passkey-kit 0.12.1 → 0.14.0

package/dist/storage/localStorage.js

@@ -0,0 +1,86 @@
+/**
+ * `localStorage` passkey storage adapter.
+ *
+ * Persists passkey records across page reloads in the browser. `localStorage`
+ * has a ~5MB limit and stores data unencrypted; for larger or more structured
+ * needs prefer {@link import("./indexeddb.js").IndexedDBStorage}.
+ */
+import { LOCALSTORAGE_CREDENTIALS_KEY } from "../constants.js";
+function serialize(passkey) {
+    return { ...passkey, publicKey: Array.from(passkey.publicKey) };
+}
+function deserialize(data) {
+    return { ...data, publicKey: new Uint8Array(data.publicKey) };
+}
+export class LocalStorageAdapter {
+    storageKey;
+    constructor(storageKey = LOCALSTORAGE_CREDENTIALS_KEY) {
+        this.storageKey = storageKey;
+    }
+    read() {
+        if (typeof localStorage === "undefined") {
+            throw new Error("localStorage is not available in this environment");
+        }
+        const data = localStorage.getItem(this.storageKey);
+        if (!data)
+            return new Map();
+        try {
+            const parsed = JSON.parse(data);
+            const map = new Map();
+            for (const [key, value] of Object.entries(parsed)) {
+                map.set(key, deserialize(value));
+            }
+            return map;
+        }
+        catch (error) {
+            // Corrupt storage: warn loudly rather than silently dropping the user's
+            // passkeys. Return empty so the app keeps working; do not overwrite.
+            console.error(`[PasskeyKit] Failed to parse stored passkeys at "${this.storageKey}"; treating storage as empty.`, error);
+            return new Map();
+        }
+    }
+    write(passkeys) {
+        const obj = {};
+        for (const [key, value] of passkeys.entries()) {
+            obj[key] = serialize(value);
+        }
+        localStorage.setItem(this.storageKey, JSON.stringify(obj));
+    }
+    async save(passkey) {
+        const passkeys = this.read();
+        passkeys.set(passkey.keyId, passkey);
+        this.write(passkeys);
+    }
+    async get(keyId) {
+        return this.read().get(keyId) ?? null;
+    }
+    async getByContract(contractId) {
+        const results = [];
+        for (const passkey of this.read().values()) {
+            if (passkey.contractId === contractId) {
+                results.push(passkey);
+            }
+        }
+        return results;
+    }
+    async getAll() {
+        return Array.from(this.read().values());
+    }
+    async delete(keyId) {
+        const passkeys = this.read();
+        passkeys.delete(keyId);
+        this.write(passkeys);
+    }
+    async update(keyId, updates) {
+        const passkeys = this.read();
+        const passkey = passkeys.get(keyId);
+        if (passkey) {
+            passkeys.set(keyId, { ...passkey, ...updates });
+            this.write(passkeys);
+        }
+    }
+    async clear() {
+        localStorage.removeItem(this.storageKey);
+    }
+}
+//# sourceMappingURL=localStorage.js.map

package/dist/storage/localStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localStorage.js","sourceRoot":"","sources":["../../src/storage/localStorage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAU/D,SAAS,SAAS,CAAC,OAAsB;IACvC,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB;IAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,UAAU,CAAS;IAE3B,YAAY,aAAqB,4BAA4B;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEO,IAAI;QACV,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsC,CAAC;YACrE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,qEAAqE;YACrE,OAAO,CAAC,KAAK,CACX,oDAAoD,IAAI,CAAC,UAAU,+BAA+B,EAClG,KAAK,CACN,CAAC;YACF,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAoC;QAChD,MAAM,GAAG,GAAsC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,OAA4D;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/storage/memory.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory passkey storage adapter.
+ *
+ * Useful for tests and server-side environments. Data is lost when the process
+ * restarts.
+ */
+import type { StorageAdapter, StoredPasskey } from "../types.js";
+export declare class MemoryStorage implements StorageAdapter {
+    private passkeys;
+    save(passkey: StoredPasskey): Promise<void>;
+    get(keyId: string): Promise<StoredPasskey | null>;
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    getAll(): Promise<StoredPasskey[]>;
+    delete(keyId: string): Promise<void>;
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/storage/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,qBAAa,aAAc,YAAW,cAAc;IAClD,OAAO,CAAC,QAAQ,CAAyC;IAEnD,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAU3D,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC;IAOV,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/storage/memory.js

