passkey-kit 0.12.1 → 0.13.1

package/dist/kit/auth-payload.js

@@ -0,0 +1,203 @@
+/**
+ * Soroban authorization-entry payload helpers + the flat `Signatures` map codec.
+ *
+ * These are thin wrappers over the stellar-sdk's native Protocol-27 auth
+ * primitives (`buildAuthorizationEntryPreimage`). The old kit hand-rolled a
+ * stack of "does this SDK support P27?" probe shims; on stellar-sdk >= 16 those
+ * are all dead, so this module simply uses the SDK.
+ *
+ * The smart wallet's `__check_auth` reads a `Signatures` value — a single
+ * `Map<SignerKey, Signature>` — from the address credentials. Each signer
+ * contributes one entry keyed by its on-chain `SignerKey`. The host rejects an
+ * `ScMap` whose keys are not in the host's canonical sort order, so the map is
+ * sorted with {@link compareScVal} (NOT a byte/`localeCompare` sort — see below).
+ *
+ * @packageDocumentation
+ */
+import { buildAuthorizationEntryPreimage, hash, xdr, } from "@stellar/stellar-sdk";
+import { SigningError, PasskeyKitErrorCode } from "../errors.js";
+// ============================================================================
+// Address credentials + signature payload
+// ============================================================================
+/**
+ * Extract the {@link xdr.SorobanAddressCredentials} from a credentials union,
+ * for the address / addressV2 / addressWithDelegates variants.
+ *
+ * @throws {SigningError} If the credentials are not address-based.
+ */
+export function getAddressCredentials(credentials) {
+    switch (credentials.switch().name) {
+        case "sorobanCredentialsAddress":
+            return credentials.address();
+        case "sorobanCredentialsAddressV2":
+            return credentials.addressV2();
+        case "sorobanCredentialsAddressWithDelegates":
+            return credentials.addressWithDelegates().addressCredentials();
+        default:
+            throw new SigningError(`Soroban credentials do not contain address credentials: ${credentials.switch().name}`, PasskeyKitErrorCode.UNSUPPORTED_CREDENTIALS);
+    }
+}
+/**
+ * Whether a credentials union uses an address-bound signature payload (the P27
+ * V2 / with-delegates variants), whose preimage binds the invoker address.
+ */
+export function usesAddressBoundPayload(credentials) {
+    const name = credentials.switch().name;
+    return (name === "sorobanCredentialsAddressV2" ||
+        name === "sorobanCredentialsAddressWithDelegates");
+}
+/**
+ * Assert that a signature-expiration ledger is a valid `u32`.
+ *
+ * @throws {SigningError} If not a `u32` integer.
+ */
+export function assertSignatureExpirationLedger(expiration) {
+    if (!Number.isInteger(expiration) ||
+        expiration < 0 ||
+        expiration > 0xffffffff) {
+        throw new SigningError("Soroban signature expiration ledger must be a uint32 integer", PasskeyKitErrorCode.INVALID_SIGNATURE_EXPIRATION, { expiration });
+    }
+}
+/**
+ * Build the signature payload (the 32-byte hash a signer signs) for an
+ * authorization entry at a given expiration ledger.
+ *
+ * Sets the expiration on the entry's address credentials, then hashes the SDK's
+ * canonical authorization-entry preimage. Works for the address, addressV2, and
+ * addressWithDelegates credential variants.
+ *
+ * @throws {SigningError} If `expiration` is not a valid `u32`.
+ */
+export function buildSignaturePayload(networkPassphrase, entry, expiration) {
+    assertSignatureExpirationLedger(expiration);
+    const credentials = getAddressCredentials(entry.credentials());
+    credentials.signatureExpirationLedger(expiration);
+    return hash(buildAuthorizationEntryPreimage(entry, expiration, networkPassphrase).toXDR());
+}
+// ============================================================================
+// Host-order ScVal comparison
+// ============================================================================
+/**
+ * Compare two ScVals in the order the Soroban host uses when it validates that
+ * an ScMap is sorted by key (host `metered_map::from_map`, which rejects an
+ * unsorted map with `InvalidInput`).
+ *
+ * This is deliberately NOT a comparison of the XDR byte encodings. XDR prefixes
+ * every variable-length payload (Bytes, Symbol, String, Vec) with a 4-byte
+ * length, so `toXDR("hex")` sorting is length-major; the host instead compares
+ * those payloads element-wise by content (Rust slice `Ord`), where a shorter
+ * value that is a prefix of a longer one sorts first. The old kit's
+ * `localeCompare` on a symbol+hex string approximated this and could diverge
+ * from the host, producing a map the wallet rejects at `__check_auth`.
