAAqC,EACtC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,SAAS,IAAI,YAAY,EACzB,SAAS,IAAI,YAAY,EAC1B,MAAM,iBAAiB,CAAC;AAMzB,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE,qCAAqC,CAAC;KACpD,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACzC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,qBAAqB,CAAC;IAChC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,YAAY,CAAC;IAClB,+EAA+E;IAC/E,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;CACjC;AAED,uDAAuD;AACvD,MAAM,WAAW,MAAM;IACrB,wEAAwE;IACxE,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;CACnD;AAED;;GAEG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;gBAEtB,OAAO,EAAE,OAAO;IAI5B;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa;IAUnD,oCAAoC;IACpC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;CAOzC;AAED;;;GAGG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,EAAE,MAAM;IAI1B,IAAI,IAAI,iBAAiB;CAM1B;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;gBAEvC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU;IAKzC,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,iBAAiB,CAAC;CAuD9B"}

package/dist/signers.js

@@ -0,0 +1,124 @@
+/**
+ * Typed signer abstraction for the flat `Signatures` map.
+ *
+ * A {@link Signer} knows how to authenticate a signature payload (the 32-byte
+ * hash from `buildSignaturePayload`) and produce the on-chain
+ * `(SignerKey, Signature)` pair the wallet's `__check_auth` expects. This
+ * replaces the old `sign({ keyId | keypair | policy })` option trio, where the
+ * caller had to pass exactly one of three mutually-exclusive fields, with three
+ * explicit signer classes:
+ *
+ * - {@link PasskeySigner} — a WebAuthn secp256r1 passkey (default).
+ * - {@link Ed25519Signer} — a local Stellar keypair.
+ * - {@link PolicySigner} — a policy contract co-signer (no signature bytes).
+ *
+ * @packageDocumentation
+ */
+import { Keypair } from "@stellar/stellar-sdk";
+import base64url from "./base64url.js";
+import { compactSignature } from "./utils.js";
+import { ValidationError, PasskeyKitErrorCode } from "./errors.js";
+import { WEBAUTHN_TIMEOUT_MS } from "./constants.js";
+/**
+ * An Ed25519 signer backed by a local Stellar keypair.
+ */
+export class Ed25519Signer {
+    keypair;
+    constructor(keypair) {
+        this.keypair = keypair;
+    }
+    /**
+     * Build an {@link Ed25519Signer} from a Stellar secret key (`S…`).
+     *
+     * @throws {ValidationError} If the secret key is invalid.
+     */
+    static fromSecret(secretKey) {
+        try {
+            return new Ed25519Signer(Keypair.fromSecret(secretKey));
+        }
+        catch {
+            throw new ValidationError("Invalid Ed25519 secret key (must be a valid Stellar secret key, S…)");
+        }
+    }
+    /** The signer's `G…` public key. */
+    get address() {
+        return this.keypair.publicKey();
+    }
+    sign(payload) {
+        const signature = this.keypair.sign(payload);
+        return {
+            key: { tag: "Ed25519", values: [Buffer.from(this.keypair.rawPublicKey())] },
+            value: { tag: "Ed25519", values: [signature] },
+        };
+    }
+}
+/**
+ * A policy signer: a policy contract co-authorizes the entry. The map value is
+ * `scvVoid`; the wallet calls the policy's `policy__` during `__check_auth`.
+ */
+export class PolicySigner {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    sign() {
+        return {
+            key: { tag: "Policy", values: [this.policy] },
+            value: { tag: "Policy", values: undefined },
+        };
+    }
+}
+/**
+ * A WebAuthn secp256r1 passkey signer.
+ *
+ * Pass a specific `keyId` to require that credential, `"any"` to let the
+ * authenticator pick a discoverable credential, or omit it to use the kit's
+ * connected passkey ({@link SignerContext.defaultKeyId}).
+ */
+export class PasskeySigner {
+    keyId;
+    constructor(keyId) {
+        this.keyId =
+            keyId instanceof Uint8Array ? base64url(Buffer.from(keyId)) : keyId;
+    }
+    async sign(payload, context) {
+        const requestedKeyId = this.keyId === "any" ? undefined : this.keyId ?? context.defaultKeyId;
+        // No specific credential → let the authenticator choose a discoverable one.
+        const discoverable = this.keyId === "any" || requestedKeyId === undefined;
+        const optionsJSON = {
+            challenge: base64url(payload),
+            rpId: context.rpId,
+            userVerification: "preferred",
+            timeout: WEBAUTHN_TIMEOUT_MS,
+            ...(discoverable
+                ? {}
+                : {
+                    allowCredentials: [{ id: requestedKeyId, type: "public-key" }],
+                }),
+        };
+        let response;
+        try {
+            response = await context.webAuthn.startAuthentication({ optionsJSON });
+        }
+        catch (err) {
+            throw new ValidationError("WebAuthn authentication failed", PasskeyKitErrorCode.INVALID_INPUT, { cause: err instanceof Error ? err.message : String(err) });
+        }
+        return {
+            key: {
+                tag: "Secp256r1",
+                values: [base64url.toBuffer(response.id)],
+            },
+            value: {
+                tag: "Secp256r1",
+                values: [
+                    {
+                        authenticator_data: base64url.toBuffer(response.response.authenticatorData),
+                        client_data_json: base64url.toBuffer(response.response.clientDataJSON),
+                        signature: Buffer.from(compactSignature(base64url.toBuffer(response.response.signature))),
+                    },
+                ],
+            },
+        };
+    }
+}
+//# sourceMappingURL=signers.js.map