@@ -0,0 +1,41 @@
+/**
+ * In-memory passkey storage adapter.
+ *
+ * Useful for tests and server-side environments. Data is lost when the process
+ * restarts.
+ */
+export class MemoryStorage {
+    passkeys = new Map();
+    async save(passkey) {
+        this.passkeys.set(passkey.keyId, { ...passkey });
+    }
+    async get(keyId) {
+        const passkey = this.passkeys.get(keyId);
+        return passkey ? { ...passkey } : null;
+    }
+    async getByContract(contractId) {
+        const results = [];
+        for (const passkey of this.passkeys.values()) {
+            if (passkey.contractId === contractId) {
+                results.push({ ...passkey });
+            }
+        }
+        return results;
+    }
+    async getAll() {
+        return Array.from(this.passkeys.values()).map((p) => ({ ...p }));
+    }
+    async delete(keyId) {
+        this.passkeys.delete(keyId);
+    }
+    async update(keyId, updates) {
+        const passkey = this.passkeys.get(keyId);
+        if (passkey) {
+            this.passkeys.set(keyId, { ...passkey, ...updates });
+        }
+    }
+    async clear() {
+        this.passkeys.clear();
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/storage/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAO,aAAa;IAChB,QAAQ,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEzD,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,OAA4D;QAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Core type definitions for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from "@simplewebauthn/browser";
+import type { PasskeyKitError } from "./errors.js";
+/**
+ * The three signer kinds the smart wallet understands.
+ */
+export type SignerKeyTag = "Policy" | "Ed25519" | "Secp256r1";
+/**
+ * A convenience wrapper describing which signer a key/limits entry refers to.
+ *
+ * The `value` is the string form the caller works with: a `C…`/`G…` address for
+ * `Policy`, a `G…` public key for `Ed25519`, or a base64url credential id for
+ * `Secp256r1`. The signing pipeline converts these into the contract's
+ * `SignerKey` ScVals.
+ */
+export declare class SignerKey {
+    key: SignerKeyTag;
+    value: string;
+    private constructor();
+    static Policy(policy: string): SignerKey;
+    static Ed25519(publicKey: string): SignerKey;
+    static Secp256r1(keyId: string): SignerKey;
+}
+/**
+ * Per-signer limits: a map of contract address → the signer keys that signer may
+ * co-authorize on that contract (`undefined` value = unrestricted on that
+ * contract). `undefined` for the whole map = a fully unlimited signer.
+ */
+export type SignerLimits = Map<string, SignerKey[] | undefined> | undefined;
+/**
+ * Storage durability for a signer entry.
+ */
+export declare enum SignerStore {
+    Persistent = "Persistent",
+    Temporary = "Temporary"
+}
+/**
+ * A persisted passkey → smart-wallet association.
+ *
+ * The `keyId` (base64url credential id) is essential for re-authenticating the
+ * passkey later; the `contractId` lets the kit reconnect a wallet from a keyId
+ * without an indexer round-trip.
+ */
+export interface StoredPasskey {
+    /** Base64URL-encoded credential id (the passkey keyId) — the unique key. */
+    keyId: string;
+    /** 65-byte uncompressed secp256r1 public key (0x04 prefix + x + y). */
+    publicKey: Uint8Array;
+    /** Smart-wallet contract address this passkey controls. */
+    contractId: string;
+    /** User-friendly label for this passkey. */
+    nickname?: string;
+    /** Unix-ms timestamp when the passkey was created. */
+    createdAt: number;
+    /** Unix-ms timestamp when the passkey was last used. */
+    lastUsedAt?: number;
+}
+/**
+ * Interface for passkey storage adapters.
+ *
+ * Implementations persist the passkey → wallet association in various backends
+ * (IndexedDB, localStorage, memory). See `./storage`.
+ */
+export interface StorageAdapter {
+    /** Save a new passkey record or overwrite an existing one (keyed by keyId). */
+    save(passkey: StoredPasskey): Promise<void>;
+    /** Get a passkey record by its keyId. */
+    get(keyId: string): Promise<StoredPasskey | null>;
+    /** Get all passkey records associated with a contract. */
+    getByContract(contractId: string): Promise<StoredPasskey[]>;
+    /** Get every stored passkey record. */
+    getAll(): Promise<StoredPasskey[]>;
+    /** Delete a passkey record by its keyId. */
+    delete(keyId: string): Promise<void>;
+    /** Update mutable metadata on a stored passkey record. */
+    update(keyId: string, updates: Partial<Omit<StoredPasskey, "keyId" | "publicKey">>): Promise<void>;
+    /** Remove every stored passkey record. */
+    clear(): Promise<void>;
+}
+/** Result of creating (deploying) a new smart wallet. */
+export interface CreateWalletResult {
+    /** The raw WebAuthn registration response. */
+    rawResponse: RegistrationResponseJSON;
+    /** Raw credential id bytes. */
+    keyId: Uint8Array;
+    /** Base64URL-encoded credential id. */
+    keyIdBase64: string;
+    /** Deployed smart-wallet contract address. */
+    contractId: string;
+    /** Signed deployment transaction, ready to submit (base64 XDR). */
+    signedTx: string;
+}
+/** Result of connecting to an existing smart wallet. */
+export interface ConnectWalletResult {
+    /** Raw WebAuthn authentication response, when a ceremony was performed. */
+    rawResponse?: AuthenticationResponseJSON;
+    /** Raw credential id bytes. */
+    keyId: Uint8Array;
+    /** Base64URL-encoded credential id. */
+    keyIdBase64: string;
+    /** Connected smart-wallet contract address. */
+    contractId: string;
+}
+/** Successful result of a submission operation. */
+export interface TransactionSuccess {
+    success: true;
+    /** Transaction hash (may be empty for a `skipWait` submission not yet polled). */
+    hash: string;
+    /** Ledger the transaction was included in, when known. */
+    ledger?: number;
+    /** Relayer transaction id, for polling a `skipWait` submission. */
+    transactionId?: string;
+}
+/**
+ * Failed result of a submission operation.
+ *
+ * Submission methods never throw for expected on-chain/relayer failures; they
+ * return this shape with a typed {@link PasskeyKitError} (a `ContractError` when
+ * an on-chain contract code was decoded). All other SDK methods throw.
+ */
+export interface TransactionFailure {
+    success: false;
+    /** The typed error describing the failure. Branch on `error.code`. */
+    error: PasskeyKitError;
+    /** Transaction hash, when one was assigned before the failure. */
+    hash?: string;
+}
+/** Result of a submission operation: a discriminated union on `success`. */
+export type TransactionResult = TransactionSuccess | TransactionFailure;
+/** How a transaction is submitted to the network. */
+export type SubmissionMethod = "relayer" | "rpc";
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAMnD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE9D;;;;;;;GAOG;AACH,qBAAa,SAAS;IAEX,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,MAAM;IAFtB,OAAO;IAKP,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IAIxC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS;IAI5C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS;CAG3C;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AAE5E;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,SAAS,cAAc;CACxB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IAEd,uEAAuE;IACvE,SAAS,EAAE,UAAU,CAAC;IAEtB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IAEnB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAElB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,yCAAyC;IACzC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAElD,0DAA0D;IAC1D,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE5D,uCAAuC;IACvC,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEnC,4CAA4C;IAC5C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,0DAA0D;IAC1D,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,0CAA0C;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,wBAAwB,CAAC;IAEtC,+BAA+B;IAC/B,KAAK,EAAE,UAAU,CAAC;IAElB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IAEpB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IAEnB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,0BAA0B,CAAC;IAEzC,+BAA+B;IAC/B,KAAK,EAAE,UAAU,CAAC;IAElB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IAEpB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC;IACf,sEAAsE;IACtE,KAAK,EAAE,eAAe,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,KAAK,CAAC"}

