passkey-kit 0.13.1 → 0.15.0

package/dist/utils.js

@@ -3,10 +3,26 @@
  *
  * @packageDocumentation
  */
-import { StrKey, hash, xdr, Address } from "@stellar/stellar-sdk";
+import { StrKey, hash, xdr, Address, Keypair } from "@stellar/stellar-sdk";
 import base64url from "./base64url.js";
-import { SECP256R1_PUBLIC_KEY_SIZE, SECP256R1_CURVE_ORDER, UNCOMPRESSED_PUBKEY_PREFIX, WEBAUTHN_CHALLENGE_SIZE, } from "./constants.js";
-import { WebAuthnError, PasskeyKitErrorCode } from "./errors.js";
+import { SECP256R1_PUBLIC_KEY_SIZE, SECP256R1_CURVE_ORDER, SECP256R1_FIELD_PRIME, SECP256R1_B, UNCOMPRESSED_PUBKEY_PREFIX, WEBAUTHN_CHALLENGE_SIZE, DEFAULT_DEPLOYER_SEED, } from "./constants.js";
+/**
+ * Public key of the shared, deterministic default deployer, derived once from
+ * {@link DEFAULT_DEPLOYER_SEED}.
+ */
+export const DEFAULT_DEPLOYER_PUBLIC_KEY = Keypair.fromRawEd25519Seed(hash(Buffer.from(DEFAULT_DEPLOYER_SEED))).publicKey();
+/**
+ * True when `publicKey` is the shared, publicly-derivable default deployer.
+ *
+ * That account is a **sign-only / address-derivation** identity: the SDK must
+ * never use it as a transaction source (its sequence can be bricked by anyone
+ * via `bumpSequence`) or fee payer (its balance is sweepable by anyone). It may
+ * only sign Soroban auth entries and salt the deploy.
+ */
+export function isDefaultDeployer(publicKey) {
+    return publicKey === DEFAULT_DEPLOYER_PUBLIC_KEY;
+}
+import { ValidationError, WebAuthnError, PasskeyKitErrorCode, } from "./errors.js";
 // ============================================================================
 // Deterministic contract-address derivation
 // ============================================================================
@@ -38,6 +54,79 @@ export function deriveContractAddress(keyId, deployerPublicKey, networkPassphras
 // ============================================================================
 // WebAuthn public-key extraction
 // ============================================================================
+/** COSE map prefix for an ES256 (P-256) key: `{1:2, 3:-26, -1:1, -2: bytes(32)…}`. */
+const ES256_COSE_PREFIX = Buffer.from([
+    0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20,
+]);
+/** COSE label for the `y` coordinate that must follow `x`: `-3: bytes(32)`. */
+const COSE_Y_LABEL = Buffer.from([0x22, 0x58, 0x20]);
+/**
+ * Whether an uncompressed `0x04 || x || y` key is a point on the P-256 curve
+ * (`y² ≡ x³ − 3x + b (mod p)`, coordinates in-field). A structurally valid but
+ * off-curve key would register fine and deploy a wallet no signature can ever
+ * satisfy, so extraction rejects it up front.
+ */
+export function isOnP256Curve(publicKey) {
+    const key = Buffer.from(publicKey);
+    if (key.length !== SECP256R1_PUBLIC_KEY_SIZE ||
+        key[0] !== UNCOMPRESSED_PUBKEY_PREFIX) {
+        return false;
+    }
+    const p = SECP256R1_FIELD_PRIME;
+    const x = BigInt("0x" + key.subarray(1, 33).toString("hex"));
+    const y = BigInt("0x" + key.subarray(33, 65).toString("hex"));
+    if (x >= p || y >= p)
+        return false;
+    const x3 = (((x * x) % p) * x) % p;
+    const rhs = (((x3 - ((3n * x) % p) + SECP256R1_B) % p) + p) % p;
+    return (y * y) % p === rhs;
+}
+/**
+ * Read `x || y` out of a COSE key at `xStart`, verifying the `y` label bytes
+ * and buffer bounds instead of trusting fixed offsets. Returns the
+ * uncompressed `0x04 || x || y` point, or `undefined` when the shape doesn't
+ * match.