package/dist/signers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers.js","sourceRoot":"","sources":["../src/signers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAS/C,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAmCrD;;GAEG;AACH,MAAM,OAAO,aAAa;IACP,OAAO,CAAU;IAElC,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,SAAiB;QACjC,IAAI,CAAC;YACH,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO;YACL,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE;YAC3E,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,YAAY;IACN,MAAM,CAAS;IAEhC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI;QACF,OAAO;YACL,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC7C,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;SAC5C,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACP,KAAK,CAA6B;IAEnD,YAAY,KAAmC;QAC7C,IAAI,CAAC,KAAK;YACR,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAsB;QAEtB,MAAM,cAAc,GAClB,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC;QAExE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc,KAAK,SAAS,CAAC;QAE1E,MAAM,WAAW,GAA0C;YACzD,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,gBAAgB,EAAE,WAAW;YAC7B,OAAO,EAAE,mBAAmB;YAC5B,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,cAAe,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;iBAChE,CAAC;SACP,CAAC;QAEF,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,gCAAgC,EAChC,mBAAmB,CAAC,aAAa,EACjC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,EAAE;gBACH,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC1C;YACD,KAAK,EAAE;gBACL,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE;oBACN;wBACE,kBAAkB,EAAE,SAAS,CAAC,QAAQ,CACpC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CACpC;wBACD,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAClC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CACjC;wBACD,SAAS,EAAE,MAAM,CAAC,IAAI,CACpB,gBAAgB,CACd,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChD,CACF;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/storage/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Storage adapters for passkey persistence.
+ *
+ * Import from the `passkey-kit/storage` subpath:
+ * ```typescript
+ * import { IndexedDBStorage, MemoryStorage } from "passkey-kit/storage";
+ * ```
+ */
+export { MemoryStorage } from "./memory.js";
+export { LocalStorageAdapter } from "./localStorage.js";
+export { IndexedDBStorage } from "./indexeddb.js";
+export type { StorageAdapter, StoredPasskey } from "../types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/storage/index.js

@@ -0,0 +1,12 @@
+/**
+ * Storage adapters for passkey persistence.
+ *
+ * Import from the `passkey-kit/storage` subpath:
+ * ```typescript
+ * import { IndexedDBStorage, MemoryStorage } from "passkey-kit/storage";
+ * ```
+ */
+export { MemoryStorage } from "./memory.js";
+export { LocalStorageAdapter } from "./localStorage.js";
+export { IndexedDBStorage } from "./indexeddb.js";
+//# sourceMappingURL=index.js.map

package/dist/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/storage/indexeddb.d.ts