package/dist/types.js

@@ -0,0 +1,39 @@
+/**
+ * Core type definitions for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+/**
+ * A convenience wrapper describing which signer a key/limits entry refers to.
+ *
+ * The `value` is the string form the caller works with: a `C…`/`G…` address for
+ * `Policy`, a `G…` public key for `Ed25519`, or a base64url credential id for
+ * `Secp256r1`. The signing pipeline converts these into the contract's
+ * `SignerKey` ScVals.
+ */
+export class SignerKey {
+    key;
+    value;
+    constructor(key, value) {
+        this.key = key;
+        this.value = value;
+    }
+    static Policy(policy) {
+        return new SignerKey("Policy", policy);
+    }
+    static Ed25519(publicKey) {
+        return new SignerKey("Ed25519", publicKey);
+    }
+    static Secp256r1(keyId) {
+        return new SignerKey("Secp256r1", keyId);
+    }
+}
+/**
+ * Storage durability for a signer entry.
+ */
+export var SignerStore;
+(function (SignerStore) {
+    SignerStore["Persistent"] = "Persistent";
+    SignerStore["Temporary"] = "Temporary";
+})(SignerStore || (SignerStore = {}));
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IAEX;IACA;IAFT,YACS,GAAiB,EACjB,KAAa;QADb,QAAG,GAAH,GAAG,CAAc;QACjB,UAAK,GAAL,KAAK,CAAQ;IACnB,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,MAAc;QAC1B,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,SAAiB;QAC9B,OAAO,IAAI,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAa;QAC5B,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF;AASD;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,sCAAuB,CAAA;AACzB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB"}

