passkey-kit 0.12.1 → 0.14.0

package/dist/indexer/stellar-indexer.js

@@ -0,0 +1,279 @@
+/**
+ * Stellar Indexer backend (Creit Tech), over `POST /v1/contract-data/`.
+ *
+ * The wallet stores one top-level contract-data entry per signer
+ * (`key = SignerKey ScVal`, `val = SignerVal`), so signer enumeration is a
+ * contract-scoped query and reverse lookup is derive-then-confirm: derive the
+ * wallet address from the keyId, then confirm the signer entry exists there.
+ * Removed signers appear as tombstoned (`deleted_at`) entries.
+ *
+ * WIRE FORMAT (F2-confirmed, todo 959 c2502 / todo 967):
+ * - The live API returns each entry's `key`/`val` as **JSON ScVal**, e.g.
+ *   `{"vec":[{"symbol":"Secp256r1"},{"bytes":"<hex>"}]}` — NOT base64 XDR. We
+ *   convert JSON ScVal -> `xdr.ScVal` ({@link jsonScValToXdr}) and reuse the
+ *   contract-spec decoders (`scValToSignerKey`/`decodeSignerVal`). The JSON
+ *   convention is the standard Stellar one: `symbol`, `bytes` (hex), `address`
+ *   (strkey), `vec` (array), `map` (`[{key,val}]`), `u64`/`i64` (string),
+ *   `u32`/`i32` (number), `bool`, `string`, `void` (None).
+ * - Entry fields: `id, contract_id, durability, key, val,
+ *   last_modified_ledger_seq, tx_meta_version, timestamp, created_at,
+ *   updated_at, deleted_at`.
+ *
+ * NETWORK: **the Stellar Indexer indexes MAINNET only** — a testnet contract
+ * returns HTTP 200 with zero entries (F2). To keep "unsupported network" from
+ * masquerading as "wallet has no signers", the backend is network-aware: use
+ * {@link StellarIndexerBackend.forNetwork} (returns `null` off mainnet), and a
+ * config pinned to a non-mainnet passphrase throws at construction rather than
+ * silently returning `[]`. Live validation therefore needs a mainnet v1 wallet
+ * (endgame-gated); until then this is unit-tested against the documented shape.
+ *
+ * @packageDocumentation
+ */
+import { Address, Networks, nativeToScVal, xdr } from "@stellar/stellar-sdk";
+import { IndexerError, PasskeyKitErrorCode } from "../errors.js";
+import { DEFAULT_INDEXER_TIMEOUT_MS } from "../constants.js";
+import { deriveContractAddress } from "../utils.js";
+import { buildWalletSigner, decodeSignerVal, deriveStatus, scValToSignerKey, signerKeyToIndexerJson, } from "./codec.js";
+/** Max contract ids per contract-data request (API cap). */
+export const MAX_CONTRACTS_PER_QUERY = 25;
+/** The only network the Stellar Indexer indexes (mainnet). */
+export const STELLAR_INDEXER_NETWORK = Networks.PUBLIC;
+export class StellarIndexerBackend {
+    config;
+    constructor(config) {
+        this.config = config;
+        if (!config.url || !config.accessToken) {
+            throw new IndexerError("StellarIndexerBackend requires url and accessToken", PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED);
+        }
+        if (config.networkPassphrase &&
+            config.networkPassphrase !== STELLAR_INDEXER_NETWORK) {
+            throw new IndexerError(`Stellar Indexer indexes mainnet only; refusing a backend pinned to "${config.networkPassphrase}". ` +
+                `Use StellarIndexerBackend.forNetwork(...) to get null off mainnet.`, PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED);
+        }
+    }
+    /**
+     * Network-aware factory: the backend for mainnet, or `null` for any other
+     * network (the Stellar Indexer doesn't index testnet, so "discovery disabled"
+     * is the honest answer — callers treat `null` as no-indexer rather than an
+     * empty signer set).