@@ -0,0 +1,26 @@
+/**
+ * IndexedDB passkey storage adapter.
+ *
+ * Recommended for web apps: larger limits than localStorage, an async API that
+ * doesn't block the main thread, and native `Uint8Array` support.
+ */
+import type { StorageAdapter, StoredPasskey } from "../types.js";
+export declare class IndexedDBStorage implements StorageAdapter {
+    private dbName;
+    private dbPromise;
+    constructor(dbName?: string);
+    private getDB;
+    private withStore;
+    save(passkey: StoredPasskey): Promise<void>;
+    get(keyId: string): Promise<StoredPasskey | null>;
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    getAll(): Promise<StoredPasskey[]>;
+    delete(keyId: string): Promise<void>;
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    clear(): Promise<void>;
+    /** Close the database connection. */
+    close(): Promise<void>;
+    /** Delete the entire database. */
+    static deleteDatabase(dbName?: string): Promise<void>;
+}
+//# sourceMappingURL=indexeddb.d.ts.map

package/dist/storage/indexeddb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexeddb.d.ts","sourceRoot":"","sources":["../../src/storage/indexeddb.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAqC;gBAE1C,MAAM,GAAE,MAAgB;YAItB,KAAK;YAgCL,SAAS;IAiBjB,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAgB3D,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAMlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC;IAOV,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,qCAAqC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,kCAAkC;WACrB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAQrE"}

package/dist/storage/indexeddb.js

@@ -0,0 +1,100 @@
+/**
+ * IndexedDB passkey storage adapter.
+ *
+ * Recommended for web apps: larger limits than localStorage, an async API that
+ * doesn't block the main thread, and native `Uint8Array` support.
+ */
+import { DB_NAME, DB_VERSION, IDB_STORE_CREDENTIALS, IDB_INDEX_CONTRACT_ID, } from "../constants.js";
+export class IndexedDBStorage {
+    dbName;
+    dbPromise = null;
+    constructor(dbName = DB_NAME) {
+        this.dbName = dbName;
+    }
+    async getDB() {
+        if (this.dbPromise)
+            return this.dbPromise;
+        this.dbPromise = new Promise((resolve, reject) => {
+            if (typeof indexedDB === "undefined") {
+                reject(new Error("IndexedDB is not available in this environment"));
+                return;
+            }
+            const request = indexedDB.open(this.dbName, DB_VERSION);
+            request.onerror = () => reject(new Error(`Failed to open IndexedDB: ${request.error?.message}`));
+            request.onsuccess = () => resolve(request.result);
+            request.onupgradeneeded = (event) => {
+                const db = event.target.result;
+                if (!db.objectStoreNames.contains(IDB_STORE_CREDENTIALS)) {
+                    const store = db.createObjectStore(IDB_STORE_CREDENTIALS, {
+                        keyPath: "keyId",
+                    });
+                    store.createIndex(IDB_INDEX_CONTRACT_ID, IDB_INDEX_CONTRACT_ID, {
+                        unique: false,
+                    });
+                }
+            };
+        });
+        return this.dbPromise;
+    }
+    async withStore(mode, callback) {
+        const db = await this.getDB();
+        return new Promise((resolve, reject) => {
+            const transaction = db.transaction(IDB_STORE_CREDENTIALS, mode);
+            const store = transaction.objectStore(IDB_STORE_CREDENTIALS);
+            const request = callback(store);
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new Error(`IndexedDB operation failed: ${request.error?.message}`));
+        });
+    }
+    async save(passkey) {
+        await this.withStore("readwrite", (store) => store.put(passkey));
+    }
+    async get(keyId) {
+        const result = await this.withStore("readonly", (store) => store.get(keyId));
+        return result ?? null;
+    }
+    async getByContract(contractId) {
+        const db = await this.getDB();
+        return new Promise((resolve, reject) => {
+            const transaction = db.transaction(IDB_STORE_CREDENTIALS, "readonly");
+            const index = transaction
+                .objectStore(IDB_STORE_CREDENTIALS)
+                .index(IDB_INDEX_CONTRACT_ID);
+            const request = index.getAll(contractId);
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new Error(`Failed to query by contract: ${request.error?.message}`));
+        });
+    }
+    async getAll() {
+        return this.withStore("readonly", (store) => store.getAll());
+    }
+    async delete(keyId) {
+        await this.withStore("readwrite", (store) => store.delete(keyId));
+    }
+    async update(keyId, updates) {
+        const existing = await this.get(keyId);
+        if (existing) {
+            await this.save({ ...existing, ...updates });
+        }
+    }
+    async clear() {
+        await this.withStore("readwrite", (store) => store.clear());
+    }
+    /** Close the database connection. */
+    async close() {
+        if (this.dbPromise) {
+            const db = await this.dbPromise;
+            db.close();
+            this.dbPromise = null;
+        }
+    }
+    /** Delete the entire database. */
+    static async deleteDatabase(dbName = DB_NAME) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.deleteDatabase(dbName);
+            request.onsuccess = () => resolve();
+            request.onerror = () => reject(new Error(`Failed to delete database: ${request.error?.message}`));
+        });
+    }
+}
+//# sourceMappingURL=indexeddb.js.map