+ */
+function coseCoordinates(buf, xStart) {
+    const yLabelStart = xStart + 32;
+    const yStart = yLabelStart + COSE_Y_LABEL.length;
+    if (buf.length < yStart + 32)
+        return undefined;
+    if (!buf.subarray(yLabelStart, yStart).equals(COSE_Y_LABEL))
+        return undefined;
+    return Buffer.concat([
+        Buffer.from([UNCOMPRESSED_PUBKEY_PREFIX]),
+        buf.subarray(xStart, xStart + 32),
+        buf.subarray(yStart, yStart + 32),
+    ]);
+}
+/**
+ * Parse the attested COSE key out of raw `authenticatorData`:
+ * `rpIdHash(32) | flags(1) | counter(4) | aaguid(16) | credIdLen(2) | credId | COSE`.
+ * Every offset is bounds-checked and the ES256 COSE prefix is verified in
+ * place before any coordinate is sliced.
+ */
+function coseKeyFromAuthenticatorData(ad) {
+    if (ad.length < 55)
+        return undefined;
+    const credentialIdLength = (ad[53] << 8) | ad[54];
+    const coseStart = 55 + credentialIdLength;
+    if (ad.length < coseStart + ES256_COSE_PREFIX.length)
+        return undefined;
+    if (!ad
+        .subarray(coseStart, coseStart + ES256_COSE_PREFIX.length)
+        .equals(ES256_COSE_PREFIX)) {
+        return undefined;
+    }
+    return coseCoordinates(ad, coseStart + ES256_COSE_PREFIX.length);
+}
+/** Locate the ES256 COSE key inside a CBOR attestation object and extract it. */
+function coseKeyFromAttestationObject(ao) {
+    const prefixIndex = ao.indexOf(ES256_COSE_PREFIX);
+    if (prefixIndex === -1)
+        return undefined;
+    return coseCoordinates(ao, prefixIndex + ES256_COSE_PREFIX.length);
+}
 /**
  * Extract the 65-byte uncompressed secp256r1 public key from a WebAuthn
  * registration (attestation) response.
@@ -47,9 +136,15 @@ export function deriveContractAddress(keyId, deployerPublicKey, networkPassphras
  * 2. `response.publicKey` decoded from SPKI via WebCrypto (`crypto.subtle`),
  *    which is the correct, non-magic-offset way to normalize the DER-encoded
  *    SubjectPublicKeyInfo most authenticators return.
- * 3. Parsing the COSE key out of `authenticatorData` / `attestationObject`.
+ * 3. Parsing the COSE key out of `authenticatorData`, then
+ *    `attestationObject` — with the COSE structure verified in place, never
+ *    trusted fixed offsets.
+ *
+ * Whatever the source, the result must be a valid point ON the P-256 curve;
+ * a mangled key is rejected here rather than deployed as an unusable wallet
+ * signer.
  *
- * @throws {WebAuthnError} If the public key cannot be extracted.
+ * @throws {WebAuthnError} If no valid public key can be extracted.
  */
 export async function extractPublicKeyFromAttestation(response) {
     let publicKey;
@@ -66,67 +161,88 @@ export async function extractPublicKeyFromAttestation(response) {
                 publicKey = Buffer.from(new Uint8Array(rawKey));
             }
             catch {
-                publicKey = encodedPublicKey.subarray(encodedPublicKey.length - SECP256R1_PUBLIC_KEY_SIZE);
+                publicKey = undefined; // not SPKI — fall through to the COSE paths
             }
         }
-        else {
-            publicKey = encodedPublicKey.subarray(encodedPublicKey.length - SECP256R1_PUBLIC_KEY_SIZE);
-        }
     }
-    // Validate it is a proper uncompressed EC point; otherwise fall back to the
-    // COSE key embedded in authenticatorData / attestationObject.
-    if (!publicKey ||
-        publicKey[0] !== UNCOMPRESSED_PUBKEY_PREFIX ||
-        publicKey.length !== SECP256R1_PUBLIC_KEY_SIZE) {
-        let x;
-        let y;
-        if (response.authenticatorData) {
-            const authenticatorData = base64url.toBuffer(response.authenticatorData);
-            const credentialIdLength = (authenticatorData[53] << 8) | authenticatorData[54];
-            x = authenticatorData.subarray(65 + credentialIdLength, 97 + credentialIdLength);
-            y = authenticatorData.subarray(100 + credentialIdLength, 132 + credentialIdLength);
-        }
-        else if (response.attestationObject) {
-            const attestationObject = base64url.toBuffer(response.attestationObject);
-            // COSE key structure prefix for an ES256 (P-256) key.