+ *
+ * Only the shapes that appear as `SignerKey` map keys are handled precisely
+ * (Vec, Symbol, String, Bytes, Address). All other shapes are same-type here
+ * (the discriminant is compared first), so their fixed-width XDR encodings sort
+ * order-equivalently to the host.
+ */
+export function compareScVal(a, b) {
+    const aType = a.switch().value;
+    const bType = b.switch().value;
+    if (aType !== bType) {
+        return aType < bType ? -1 : 1;
+    }
+    switch (a.switch().name) {
+        case "scvVec": {
+            const av = a.vec() ?? [];
+            const bv = b.vec() ?? [];
+            const len = Math.min(av.length, bv.length);
+            for (let i = 0; i < len; i += 1) {
+                const cmp = compareScVal(av[i], bv[i]);
+                if (cmp !== 0)
+                    return cmp;
+            }
+            return av.length - bv.length;
+        }
+        case "scvMap": {
+            const am = a.map() ?? [];
+            const bm = b.map() ?? [];
+            const len = Math.min(am.length, bm.length);
+            for (let i = 0; i < len; i += 1) {
+                const keyCmp = compareScVal(am[i].key(), bm[i].key());
+                if (keyCmp !== 0)
+                    return keyCmp;
+                const valCmp = compareScVal(am[i].val(), bm[i].val());
+                if (valCmp !== 0)
+                    return valCmp;
+            }
+            return am.length - bm.length;
+        }
+        case "scvSymbol":
+            return Buffer.compare(Buffer.from(a.sym().toString(), "utf8"), Buffer.from(b.sym().toString(), "utf8"));
+        case "scvString":
+            return Buffer.compare(Buffer.from(a.str().toString(), "utf8"), Buffer.from(b.str().toString(), "utf8"));
+        case "scvBytes":
+            return Buffer.compare(Buffer.from(a.bytes()), Buffer.from(b.bytes()));
+        case "scvAddress":
+            // ScAddress is a type discriminant plus a fixed-width key, so a byte
+            // comparison of the encoding matches the host's (type, key) ordering.
+            return Buffer.compare(a.address().toXDR(), b.address().toXDR());
+        default:
+            // Same-type scalar (or any unhandled shape): its XDR encoding is
+            // fixed-width for a given type, so a byte comparison is order-equivalent.
+            return Buffer.compare(a.toXDR(), b.toXDR());
+    }
+}
+// ============================================================================
+// SignerKey / Signature encoding + the flat Signatures map
+// ============================================================================
+const SIGNER_KEY_UDT = xdr.ScSpecTypeDef.scSpecTypeUdt(new xdr.ScSpecTypeUdt({ name: "SignerKey" }));
+const SIGNATURE_UDT = xdr.ScSpecTypeDef.scSpecTypeUdt(new xdr.ScSpecTypeUdt({ name: "Signature" }));
+/** The `SignerVal` UDT type def, for decoding a stored signer entry's value. */
+export const SIGNER_VAL_UDT = xdr.ScSpecTypeDef.scSpecTypeUdt(new xdr.ScSpecTypeUdt({ name: "SignerVal" }));
+/** Encode a native `SignerKey` union into its contract ScVal via the spec. */
+export function signerKeyToScVal(spec, key) {
+    return spec.nativeToScVal(key, SIGNER_KEY_UDT);
+}
+/**
+ * Encode a native `Signature` union into its contract ScVal via the spec, or
+ * `scvVoid` when there is no signature value (policy signers).
+ */
+export function signatureToScVal(spec, val) {
+    return val ? spec.nativeToScVal(val, SIGNATURE_UDT) : xdr.ScVal.scvVoid();
+}
+/**
+ * Upsert a `(SignerKey, Signature)` pair into the entry's `Signatures` value,
+ * which is encoded as `scvVec([ scvMap([...]) ])`.
+ *
+ * A signer key already present in the map is replaced (co-signing is idempotent
+ * per signer). The map is re-sorted by key in host order after every insert, so
+ * the wallet's `__check_auth` accepts it.
+ *
+ * @throws {SigningError} If the existing signature is neither void nor a
+ *   Signatures vec.