package/dist/storage/indexeddb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexeddb.js","sourceRoot":"","sources":["../../src/storage/indexeddb.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAS;IACf,SAAS,GAAgC,IAAI,CAAC;IAEtD,YAAY,SAAiB,OAAO;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,SAAS,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAExD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAE3E,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAElD,OAAO,CAAC,eAAe,GAAG,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,EAAE,GAAI,KAAK,CAAC,MAA2B,CAAC,MAAM,CAAC;gBACrD,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;oBACzD,MAAM,KAAK,GAAG,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;wBACxD,OAAO,EAAE,OAAO;qBACjB,CAAC,CAAC;oBACH,KAAK,CAAC,WAAW,CAAC,qBAAqB,EAAE,qBAAqB,EAAE;wBAC9D,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,IAAwB,EACxB,QAAkD;QAElD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CACnE,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,UAAU,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAC5B,CAAC;QACF,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,WAAW;iBACtB,WAAW,CAAC,qBAAqB,CAAC;iBAClC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACzC,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CACpE,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,SAAS,CAAkB,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3D,KAAK,CAAC,MAAM,EAAE,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,OAA4D;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YAChC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,SAAiB,OAAO;QAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/storage/localStorage.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `localStorage` passkey storage adapter.
+ *
+ * Persists passkey records across page reloads in the browser. `localStorage`
+ * has a ~5MB limit and stores data unencrypted; for larger or more structured
+ * needs prefer {@link import("./indexeddb.js").IndexedDBStorage}.
+ */
+import type { StorageAdapter, StoredPasskey } from "../types.js";
+export declare class LocalStorageAdapter implements StorageAdapter {
+    private storageKey;
+    constructor(storageKey?: string);
+    private read;
+    private write;
+    save(passkey: StoredPasskey): Promise<void>;
+    get(keyId: string): Promise<StoredPasskey | null>;
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    getAll(): Promise<StoredPasskey[]>;
+    delete(keyId: string): Promise<void>;
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=localStorage.d.ts.map

package/dist/storage/localStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localStorage.d.ts","sourceRoot":"","sources":["../../src/storage/localStorage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmBjE,qBAAa,mBAAoB,YAAW,cAAc;IACxD,OAAO,CAAC,UAAU,CAAS;gBAEf,UAAU,GAAE,MAAqC;IAI7D,OAAO,CAAC,IAAI;IA0BZ,OAAO,CAAC,KAAK;IAQP,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAU3D,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpC,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC;IASV,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}