-            const publicKeyPrefixSlice = Buffer.from([
-                0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20,
-            ]);
-            let startIndex = attestationObject.indexOf(publicKeyPrefixSlice);
-            if (startIndex === -1) {
-                throw new WebAuthnError("Could not locate the COSE public key in the attestation object", PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED);
-            }
-            startIndex = startIndex + publicKeyPrefixSlice.length;
-            x = attestationObject.subarray(startIndex, 32 + startIndex);
-            y = attestationObject.subarray(35 + startIndex, 67 + startIndex);
-        }
-        else {
-            throw new WebAuthnError("Could not extract a public key from the attestation response", PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED);
-        }
-        publicKey = Buffer.from([UNCOMPRESSED_PUBKEY_PREFIX, ...x, ...y]);
+    // Fall back to the attested COSE key when `response.publicKey` is absent or
+    // didn't yield a valid on-curve point.
+    if (!publicKey || !isOnP256Curve(publicKey)) {
+        publicKey =
+            (response.authenticatorData
+                ? coseKeyFromAuthenticatorData(base64url.toBuffer(response.authenticatorData))
+                : undefined) ??
+                (response.attestationObject
+                    ? coseKeyFromAttestationObject(base64url.toBuffer(response.attestationObject))
+                    : undefined);
+    }
+    if (!publicKey || !isOnP256Curve(publicKey)) {
+        throw new WebAuthnError("Could not extract a valid secp256r1 public key from the attestation response", PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED);
     }
     return new Uint8Array(publicKey);
 }
 // ============================================================================
 // Signature encoding
 // ============================================================================
+function malformedDer(reason) {
+    return new ValidationError(`Malformed DER ECDSA signature: ${reason}`, PasskeyKitErrorCode.INVALID_INPUT);
+}
 /**
  * Convert a DER-encoded ECDSA signature to Stellar's compact `r || s` form with
  * a low-S value (S <= n/2), as required by the secp256r1 host function.
  *
+ * The DER structure is validated before any offset is dereferenced:
+ * sequence/integer tags, short-form lengths that exactly span the buffer, and
+ * `r`/`s` values in `[1, n-1]`. A WebAuthn P-256 signature always fits
+ * short-form DER (total length < 128 bytes), so long-form lengths are rejected.
+ *
  * @param derSignature - The DER-encoded signature
  * @returns 64-byte compact signature (`r || s`)
+ * @throws {ValidationError} If the signature is not structurally valid DER or
+ *   `r`/`s` are out of range for P-256.
  */
 export function compactSignature(derSignature) {
     // DER: 0x30 [total-len] 0x02 [r-len] [r] 0x02 [s-len] [s]
-    let offset = 2; // skip 0x30 and the total length
-    const rLength = derSignature[offset + 1];
-    const r = derSignature.subarray(offset + 2, offset + 2 + rLength);
-    offset += 2 + rLength;
-    const sLength = derSignature[offset + 1];
-    const s = derSignature.subarray(offset + 2, offset + 2 + sLength);
+    if (derSignature.length < 8)
+        throw malformedDer("too short");
+    if (derSignature[0] !== 0x30)
+        throw malformedDer("missing SEQUENCE tag");
+    const totalLength = derSignature[1];
+    if (totalLength >= 0x80)
+        throw malformedDer("long-form length not supported");
+    if (totalLength !== derSignature.length - 2) {
+        throw malformedDer("SEQUENCE length does not span the buffer");
+    }
+    if (derSignature[2] !== 0x02)
+        throw malformedDer("missing INTEGER tag for r");
+    const rLength = derSignature[3];
+    // A P-256 integer is at most 32 bytes plus one 0x00 sign pad.