+ */
+export function upsertSignatureEntry(credentials, scKey, scVal) {
+    const newEntry = new xdr.ScMapEntry({ key: scKey, val: scVal });
+    switch (credentials.signature().switch().name) {
+        case "scvVoid": {
+            credentials.signature(xdr.ScVal.scvVec([xdr.ScVal.scvMap([newEntry])]));
+            break;
+        }
+        case "scvVec": {
+            const map = credentials.signature().vec()?.[0]?.map();
+            if (!map) {
+                throw new SigningError("Malformed Signatures value: expected a map inside the signatures vector", PasskeyKitErrorCode.SIGNING_FAILED);
+            }
+            const existingIndex = map.findIndex((entry) => compareScVal(entry.key(), scKey) === 0);
+            if (existingIndex >= 0) {
+                map[existingIndex] = newEntry;
+            }
+            else {
+                map.push(newEntry);
+            }
+            // Host order: the wallet converts this map to a host object and rejects
+            // it if the keys are not in host-sort order.
+            map.sort((x, y) => compareScVal(x.key(), y.key()));
+            break;
+        }
+        default:
+            throw new SigningError(`Unsupported existing signature value: ${credentials.signature().switch().name}`, PasskeyKitErrorCode.SIGNING_FAILED);
+    }
+}
+//# sourceMappingURL=auth-payload.js.map

package/dist/kit/auth-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-payload.js","sourceRoot":"","sources":["../../src/kit/auth-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,+BAA+B,EAC/B,IAAI,EACJ,GAAG,GACJ,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEjE,+EAA+E;AAC/E,0CAA0C;AAC1C,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmC;IAEnC,QAAQ,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClC,KAAK,2BAA2B;YAC9B,OAAO,WAAW,CAAC,OAAO,EAAE,CAAC;QAC/B,KAAK,6BAA6B;YAChC,OAAO,WAAW,CAAC,SAAS,EAAE,CAAC;QACjC,KAAK,wCAAwC;YAC3C,OAAO,WAAW,CAAC,oBAAoB,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjE;YACE,MAAM,IAAI,YAAY,CACpB,2DAA2D,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EACtF,mBAAmB,CAAC,uBAAuB,CAC5C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IACvC,OAAO,CACL,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,wCAAwC,CAClD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC7B,UAAU,GAAG,CAAC;QACd,UAAU,GAAG,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8DAA8D,EAC9D,mBAAmB,CAAC,4BAA4B,EAChD,EAAE,UAAU,EAAE,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAyB,EACzB,KAAoC,EACpC,UAAkB;IAElB,+BAA+B,CAAC,UAAU,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,WAAW,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAElD,OAAO,IAAI,CACT,+BAA+B,CAC7B,KAAK,EACL,UAAU,EACV,iBAAiB,CAClB,CAAC,KAAK,EAAE,CACV,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,CAAY,EAAE,CAAY;IACrD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;IAC/B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;gBACzC,IAAI,GAAG,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;gBAChC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;YAClC,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,EACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CACxC,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,EACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CACxC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,KAAK,YAAY;YACf,qEAAqE;YACrE,sEAAsE;YACtE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAClE;YACE,iEAAiE;YACjE,0EAA0E;YAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,CACpD,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC7C,CAAC;AACF,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,CACnD,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC7C,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,CAC3D,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC7C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAkB,EAClB,GAAiB;IAEjB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAkB,EAClB,GAA6B;IAE7B,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA0C,EAC1C,KAAgB,EAChB,KAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhE,QAAQ,WAAW,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9C,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YACtD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,YAAY,CACpB,yEAAyE,EACzE,mBAAmB,CAAC,cAAc,CACnC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAClD,CAAC;YACF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;YACD,wEAAwE;YACxE,6CAA6C;YAC7C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnD,MAAM;QACR,CAAC;QACD;YACE,MAAM,IAAI,YAAY,CACpB,yCAAyC,WAAW,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAChF,mBAAmB,CAAC,cAAc,CACnC,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/kit/deploy-ops.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Smart-wallet deployment operations.
+ *
+ * The deployer keypair is now configurable (`config.deploySource`) instead of a
+ * hard-coded `Keypair.fromRawEd25519Seed(hash("kalepail"))`. The default still
+ * derives from {@link DEFAULT_DEPLOYER_SEED} = `"kalepail"` so contract-id
+ * determinism (and indexer reverse-lookup) is preserved out of the box.
+ *
+ * @packageDocumentation
+ */
+import { Keypair } from "@stellar/stellar-sdk";
+import type { AssembledTransaction } from "@stellar/stellar-sdk/contract";
+import { Client as PasskeyClient } from "passkey-kit-sdk";
+/**
+ * Resolve the fee-paying deployer keypair from an optional secret.