+     */
+    static forNetwork(config, networkPassphrase) {
+        if (networkPassphrase !== STELLAR_INDEXER_NETWORK)
+            return null;
+        return new StellarIndexerBackend({ ...config, networkPassphrase });
+    }
+    nowSeconds() {
+        return this.config.now ? this.config.now() : Math.floor(Date.now() / 1000);
+    }
+    async query(body) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), DEFAULT_INDEXER_TIMEOUT_MS);
+        try {
+            const response = await fetch(`${this.config.url}/v1/contract-data/`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${this.config.accessToken}`,
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => "");
+                throw new IndexerError(`Stellar Indexer request failed (${response.status}): ${text.slice(0, 200)}`, PasskeyKitErrorCode.INDEXER_REQUEST_FAILED, { status: response.status });
+            }
+            const json = (await response.json());
+            return extractEntries(json);
+        }
+        catch (err) {
+            if (err instanceof IndexerError)
+                throw err;
+            const aborted = err instanceof Error && err.name === "AbortError";
+            throw new IndexerError(aborted ? "Stellar Indexer request timed out" : String(err), PasskeyKitErrorCode.INDEXER_REQUEST_FAILED, undefined, err instanceof Error ? err : undefined);
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    async getSigners(wallet) {
+        const entries = await this.query({ contracts: [wallet] });
+        return this.entriesToSigners(entries);
+    }
+    /**
+     * Group entries by signer key and resolve status. A key with any live entry
+     * is live/expired; a key whose every entry is tombstoned (no live counterpart
+     * in either durability) is `removed`.
+     */
+    entriesToSigners(entries) {
+        const groups = new Map();
+        for (const entry of entries) {
+            // Group on the raw JSON ScVal of the key (identical signer keys serialize
+            // identically); decode once per group below.
+            const groupKey = JSON.stringify(entry.key);
+            const list = groups.get(groupKey) ?? [];
+            list.push(entry);
+            groups.set(groupKey, list);
+        }
+        const signers = [];
+        for (const [, group] of groups) {
+            const live = group.find((e) => e.deleted_at == null);
+            const chosen = live ?? group[0];
+            const key = scValToSignerKey(jsonScValToXdr(chosen.key));
+            const decoded = decodeSignerVal(jsonScValToXdr(chosen.val));
+            const storage = chosen.durability;
+            const status = live
+                ? deriveStatus({
+                    expiration: decoded.expiration,
+                    nowSeconds: this.nowSeconds(),
+                })
+                : "removed";
+            signers.push(buildWalletSigner(key, decoded, storage, status));
+        }
+        return signers;
+    }
+    /**
+     * Reverse lookup via derive-then-confirm. Only Secp256r1 keyIds are
+     * derivable; Ed25519/Policy signers are not discoverable through this backend
+     * (use Mercury's event-driven index for those).
+     */
+    async findWallets(key) {
+        if (key.key !== "Secp256r1") {
+            return [];
+        }
+        if (!this.config.hardening) {
+            throw new IndexerError("findWallets requires hardening deps (networkPassphrase + deployerPublicKey) to derive candidates", PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED);
+        }
+        const candidate = deriveContractAddress(Buffer.from(key.value, "base64url"), this.config.hardening.deployerPublicKey, this.config.hardening.networkPassphrase);
+        const entries = await this.query({
+            contracts: [candidate],
+            key: signerKeyToIndexerJson(key),
+        });
+        // Confirmed only if the derived wallet holds a live entry for this key.
+        const live = entries.some((e) => e.deleted_at == null);
+        return live ? [candidate] : [];
+    }
+    async health() {
+        try {
+            await this.query({
+                contracts: ["CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF"],
+            });
+            return { ok: true, backend: "stellar-indexer" };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                backend: "stellar-indexer",
+                detail: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+}
+/**
+ * Pull the entries array out of a few known response shapes.
+ *
+ * A genuinely empty response (`null`/`undefined` or `{}`) yields `[]`, but an
+ * UNRECOGNIZED non-empty envelope throws rather than silently degrading to `[]`:
+ * conflating "shape changed" with "wallet has no signers" would burn the whole
+ * retry budget and then report a valid wallet as signer-less (audit LOW).
+ */
+function extractEntries(json) {
+    if (Array.isArray(json))
+        return json;
+    if (json == null)
+        return [];
+    if (typeof json === "object") {
+        const obj = json;
+        if (Array.isArray(obj.entries))
+            return obj.entries;
+        if (Array.isArray(obj.data))
+            return obj.data;
+        if (Object.keys(obj).length === 0)
+            return []; // genuinely-empty object
+    }
+    throw new IndexerError("Unrecognized Stellar Indexer response shape (expected an array or { entries | data: [...] })", PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+}
+/**
+ * Convert a Stellar JSON-ScVal object into an `xdr.ScVal`.