+    if (rLength < 1 || rLength > 33)
+        throw malformedDer("r length out of range");
+    if (4 + rLength + 2 > derSignature.length) {
+        throw malformedDer("r overruns the buffer");
+    }
+    const r = derSignature.subarray(4, 4 + rLength);
+    const sTagOffset = 4 + rLength;
+    if (derSignature[sTagOffset] !== 0x02) {
+        throw malformedDer("missing INTEGER tag for s");
+    }
+    const sLength = derSignature[sTagOffset + 1];
+    if (sLength < 1 || sLength > 33)
+        throw malformedDer("s length out of range");
+    if (sTagOffset + 2 + sLength !== derSignature.length) {
+        throw malformedDer("s does not end exactly at the buffer end");
+    }
+    const s = derSignature.subarray(sTagOffset + 2, sTagOffset + 2 + sLength);
     const rBigInt = BigInt("0x" + r.toString("hex"));
     let sBigInt = BigInt("0x" + s.toString("hex"));
+    // Scalars must be in [1, n-1] — anything else can never verify on-chain.
+    if (rBigInt < 1n || rBigInt >= SECP256R1_CURVE_ORDER) {
+        throw malformedDer("r out of curve order range");
+    }
+    if (sBigInt < 1n || sBigInt >= SECP256R1_CURVE_ORDER) {
+        throw malformedDer("s out of curve order range");
+    }
     // Enforce low-S.
     const halfN = SECP256R1_CURVE_ORDER / 2n;
     if (sBigInt > halfN) {

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjE,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,iBAAyB,EACzB,iBAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,sBAAsB,CACxD,IAAI,GAAG,CAAC,wBAAwB,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CACtE,IAAI,GAAG,CAAC,6BAA6B,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SAClB,CAAC,CACH;KACF,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAA8C;IAE9C,IAAI,SAA6B,CAAC;IAElC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEhE,IACE,gBAAgB,CAAC,MAAM,KAAK,yBAAyB;YACrD,gBAAgB,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAClD,CAAC;YACD,SAAS,GAAG,gBAAgB,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,MAAM,EACN,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAChC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,EAAE,CACH,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CACnC,gBAAgB,CAAC,MAAM,GAAG,yBAAyB,CACpD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CACnC,gBAAgB,CAAC,MAAM,GAAG,yBAAyB,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IACE,CAAC,SAAS;QACV,SAAS,CAAC,CAAC,CAAC,KAAK,0BAA0B;QAC3C,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAC9C,CAAC;QACD,IAAI,CAAS,CAAC;QACd,IAAI,CAAS,CAAC;QAEd,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YACzE,MAAM,kBAAkB,GACtB,CAAC,iBAAiB,CAAC,EAAE,CAAE,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAE,CAAC;YAEzD,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAC5B,EAAE,GAAG,kBAAkB,EACvB,EAAE,GAAG,kBAAkB,CACxB,CAAC;YACF,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAC5B,GAAG,GAAG,kBAAkB,EACxB,GAAG,GAAG,kBAAkB,CACzB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAEzE,sDAAsD;YACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC;gBACvC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;aAC3D,CAAC,CAAC;YACH,IAAI,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjE,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,aAAa,CACrB,gEAAgE,EAChE,mBAAmB,CAAC,4BAA4B,CACjD,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC;YAEtD,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;YAC5D,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,aAAa,CACrB,8DAA8D,EAC9D,mBAAmB,CAAC,4BAA4B,CACjD,CAAC;QACJ,CAAC;QAED,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,0DAA0D;IAC1D,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,iCAAiC;IAEjD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/C,iBAAiB;IACjB,MAAM,KAAK,GAAG,qBAAqB,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACpB,OAAO,GAAG,qBAAqB,GAAG,OAAO,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAEzE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACtD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,EACX,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CACzC,CAAC,SAAS,EAAE,CAAC;AAEd;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,SAAS,KAAK,2BAA2B,CAAC;AACnD,CAAC;AACD,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,iBAAyB,EACzB,iBAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,sBAAsB,CACxD,IAAI,GAAG,CAAC,wBAAwB,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CACtE,IAAI,GAAG,CAAC,6BAA6B,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;SAClB,CAAC,CACH;KACF,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC;IACpC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC3D,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAqB;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IACE,GAAG,CAAC,MAAM,KAAK,yBAAyB;QACxC,GAAG,CAAC,CAAC,CAAC,KAAK,0BAA0B,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,qBAAqB,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,MAAc;IAClD,MAAM,WAAW,GAAG,MAAM,GAAG,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,EAAU;IAC9C,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,kBAAkB