+ *
+ * With no secret, derives the canonical deterministic deployer from
+ * {@link DEFAULT_DEPLOYER_SEED}. The deployer only pays fees and salts the
+ * deploy; it never controls the wallet. Supplying a different `deploySource`
+ * changes the derived contract addresses (and breaks keyId → contract
+ * discovery), so this is documented as an advanced option.
+ *
+ * @throws {ConfigurationError} If `deploySource` is not a valid secret key.
+ */
+export declare function resolveDeployer(deploySource?: string): Keypair;
+/** Deterministically derive a smart-wallet address for a passkey credential. */
+export declare function deriveWalletAddress(deps: {
+    networkPassphrase: string;
+    deployerPublicKey: string;
+}, keyId: Buffer): string;
+/**
+ * Build the smart-wallet deploy transaction, initializing it with the passkey as
+ * the first (unlimited, persistent) Secp256r1 signer via `__constructor`.
+ *
+ * The returned {@link AssembledTransaction} still needs to be signed by the
+ * deployer keypair (the fee source) before submission.
+ */
+export declare function buildDeployTransaction(deps: {
+    rpcUrl: string;
+    networkPassphrase: string;
+    walletWasmHash: string;
+    deployerPublicKey: string;
+    timeoutInSeconds: number;
+}, keyId: Buffer, publicKey: Uint8Array): Promise<AssembledTransaction<PasskeyClient>>;
+//# sourceMappingURL=deploy-ops.d.ts.map

package/dist/kit/deploy-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-ops.d.ts","sourceRoot":"","sources":["../../src/kit/deploy-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAQ,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,MAAM,IAAI,aAAa,EAExB,MAAM,iBAAiB,CAAC;AAKzB;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,EAC9D,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAuB9C"}

package/dist/kit/deploy-ops.js

@@ -0,0 +1,69 @@
+/**
+ * Smart-wallet deployment operations.
+ *
+ * The deployer keypair is now configurable (`config.deploySource`) instead of a
+ * hard-coded `Keypair.fromRawEd25519Seed(hash("kalepail"))`. The default still
+ * derives from {@link DEFAULT_DEPLOYER_SEED} = `"kalepail"` so contract-id
+ * determinism (and indexer reverse-lookup) is preserved out of the box.
+ *
+ * @packageDocumentation
+ */
+import { Keypair, hash } from "@stellar/stellar-sdk";
+import { Client as PasskeyClient, } from "passkey-kit-sdk";
+import { DEFAULT_DEPLOYER_SEED } from "../constants.js";
+import { deriveContractAddress } from "../utils.js";
+import { ConfigurationError, PasskeyKitErrorCode } from "../errors.js";
+/**
+ * Resolve the fee-paying deployer keypair from an optional secret.
+ *
+ * With no secret, derives the canonical deterministic deployer from
+ * {@link DEFAULT_DEPLOYER_SEED}. The deployer only pays fees and salts the
+ * deploy; it never controls the wallet. Supplying a different `deploySource`
+ * changes the derived contract addresses (and breaks keyId → contract
+ * discovery), so this is documented as an advanced option.
+ *
+ * @throws {ConfigurationError} If `deploySource` is not a valid secret key.
+ */
+export function resolveDeployer(deploySource) {
+    if (deploySource) {
+        try {
+            return Keypair.fromSecret(deploySource);
+        }
+        catch {
+            throw new ConfigurationError("deploySource must be a valid Stellar secret key (S…)", PasskeyKitErrorCode.INVALID_CONFIG);
+        }
+    }
+    return Keypair.fromRawEd25519Seed(hash(Buffer.from(DEFAULT_DEPLOYER_SEED)));
+}
+/** Deterministically derive a smart-wallet address for a passkey credential. */
+export function deriveWalletAddress(deps, keyId) {
+    return deriveContractAddress(keyId, deps.deployerPublicKey, deps.networkPassphrase);
+}
+/**
+ * Build the smart-wallet deploy transaction, initializing it with the passkey as
+ * the first (unlimited, persistent) Secp256r1 signer via `__constructor`.
+ *
+ * The returned {@link AssembledTransaction} still needs to be signed by the
+ * deployer keypair (the fee source) before submission.