+ *
+ * The Stellar Indexer serializes ledger-entry `key`/`val` as JSON ScVal — a
+ * single-key object per value (`{"vec":[...]}`, `{"symbol":"…"}`, …). This is
+ * the inverse of that serialization for the variants a smart-wallet
+ * SignerKey/SignerVal can contain, letting the contract-spec decoders take over.
+ *
+ * Unknown variant keys THROW (never silently misdecode): an unexpected wire
+ * shape must surface as an error, not a wrong signer.
+ */
+export function jsonScValToXdr(json) {
+    // Some encoders represent `void`/None as a bare null.
+    if (json === null || json === undefined)
+        return xdr.ScVal.scvVoid();
+    if (typeof json !== "object") {
+        throw new IndexerError(`Unrecognized JSON ScVal (not an object): ${JSON.stringify(json)}`, PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+    }
+    const obj = json;
+    const keys = Object.keys(obj);
+    if (keys.length !== 1) {
+        throw new IndexerError(`Unrecognized JSON ScVal (expected exactly one type key): ${JSON.stringify(keys)}`, PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+    }
+    const tag = keys[0];
+    const v = obj[tag];
+    switch (tag) {
+        case "void":
+            return xdr.ScVal.scvVoid();
+        case "bool":
+            return xdr.ScVal.scvBool(Boolean(v));
+        case "u32":
+            return xdr.ScVal.scvU32(Number(v));
+        case "i32":
+            return xdr.ScVal.scvI32(Number(v));
+        case "u64":
+            return nativeToScVal(BigInt(v), { type: "u64" });
+        case "i64":
+            return nativeToScVal(BigInt(v), { type: "i64" });
+        case "timepoint":
+            return nativeToScVal(BigInt(v), { type: "timepoint" });
+        case "duration":
+            return nativeToScVal(BigInt(v), { type: "duration" });
+        case "u128":
+            return nativeToScVal(bigIntOfParts(v), { type: "u128" });
+        case "i128":
+            return nativeToScVal(bigIntOfParts(v), { type: "i128" });
+        case "u256":
+            return nativeToScVal(bigIntOfParts(v), { type: "u256" });
+        case "i256":
+            return nativeToScVal(bigIntOfParts(v), { type: "i256" });
+        case "bytes":
+            return xdr.ScVal.scvBytes(Buffer.from(String(v), "hex"));
+        case "string":
+            return xdr.ScVal.scvString(String(v));
+        case "symbol":
+            return xdr.ScVal.scvSymbol(String(v));
+        case "address":
+            return Address.fromString(String(v)).toScVal();
+        case "vec":
+            return xdr.ScVal.scvVec(v.map(jsonScValToXdr));
+        case "map":
+            return xdr.ScVal.scvMap(v.map((e) => new xdr.ScMapEntry({
+                key: jsonScValToXdr(e.key),
+                val: jsonScValToXdr(e.val),
+            })));
+        default:
+            throw new IndexerError(`Unsupported JSON ScVal type "${tag}"`, PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+    }
+}
+/**
+ * Coerce a large-integer JSON ScVal value to a bigint, accepting either a
+ * decimal string/number or a `{ hi, lo }` multi-part object (the exact 128/256
+ * wire shape is undocumented and unused by SignerVal — u64 covers expiration —
+ * so this stays tolerant).