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAE,CAAC;IACpD,MAAM,SAAS,GAAG,EAAE,GAAG,kBAAkB,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACvE,IACE,CAAC,EAAE;SACA,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC;SACzD,MAAM,CAAC,iBAAiB,CAAC,EAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,SAAS,4BAA4B,CAAC,EAAU;IAC9C,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAA8C;IAE9C,IAAI,SAA6B,CAAC;IAElC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEhE,IACE,gBAAgB,CAAC,MAAM,KAAK,yBAAyB;YACrD,gBAAgB,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAClD,CAAC;YACD,SAAS,GAAG,gBAAgB,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,MAAM,EACN,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAChC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,EAAE,CACH,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,SAAS,CAAC,CAAC,4CAA4C;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uCAAuC;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,SAAS;YACP,CAAC,QAAQ,CAAC,iBAAiB;gBACzB,CAAC,CAAC,4BAA4B,CAC1B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAC/C;gBACH,CAAC,CAAC,SAAS,CAAC;gBACd,CAAC,QAAQ,CAAC,iBAAiB;oBACzB,CAAC,CAAC,4BAA4B,CAC1B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAC/C;oBACH,CAAC,CAAC,SAAS,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CACrB,8EAA8E,EAC9E,mBAAmB,CAAC,4BAA4B,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,eAAe,CACxB,kCAAkC,MAAM,EAAE,EAC1C,mBAAmB,CAAC,aAAa,CAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,0DAA0D;IAC1D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,YAAY,CAAC,sBAAsB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;IACrC,IAAI,WAAW,IAAI,IAAI;QAAE,MAAM,YAAY,CAAC,gCAAgC,CAAC,CAAC;IAC9E,IAAI,WAAW,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;IACjC,8DAA8D;IAC9D,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;QAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC;IAC/B,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,GAAG,CAAC,CAAE,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;QAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,UAAU,GAAG,CAAC,GAAG,OAAO,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/C,yEAAyE;IACzE,IAAI,OAAO,GAAG,EAAE,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrD,MAAM,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrD,MAAM,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACnD,CAAC;IAED,iBAAiB;IACjB,MAAM,KAAK,GAAG,qBAAqB,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACpB,OAAO,GAAG,qBAAqB,GAAG,OAAO,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAEzE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACtD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/validation.d.ts

@@ -23,10 +23,12 @@ export declare function validateAmount(amount: number, fieldName?: string): void
 /**
  * Validate a signer expiration.
  *
- * Must be a non-negative integer within `u32` bounds when provided; `undefined`
- * means "no expiration". (Unix-second timestamps fit in `u32` through the year
- * 2106, so this bound holds whether the contract interprets the value as a
- * ledger sequence or a UNIX timestamp.)
+ * The contract types signer expiration as `Option<u64>` UNIX seconds, so the
+ * accepted range here is the `u64`-compatible safe-integer range: a
+ * non-negative integer up to `Number.MAX_SAFE_INTEGER` (the kit carries the
+ * value as a JS number before converting to `BigInt`). `undefined` means "no
+ * expiration". Capping at `u32` (the old bound) would reject post-2106
+ * timestamps the contract accepts.
  *
  * @throws {ValidationError} If the expiration is out of range.
  */

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,SAAY,GACpB,IAAI,CAmBN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAW,GAAG,IAAI,CAezE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,SAAe,GACvB,IAAI,CAaN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,UAAU,EACrB,SAAS,SAAc,GACtB,IAAI,CAeN"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,SAAY,GACpB,IAAI,CAmBN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAW,GAAG,IAAI,CAezE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,SAAS,SAAe,GACvB,IAAI,CAaN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,UAAU,EACrB,SAAS,SAAc,GACtB,IAAI,CAeN"}

package/dist/validation.js

@@ -41,10 +41,12 @@ export function validateAmount(amount, fieldName = "amount") {
 /**
  * Validate a signer expiration.
  *
- * Must be a non-negative integer within `u32` bounds when provided; `undefined`
- * means "no expiration". (Unix-second timestamps fit in `u32` through the year
- * 2106, so this bound holds whether the contract interprets the value as a
- * ledger sequence or a UNIX timestamp.)
+ * The contract types signer expiration as `Option<u64>` UNIX seconds, so the
+ * accepted range here is the `u64`-compatible safe-integer range: a
+ * non-negative integer up to `Number.MAX_SAFE_INTEGER` (the kit carries the
+ * value as a JS number before converting to `BigInt`). `undefined` means "no
+ * expiration". Capping at `u32` (the old bound) would reject post-2106
+ * timestamps the contract accepts.