+ */
+export async function buildDeployTransaction(deps, keyId, publicKey) {
+    const signer = {
+        tag: "Secp256r1",
+        values: [
+            Buffer.from(keyId),
+            Buffer.from(publicKey),
+            [undefined], // SignerExpiration: none
+            [undefined], // SignerLimits: unlimited
+            { tag: "Persistent", values: undefined },
+        ],
+    };
+    return PasskeyClient.deploy({ signer }, {
+        rpcUrl: deps.rpcUrl,
+        wasmHash: deps.walletWasmHash,
+        networkPassphrase: deps.networkPassphrase,
+        publicKey: deps.deployerPublicKey,
+        salt: hash(keyId),
+        timeoutInSeconds: deps.timeoutInSeconds,
+    });
+}
+//# sourceMappingURL=deploy-ops.js.map

package/dist/kit/deploy-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-ops.js","sourceRoot":"","sources":["../../src/kit/deploy-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EACL,MAAM,IAAI,aAAa,GAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,YAAqB;IACnD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,sDAAsD,EACtD,mBAAmB,CAAC,cAAc,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CACjC,IAA8D,EAC9D,KAAa;IAEb,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAMC,EACD,KAAa,EACb,SAAqB;IAErB,MAAM,MAAM,GAAc;QACxB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE;YACN,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACtB,CAAC,SAAS,CAAC,EAAE,yBAAyB;YACtC,CAAC,SAAS,CAAC,EAAE,0BAA0B;YACvC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;SACzC;KACF,CAAC;IAEF,OAAO,aAAa,CAAC,MAAM,CACzB,EAAE,MAAM,EAAE,EACV;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,cAAc;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,IAAI,CAAC,iBAAiB;QACjC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;QACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CACF,CAAC;AACJ,CAAC"}

package/dist/kit/tx-ops.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Transaction-signing operations: the auth-entry signing pipeline and the
+ * `AssembledTransaction` signing entrypoint.
+ *
+ * Two deliberate changes from the old kit:
+ * - `sign` takes a single explicit `AssembledTransaction<T>` instead of the
+ *   lossy `AssembledTransaction | Tx | string` tri-input that silently dropped
+ *   memo/fee/operations on its fallback path (#599 §6). Callers holding XDR use
+ *   `AssembledTransaction.fromXDR` first.
+ * - The `Signatures` map is sorted with the host-order `compareScVal`, not the
+ *   old `localeCompare` string approximation.
+ *
+ * @packageDocumentation
+ */
+import { xdr } from "@stellar/stellar-sdk";
+import type { Keypair } from "@stellar/stellar-sdk";
+import type { Server } from "@stellar/stellar-sdk/rpc";
+import type { AssembledTransaction, Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import type { Signer, SignerContext } from "../signers.js";
+/** Deps for computing a default signature-expiration ledger. */
+export interface ExpirationDeps {
+    rpc: Server;
+    timeoutInSeconds: number;
+}
+/**
+ * Compute a default signature-expiration ledger: the latest ledger plus the
+ * timeout window (assuming ~5s ledgers), rounded up.
+ */
+export declare function calculateExpiration(deps: ExpirationDeps): Promise<number>;
+/** Deps for signing a single auth entry. */
+export interface SignAuthEntryDeps {
+    networkPassphrase: string;
+    spec: ContractSpec;
+    signerContext: SignerContext;
+    calculateExpiration: () => Promise<number>;
+}
+/** Per-call signing options. */
+export interface SignOptions {
+    /** Signature expiration ledger (defaults to the configured window). */
+    expiration?: number;
+}
+/**
+ * Sign a single Soroban authorization entry with a {@link Signer}, merging the
+ * resulting `(SignerKey, Signature)` pair into the entry's flat `Signatures`
+ * map (host-ordered).
+ *
+ * Mutates and returns the passed entry.
+ */
+export declare function signAuthEntry(deps: SignAuthEntryDeps, entry: xdr.SorobanAuthorizationEntry, signer: Signer, options?: SignOptions): Promise<xdr.SorobanAuthorizationEntry>;
+/** Deps for signing an assembled transaction's auth entries. */
+export interface SignTxDeps extends SignAuthEntryDeps {
+    getContractId: () => string | undefined;
+}
+/**
+ * Sign every auth entry of an {@link AssembledTransaction} that is authorized by
+ * the connected wallet, using `signer`. Returns the same transaction with its
+ * auth entries signed.
+ *
+ * @throws {SigningError} If no wallet is connected.
+ */
+export declare function sign<T>(deps: SignTxDeps, txn: AssembledTransaction<T>, signer: Signer, options?: SignOptions): Promise<AssembledTransaction<T>>;
+/**
+ * The `restorePreamble` shape Soroban simulation returns when a transaction
+ * touches archived entries (a subset of the SDK's `SimulateTransactionResponse`).