+ */
+function bigIntOfParts(v) {
+    if (typeof v === "string" || typeof v === "number")
+        return BigInt(v);
+    if (v && typeof v === "object" && "hi" in v && "lo" in v) {
+        const { hi, lo } = v;
+        return (BigInt(hi) << 64n) | BigInt(lo);
+    }
+    throw new IndexerError(`Unrecognized large-integer JSON ScVal value: ${JSON.stringify(v)}`, PasskeyKitErrorCode.INDEXER_REQUEST_FAILED);
+}
+//# sourceMappingURL=stellar-indexer.js.map

package/dist/indexer/stellar-indexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stellar-indexer.js","sourceRoot":"","sources":["../../src/indexer/stellar-indexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAQpD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC;AAyCvD,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,MAA4B;QAA5B,WAAM,GAAN,MAAM,CAAsB;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,YAAY,CACpB,oDAAoD,EACpD,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;QACD,IACE,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,iBAAiB,KAAK,uBAAuB,EACpD,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,uEAAuE,MAAM,CAAC,iBAAiB,KAAK;gBAClG,oEAAoE,EACtE,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CACf,MAAuD,EACvD,iBAAyB;QAEzB,IAAI,iBAAiB,KAAK,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,IAAI,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACrE,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAGnB;QACC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,0BAA0B,CAC3B,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,oBAAoB,EAAE;gBACnE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;iBACnD;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,YAAY,CACpB,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAC5E,mBAAmB,CAAC,sBAAsB,EAC1C,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,MAAM,GAAG,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;YAClE,MAAM,IAAI,YAAY,CACpB,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAC3D,mBAAmB,CAAC,sBAAsB,EAC1C,SAAS,EACT,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,OAA8B;QAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC;YACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAuB,MAAM,CAAC,UAAU,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI;gBACjB,CAAC,CAAC,YAAY,CAAC;oBACX,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;iBAC9B,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,GAAc;QAC9B,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,YAAY,CACpB,kGAAkG,EAClG,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,EACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CACxC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAC/B,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,GAAG,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QAEH,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC;gBACf,SAAS,EAAE,CAAC,0DAA0D,CAAC;aACxE,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,iBAAiB;gBAC1B,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAA6B,CAAC;IAC9D,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAA6C,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,CAAC,OAAgC,CAAC;QAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,IAA6B,CAAC;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,yBAAyB;IACzE,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,8FAA8F,EAC9F,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,sDAAsD;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,4CAA4C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAClE,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,4DAA4D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAClF,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAEnB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,KAAK,KAAK;YACR,OAAO,aAAa,CAAC,MAAM,CAAC,CAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,KAAK;YACR,OAAO,aAAa,CAAC,MAAM,CAAC,CAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,WAAW;YACd,OAAO,aAAa,CAAC,MAAM,CAAC,CAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,MAAM,CAAC,CAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,KAAK,MAAM;YACT,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACjD,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChE,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CACpB,CAA2C,CAAC,GAAG,CAC9C,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,GAAG,CAAC,UAAU,CAAC;gBACjB,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1B,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;aAC3B,CAAC,CACL,CACF,CAAC;QACJ;YACE,MAAM,IAAI,YAAY,CACpB,gCAAgC,GAAG,GAAG,EACtC,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAiD,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,gDAAgD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EACnE,mBAAmB,CAAC,sBAAsB,CAC3C,CAAC;AACJ,CAAC"}

package/dist/indexer/types.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Indexer abstraction: one {@link SignerIndexer} interface, resolved by the
+ * keyless {@link MercuryIndexer} backend into the {@link WalletSigner} shape so a
+ * signer added through the demo is discoverable and asserted in the browser e2e.
+ *
+ * @packageDocumentation
+ */
+import type { SignerKey, SignerLimits } from "../types.js";
+/** Storage durability of a signer's ledger entry. */
+export type SignerStorageClass = "persistent" | "temporary";
+/**
+ * Lifecycle status of a signer, derived from the entry + expiration:
+ * - `live` — present and not expired.
+ * - `expired` — present but past its expiration timestamp.
+ * - `evicted` — a temporary entry whose ledger state was evicted (TTL).
+ * - `removed` — tombstoned (remove_signer), no live counterpart in either
+ *   durability.
+ */
+export type SignerStatus = "live" | "expired" | "evicted" | "removed";
+/** A signer as resolved by an indexer backend. */
+export interface WalletSigner {
+    /** The signer's key (kind + value). */
+    key: SignerKey;
+    /** 65-byte secp256r1 public key, for Secp256r1 signers. */
+    publicKey?: Uint8Array;
+    /**
+     * Expiration as a UNIX timestamp in seconds (inclusive), if set. The reworked
+     * contract stores expiration as a timestamp, not a ledger sequence (#602).
+     */
+    expiration?: number;
+    /** Per-contract limits (`undefined` = unlimited). */
+    limits?: SignerLimits;
+    /** Storage durability of the entry. */
+    storage: SignerStorageClass;
+    /** Derived lifecycle status. */
+    status: SignerStatus;
+}
+/** Health of an indexer backend. */
+export interface IndexerHealth {
+    /** Whether the backend answered a health probe. */
+    ok: boolean;
+    /** Backend identifier (e.g. "mercury"). */
+    backend: string;
+    /** Optional human-readable detail. */
+    detail?: string;
+}
+/**
+ * A pluggable signer indexer.