package/dist/utils.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Cryptographic and derivation helpers for the Passkey Kit SDK.
+ *
+ * @packageDocumentation
+ */
+import type { RegistrationResponseJSON } from "@simplewebauthn/browser";
+/**
+ * Derive a smart-wallet contract address from a passkey credential id.
+ *
+ * The wallet's contract id is deterministic: `salt = sha256(keyId)` and the
+ * deployer address salts a `ContractIdPreimageFromAddress`. This determinism is
+ * load-bearing — the indexer reverse-lookup (keyId → wallet) re-derives the
+ * address the same way — so this function is pinned with golden vectors in
+ * `utils.test.ts`. Any change to the derivation breaks the tests instead of
+ * silently shifting deployed addresses.
+ *
+ * @param keyId - The raw credential id bytes
+ * @param deployerPublicKey - The deployer's `G…` public key
+ * @param networkPassphrase - The network passphrase
+ * @returns The derived contract address (`C…`)
+ */
+export declare function deriveContractAddress(keyId: Buffer, deployerPublicKey: string, networkPassphrase: string): string;
+/**
+ * Whether an uncompressed `0x04 || x || y` key is a point on the P-256 curve
+ * (`y² ≡ x³ − 3x + b (mod p)`, coordinates in-field). A structurally valid but
+ * off-curve key would register fine and deploy a wallet no signature can ever
+ * satisfy, so extraction rejects it up front.
+ */
+export declare function isOnP256Curve(publicKey: Uint8Array): boolean;
+/**
+ * Extract the 65-byte uncompressed secp256r1 public key from a WebAuthn
+ * registration (attestation) response.
+ *
+ * Tries, in order:
+ * 1. `response.publicKey` when it is already a raw uncompressed EC point.
+ * 2. `response.publicKey` decoded from SPKI via WebCrypto (`crypto.subtle`),
+ *    which is the correct, non-magic-offset way to normalize the DER-encoded
+ *    SubjectPublicKeyInfo most authenticators return.
+ * 3. Parsing the COSE key out of `authenticatorData`, then
+ *    `attestationObject` — with the COSE structure verified in place, never
+ *    trusted fixed offsets.
+ *
+ * Whatever the source, the result must be a valid point ON the P-256 curve;
+ * a mangled key is rejected here rather than deployed as an unusable wallet
+ * signer.
+ *
+ * @throws {WebAuthnError} If no valid public key can be extracted.
+ */
+export declare function extractPublicKeyFromAttestation(response: RegistrationResponseJSON["response"]): Promise<Uint8Array>;
+/**
+ * Convert a DER-encoded ECDSA signature to Stellar's compact `r || s` form with
+ * a low-S value (S <= n/2), as required by the secp256r1 host function.
+ *
+ * The DER structure is validated before any offset is dereferenced:
+ * sequence/integer tags, short-form lengths that exactly span the buffer, and
+ * `r`/`s` values in `[1, n-1]`. A WebAuthn P-256 signature always fits
+ * short-form DER (total length < 128 bytes), so long-form lengths are rejected.
+ *
+ * @param derSignature - The DER-encoded signature
+ * @returns 64-byte compact signature (`r || s`)
+ * @throws {ValidationError} If the signature is not structurally valid DER or
+ *   `r`/`s` are out of range for P-256.
+ */
+export declare function compactSignature(derSignature: Buffer): Uint8Array;
+/**
+ * Generate a cryptographically-random base64url challenge for a WebAuthn
+ * ceremony.
+ *
+ * Replaces the old hard-coded `"stellaristhebetterblockchain"` challenge.
+ */
+export declare function generateChallenge(): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAoBxE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,MAAM,EACzB,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAcR;AAcD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAe5D;AAgDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,GAC7C,OAAO,CAAC,UAAU,CAAC,CAoDrB;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAmDjE;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAI1C"}