+ */
+export interface RestorePreamble {
+    minResourceFee: string;
+    transactionData: {
+        build(): xdr.SorobanTransactionData;
+    };
+}
+/**
+ * Restore an archived contract-data footprint reported by simulation, paying
+ * with the deployer keypair.
+ *
+ * Soroban simulation returns a `restorePreamble` when the transaction touches
+ * archived entries; the footprint must be restored (a separate, fee-bearing
+ * transaction) before the real transaction can succeed. The deployer keypair
+ * pays because it is the on-chain fee source the kit already controls.
+ *
+ * Returns the restore transaction hash. This path is exercised live in F2 (it
+ * requires archived on-chain state to trigger).
+ *
+ * @throws {SigningError} On submission/confirmation failure.
+ */
+export declare function restoreFootprint(deps: {
+    rpc: Server;
+    networkPassphrase: string;
+    deployerKeypair: Keypair;
+    timeoutInSeconds: number;
+}, restorePreamble: RestorePreamble): Promise<string>;
+//# sourceMappingURL=tx-ops.d.ts.map

package/dist/kit/tx-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx-ops.d.ts","sourceRoot":"","sources":["../../src/kit/tx-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAiC,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EACV,oBAAoB,EACpB,IAAI,IAAI,YAAY,EACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAU3D,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,aAAa,CAAC;IAC7B,mBAAmB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,GAAG,CAAC,yBAAyB,EACpC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAgCxC;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAW,SAAQ,iBAAiB;IACnD,aAAa,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAC1B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAC5B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAkBlC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE;QAAE,KAAK,IAAI,GAAG,CAAC,sBAAsB,CAAA;KAAE,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,EACD,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,MAAM,CAAC,CAkCjB"}

package/dist/kit/tx-ops.js

@@ -0,0 +1,113 @@
+/**
+ * Transaction-signing operations: the auth-entry signing pipeline and the
+ * `AssembledTransaction` signing entrypoint.
+ *
+ * Two deliberate changes from the old kit:
+ * - `sign` takes a single explicit `AssembledTransaction<T>` instead of the
+ *   lossy `AssembledTransaction | Tx | string` tri-input that silently dropped
+ *   memo/fee/operations on its fallback path (#599 §6). Callers holding XDR use
+ *   `AssembledTransaction.fromXDR` first.
+ * - The `Signatures` map is sorted with the host-order `compareScVal`, not the
+ *   old `localeCompare` string approximation.
+ *
+ * @packageDocumentation
+ */
+import { Operation, TransactionBuilder, xdr } from "@stellar/stellar-sdk";
+import { buildSignaturePayload, getAddressCredentials, signatureToScVal, signerKeyToScVal, upsertSignatureEntry, } from "./auth-payload.js";
+import { SigningError, PasskeyKitError, PasskeyKitErrorCode } from "../errors.js";
+/**
+ * Compute a default signature-expiration ledger: the latest ledger plus the
+ * timeout window (assuming ~5s ledgers), rounded up.
+ */
+export async function calculateExpiration(deps) {
+    const { sequence } = await deps.rpc.getLatestLedger();
+    return Math.ceil(sequence + deps.timeoutInSeconds / 5);
+}
+/**
+ * Sign a single Soroban authorization entry with a {@link Signer}, merging the
+ * resulting `(SignerKey, Signature)` pair into the entry's flat `Signatures`
+ * map (host-ordered).
+ *
+ * Mutates and returns the passed entry.
+ */
+export async function signAuthEntry(deps, entry, signer, options) {
+    if (entry.credentials().switch().name === "sorobanCredentialsAddressWithDelegates") {
+        throw new SigningError("ADDRESS_WITH_DELEGATES auth entries are not supported by passkey signing", PasskeyKitErrorCode.UNSUPPORTED_CREDENTIALS);
+    }
+    const credentials = getAddressCredentials(entry.credentials());
+    // `== null`, not `!expiration`: an explicit `expiration: 0` is a caller-chosen
+    // value, not "unset" — only undefined/null falls through to the entry's
+    // existing ledger or a freshly computed default.
+    let expiration = options?.expiration;
+    if (expiration == null) {
+        expiration = credentials.signatureExpirationLedger();
+        if (!expiration) {
+            expiration = await deps.calculateExpiration();
+        }
+    }
+    // Sets credentials.signatureExpirationLedger(expiration) as a side effect.