+ *
+ * Null-tolerant seam (per SAK): a backend that is *not configured* is
+ * represented as `null` at the call site (see `forNetwork`); a backend that is
+ * configured but *fails* throws; a health/404 degrades to `{ ok: false }`
+ * rather than throwing.
+ */
+export interface SignerIndexer {
+    /** Enumerate all signers currently indexed for a wallet. */
+    getSigners(wallet: string): Promise<WalletSigner[]>;
+    /** Reverse lookup: the wallet contract ids a signer key belongs to. */
+    findWallets(key: SignerKey): Promise<string[]>;
+    /** Probe backend health (degrades to `{ ok: false }` rather than throwing). */
+    health(): Promise<IndexerHealth>;
+}
+/**
+ * Deps for the SDK-side `findWallets` hardening (#598 F3): before trusting a
+ * reverse-lookup result, the candidate wallet is confirmed by re-deriving its
+ * address from the keyId (deterministic derivation) — no unverified `res[0]`.
+ */
+export interface FindWalletsHardeningDeps {
+    networkPassphrase: string;
+    /** The canonical deployer `G…` public key used for derivation. */
+    deployerPublicKey: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/indexer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/indexer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3D,qDAAqD;AACrD,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,GAAG,EAAE,SAAS,CAAC;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,uCAAuC;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gCAAgC;IAChC,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;IACZ,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,uEAAuE;IACvE,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;CAC3B"}

package/dist/indexer/types.js

@@ -0,0 +1,9 @@
+/**
+ * Indexer abstraction: one {@link SignerIndexer} interface, resolved by the
+ * keyless {@link MercuryIndexer} backend into the {@link WalletSigner} shape so a
+ * signer added through the demo is discoverable and asserted in the browser e2e.
+ *
+ * @packageDocumentation
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/indexer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/indexer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/kit/auth-payload.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Soroban authorization-entry payload helpers + the flat `Signatures` map codec.
+ *
+ * These are thin wrappers over the stellar-sdk's native Protocol-27 auth
+ * primitives (`buildAuthorizationEntryPreimage`). The old kit hand-rolled a
+ * stack of "does this SDK support P27?" probe shims; on stellar-sdk >= 16 those
+ * are all dead, so this module simply uses the SDK.
+ *
+ * The smart wallet's `__check_auth` reads a `Signatures` value — a single
+ * `Map<SignerKey, Signature>` — from the address credentials. Each signer
+ * contributes one entry keyed by its on-chain `SignerKey`. The host rejects an
+ * `ScMap` whose keys are not in the host's canonical sort order, so the map is
+ * sorted with {@link compareScVal} (NOT a byte/`localeCompare` sort — see below).
+ *
+ * @packageDocumentation
+ */
+import { xdr } from "@stellar/stellar-sdk";
+import type { Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import type { Signature as SDKSignature, SignerKey as SDKSignerKey } from "passkey-kit-sdk";
+/**
+ * Extract the {@link xdr.SorobanAddressCredentials} from a credentials union,
+ * for the address / addressV2 / addressWithDelegates variants.
+ *
+ * @throws {SigningError} If the credentials are not address-based.
+ */
+export declare function getAddressCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanAddressCredentials;
+/**
+ * Whether a credentials union uses an address-bound signature payload (the P27
+ * V2 / with-delegates variants), whose preimage binds the invoker address.
+ */
+export declare function usesAddressBoundPayload(credentials: xdr.SorobanCredentials): boolean;
+/**
+ * Coerce a credentials union to an address-bound variant (CAP-0071-02).
+ *
+ * Legacy V1 `sorobanCredentialsAddress` credentials are upgraded to
+ * `sorobanCredentialsAddressV2` IN PLACE of the signed payload's semantics: the
+ * V2 preimage (`HashIdPreimageSorobanAuthorizationWithAddress`) binds the
+ * authorizing address into the hash the signer signs, so the same signer key on
+ * two different wallets can never produce interchangeable signatures. V1's
+ * preimage has no address field — signing it verbatim would produce a payload
+ * that is identical across wallets for a signer key installed on more than
+ * one wallet.
+ *
+ * Already-address-bound variants (V2, with-delegates) pass through unchanged.
+ *
+ * @throws {SigningError} If the credentials are not address-based.
+ */
+export declare function toAddressBoundCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanCredentials;
+/**
+ * Assert that a signature-expiration ledger is a valid `u32`.
+ *
+ * @throws {SigningError} If not a `u32` integer.