+    const payload = buildSignaturePayload(deps.networkPassphrase, entry, expiration);
+    const prepared = await signer.sign(payload, deps.signerContext);
+    const scKey = signerKeyToScVal(deps.spec, prepared.key);
+    const scVal = signatureToScVal(deps.spec, prepared.value);
+    upsertSignatureEntry(credentials, scKey, scVal);
+    return entry;
+}
+/**
+ * Sign every auth entry of an {@link AssembledTransaction} that is authorized by
+ * the connected wallet, using `signer`. Returns the same transaction with its
+ * auth entries signed.
+ *
+ * @throws {SigningError} If no wallet is connected.
+ */
+export async function sign(deps, txn, signer, options) {
+    const contractId = deps.getContractId();
+    if (!contractId) {
+        throw new SigningError("A wallet must be connected to sign a transaction", PasskeyKitErrorCode.SIGNING_FAILED);
+    }
+    await txn.signAuthEntries({
+        address: contractId,
+        authorizeEntry: async (entry) => {
+            const clone = xdr.SorobanAuthorizationEntry.fromXDR(entry.toXDR());
+            return signAuthEntry(deps, clone, signer, options);
+        },
+    });
+    return txn;
+}
+/**
+ * Restore an archived contract-data footprint reported by simulation, paying
+ * with the deployer keypair.
+ *
+ * Soroban simulation returns a `restorePreamble` when the transaction touches
+ * archived entries; the footprint must be restored (a separate, fee-bearing
+ * transaction) before the real transaction can succeed. The deployer keypair
+ * pays because it is the on-chain fee source the kit already controls.
+ *
+ * Returns the restore transaction hash. This path is exercised live in F2 (it
+ * requires archived on-chain state to trigger).
+ *
+ * @throws {SigningError} On submission/confirmation failure.
+ */
+export async function restoreFootprint(deps, restorePreamble) {
+    const account = await deps.rpc.getAccount(deps.deployerKeypair.publicKey());
+    const fee = (Number(restorePreamble.minResourceFee) + 100_000).toString();
+    const restoreTx = new TransactionBuilder(account, {
+        fee,
+        networkPassphrase: deps.networkPassphrase,
+    })
+        .addOperation(Operation.restoreFootprint({}))
+        .setSorobanData(restorePreamble.transactionData.build())
+        .setTimeout(deps.timeoutInSeconds)
+        .build();
+    restoreTx.sign(deps.deployerKeypair);
+    const sendResult = await deps.rpc.sendTransaction(restoreTx);
+    if (sendResult.status === "ERROR") {
+        throw new PasskeyKitError(`Footprint restore submission failed: ${sendResult.errorResult?.toXDR("base64") ?? "unknown"}`, PasskeyKitErrorCode.RESTORE_REQUIRED, { context: { hash: sendResult.hash } });
+    }
+    const result = await deps.rpc.pollTransaction(sendResult.hash, { attempts: 10 });
+    if (result.status !== "SUCCESS") {
+        throw new PasskeyKitError(`Footprint restore did not confirm (status ${result.status})`, PasskeyKitErrorCode.RESTORE_REQUIRED, { context: { hash: sendResult.hash } });
+    }
+    return sendResult.hash;
+}
+//# sourceMappingURL=tx-ops.js.map

package/dist/kit/tx-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx-ops.js","sourceRoot":"","sources":["../../src/kit/tx-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAQ1E,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAQlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAoB;IAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAuB,EACvB,KAAoC,EACpC,MAAc,EACd,OAAqB;IAErB,IACE,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,wCAAwC,EAC9E,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,mBAAmB,CAAC,uBAAuB,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/D,+EAA+E;IAC/E,wEAAwE;IACxE,iDAAiD;IACjD,IAAI,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;IACrC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,UAAU,GAAG,WAAW,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEhD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAgB,EAChB,GAA4B,EAC5B,MAAc,EACd,OAAqB;IAErB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,YAAY,CACpB,kDAAkD,EAClD,mBAAmB,CAAC,cAAc,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,CAAC,eAAe,CAAC;QACxB,OAAO,EAAE,UAAU;QACnB,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAKC,EACD,eAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAE1E,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE;QAChD,GAAG;QACH,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC;SACC,YAAY,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;SAC5C,cAAc,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;SACvD,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACjC,KAAK,EAAE,CAAC;IAEX,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,wCAAwC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,EAC9F,mBAAmB,CAAC,gBAAgB,EACpC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,MAAM,GAAG,EAC7D,mBAAmB,CAAC,gBAAgB,EACpC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,CAAC;AACzB,CAAC"}

package/dist/kit/wallet-ops.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Wallet signer operations: build add/update/remove signer transactions, encode
+ * the SDK-side {@link SignerKey}/{@link SignerLimits} helpers into the contract's
+ * union types, and read a signer entry back from the ledger.
+ *
+ * `getSigner` reads the flat top-level `SignerKey → SignerVal` entry directly via
+ * RPC (temporary durability before persistent, per the contract's lookup
+ * invariant). This doubles as `connectWallet`'s ownership check (#601 F7): a
+ * keyId that resolves to a live signer entry proves the wallet actually knows
+ * that passkey. When the contract's `get_signer` view lands (A3) this can move
+ * onto the view; the ledger read is equivalent and works today.
+ *
+ * @packageDocumentation
+ */
+import { type Server } from "@stellar/stellar-sdk/rpc";
+import type { AssembledTransaction, Result, Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import { Client as PasskeyClient, type SignerKey as SDKSignerKey, type SignerLimits as SDKSignerLimits, type SignerVal } from "passkey-kit-sdk";
+import { SignerStore, type SignerKey, type SignerLimits } from "../types.js";
+/**
+ * The result of a signer-write / upgrade transaction. The reworked contract's
+ * admin functions are typed `Result<void>` (they return `Ok(())` or a typed
+ * contract error), so the AssembledTransaction is generic over that.
+ */
+export type WalletTx = AssembledTransaction<Result<void>>;
+/** Which write the builder targets. */
+type SignerFn = "add_signer" | "update_signer";
+/** Encode a SDK-side {@link SignerKey} helper into the contract's union. */
+export declare function toContractSignerKey({ key, value }: SignerKey): SDKSignerKey;
+/** Encode SDK-side {@link SignerLimits} into the contract's `SignerLimits`. */
+export declare function toContractSignerLimits(limits: SignerLimits): SDKSignerLimits;
+/** Shared deps for building signer-write transactions. */
+export interface WalletWriteDeps {
+    wallet: PasskeyClient;
+    timeoutInSeconds: number;
+}
+export declare function buildSecp256r1SignerTx(deps: WalletWriteDeps, fn: SignerFn, keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildEd25519SignerTx(deps: WalletWriteDeps, fn: SignerFn, publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildPolicySignerTx(deps: WalletWriteDeps, fn: SignerFn, policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<WalletTx>;
+export declare function buildRemoveSignerTx(deps: WalletWriteDeps, signerKey: SignerKey): Promise<WalletTx>;
+/** Build an `upgrade(new_wasm_hash)` transaction (renamed from update_contract_code). */
+export declare function buildUpgradeTx(deps: WalletWriteDeps, newWasmHash: Buffer | Uint8Array): Promise<WalletTx>;
+/**
+ * Read a signer entry from the ledger, or `null` if absent.
+ *
+ * Checks temporary durability before persistent (the contract's lookup order).
+ * A non-null result proves the wallet holds this signer — the basis of
+ * `connectWallet`'s ownership verification.
+ *
+ * `null` means a genuine not-found in BOTH durabilities. A transport error
+ * (RPC 429/5xx/timeout) is NOT swallowed — it propagates, so `connectWallet`
+ * never mistakes a flaky RPC for "the passkey is not a signer" and throws a
+ * misleading `WalletOwnershipError` for a valid credential.
+ */
+export declare function getSigner(deps: {
+    rpc: Server;
+    spec: ContractSpec;
+}, contractId: string, signerKey: SignerKey): Promise<SignerVal | null>;
+export {};
+//# sourceMappingURL=wallet-ops.d.ts.map

package/dist/kit/wallet-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-ops.d.ts","sourceRoot":"","sources":["../../src/kit/wallet-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EACV,oBAAoB,EACpB,MAAM,EACN,IAAI,IAAI,YAAY,EACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,MAAM,IAAI,aAAa,EAGvB,KAAK,SAAS,IAAI,YAAY,EAC9B,KAAK,YAAY,IAAI,eAAe,EACpC,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAI7E;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAO1D,uCAAuC;AACvC,KAAK,QAAQ,GAAG,YAAY,GAAG,eAAe,CAAC;AAE/C,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,GAAG,YAAY,CAS3E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAa5E;AA6DD,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,GAAG,UAAU,EAC1B,SAAS,EAAE,MAAM,GAAG,UAAU,EAC9B,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED,yFAAyF;AACzF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,WAAW,EAAE,MAAM,GAAG,UAAU,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EACzC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B"}