+ */
+export declare function assertSignatureExpirationLedger(expiration: number): void;
+/**
+ * Build the signature payload (the 32-byte hash a signer signs) for an
+ * authorization entry at a given expiration ledger.
+ *
+ * Sets the expiration on the entry's address credentials, then hashes the SDK's
+ * canonical authorization-entry preimage. Works for the address, addressV2, and
+ * addressWithDelegates credential variants.
+ *
+ * @throws {SigningError} If `expiration` is not a valid `u32`.
+ */
+export declare function buildSignaturePayload(networkPassphrase: string, entry: xdr.SorobanAuthorizationEntry, expiration: number): Buffer;
+/**
+ * Compare two ScVals in the order the Soroban host uses when it validates that
+ * an ScMap is sorted by key (host `metered_map::from_map`, which rejects an
+ * unsorted map with `InvalidInput`).
+ *
+ * This is deliberately NOT a comparison of the XDR byte encodings. XDR prefixes
+ * every variable-length payload (Bytes, Symbol, String, Vec) with a 4-byte
+ * length, so `toXDR("hex")` sorting is length-major; the host instead compares
+ * those payloads element-wise by content (Rust slice `Ord`), where a shorter
+ * value that is a prefix of a longer one sorts first. The old kit's
+ * `localeCompare` on a symbol+hex string approximated this and could diverge
+ * from the host, producing a map the wallet rejects at `__check_auth`.
+ *
+ * Only the shapes that appear as `SignerKey` map keys are handled precisely
+ * (Vec, Symbol, String, Bytes, Address). All other shapes are same-type here
+ * (the discriminant is compared first), so their fixed-width XDR encodings sort
+ * order-equivalently to the host.
+ */
+export declare function compareScVal(a: xdr.ScVal, b: xdr.ScVal): number;
+/** The `SignerVal` UDT type def, for decoding a stored signer entry's value. */
+export declare const SIGNER_VAL_UDT: xdr.ScSpecTypeDef;
+/** Encode a native `SignerKey` union into its contract ScVal via the spec. */
+export declare function signerKeyToScVal(spec: ContractSpec, key: SDKSignerKey): xdr.ScVal;
+/**
+ * Encode a native `Signature` union into its contract ScVal via the spec, or
+ * `scvVoid` when there is no signature value (policy signers).
+ */
+export declare function signatureToScVal(spec: ContractSpec, val: SDKSignature | undefined): xdr.ScVal;
+/**
+ * Upsert a `(SignerKey, Signature)` pair into the entry's `Signatures` value,
+ * which is encoded as `scvVec([ scvMap([...]) ])`.
+ *
+ * A signer key already present in the map is replaced (co-signing is idempotent
+ * per signer). The map is re-sorted by key in host order after every insert, so
+ * the wallet's `__check_auth` accepts it.
+ *
+ * @throws {SigningError} If the existing signature is neither void nor a
+ *   Signatures vec.
+ */
+export declare function upsertSignatureEntry(credentials: xdr.SorobanAddressCredentials, scKey: xdr.ScVal, scVal: xdr.ScVal): void;
+//# sourceMappingURL=auth-payload.d.ts.map

package/dist/kit/auth-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-payload.d.ts","sourceRoot":"","sources":["../../src/kit/auth-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,GAAG,EACJ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,IAAI,YAAY,EACzB,SAAS,IAAI,YAAY,EAC1B,MAAM,iBAAiB,CAAC;AAOzB;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,GAAG,CAAC,kBAAkB,GAClC,GAAG,CAAC,yBAAyB,CAc/B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,GAAG,CAAC,kBAAkB,GAClC,OAAO,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,GAAG,CAAC,kBAAkB,GAClC,GAAG,CAAC,kBAAkB,CASxB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAYxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,GAAG,CAAC,yBAAyB,EACpC,UAAU,EAAE,MAAM,GACjB,MAAM,CAaR;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAmD/D;AAaD,gFAAgF;AAChF,eAAO,MAAM,cAAc,mBAE1B,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,YAAY,GAChB,GAAG,CAAC,KAAK,CAEX;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,YAAY,GAAG,SAAS,GAC5B,GAAG,CAAC,KAAK,CAEX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,GAAG,CAAC,yBAAyB,EAC1C,KAAK,EAAE,GAAG,CAAC,KAAK,EAChB,KAAK,EAAE,GAAG,CAAC,KAAK,GACf,IAAI,CAmCN"}