  *
  * @throws {ValidationError} If the expiration is out of range.
  */
@@ -53,8 +55,8 @@ export function validateExpiration(expiration, fieldName = "expiration") {
         return;
     if (!Number.isInteger(expiration) ||
         expiration < 0 ||
-        expiration > 0xffffffff) {
-        throw new ValidationError(`${fieldName} must be a non-negative integer within u32 bounds`, PasskeyKitErrorCode.INVALID_INPUT, { field: fieldName, value: expiration });
+        expiration > Number.MAX_SAFE_INTEGER) {
+        throw new ValidationError(`${fieldName} must be a non-negative integer (u64 UNIX seconds, within JS safe-integer range)`, PasskeyKitErrorCode.INVALID_INPUT, { field: fieldName, value: expiration });
     }
 }
 /**

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAS,GAAG,SAAS;IAErB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,cAAc,EAC1B,mBAAmB,CAAC,eAAe,EACnC,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACJ,CAAC;IAED,IACE,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC;QACxC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,WAAW,SAAS,iEAAiE,EACrF,mBAAmB,CAAC,eAAe,EACnC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAS,GAAG,QAAQ;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mBAAmB,EAC/B,mBAAmB,CAAC,cAAc,EAClC,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mBAAmB,EAC/B,mBAAmB,CAAC,cAAc,EAClC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B,EAC9B,SAAS,GAAG,YAAY;IAExB,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC7B,UAAU,GAAG,CAAC;QACd,UAAU,GAAG,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mDAAmD,EAC/D,mBAAmB,CAAC,aAAa,EACjC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAqB,EACrB,SAAS,GAAG,WAAW;IAEvB,IAAI,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,YAAY,yBAAyB,eAAe,SAAS,CAAC,MAAM,GAAG,EACnF,mBAAmB,CAAC,kBAAkB,EACtC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,iDAAiD,EAC7D,mBAAmB,CAAC,kBAAkB,EACtC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAS,GAAG,SAAS;IAErB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,cAAc,EAC1B,mBAAmB,CAAC,eAAe,EACnC,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACJ,CAAC;IAED,IACE,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC;QACxC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,WAAW,SAAS,iEAAiE,EACrF,mBAAmB,CAAC,eAAe,EACnC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAS,GAAG,QAAQ;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mBAAmB,EAC/B,mBAAmB,CAAC,cAAc,EAClC,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,mBAAmB,EAC/B,mBAAmB,CAAC,cAAc,EAClC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B,EAC9B,SAAS,GAAG,YAAY;IAExB,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC7B,UAAU,GAAG,CAAC;QACd,UAAU,GAAG,MAAM,CAAC,gBAAgB,EACpC,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,kFAAkF,EAC9F,mBAAmB,CAAC,aAAa,EACjC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAqB,EACrB,SAAS,GAAG,WAAW;IAEvB,IAAI,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,YAAY,yBAAyB,eAAe,SAAS,CAAC,MAAM,GAAG,EACnF,mBAAmB,CAAC,kBAAkB,EACtC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,iDAAiD,EAC7D,mBAAmB,CAAC,kBAAkB,EACtC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -2,6 +2,6 @@
  * Package version — auto-generated from package.json.
  * @packageDocumentation
  */
-export declare const VERSION = "0.13.1";
+export declare const VERSION = "0.15.0";
 export declare const NAME = "passkey-kit";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -4,6 +4,6 @@
  */
 // This file is auto-generated. Do not edit manually.
 // Run `pnpm run sync-version` (or `pnpm build`) to update.
-export const VERSION = "0.13.1";
+export const VERSION = "0.15.0";
 export const NAME = "passkey-kit";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "A helper library for creating and using smart wallet accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven <tyler@stellar.org>",
   "license": "MIT",
@@ -31,11 +31,11 @@
   "dependencies": {
     "@openzeppelin/relayer-plugin-channels": "^0.20.0",
     "@simplewebauthn/browser": "^13.3.0",
-    "@stellar/stellar-sdk": "16.0.1",
+    "@stellar/stellar-sdk": ">=16.0.0",
     "base64url": "^3.0.1",
     "buffer": "^6.0.3",
-    "passkey-kit-sdk": "0.7.3",
-    "sac-sdk": "0.4.3"
+    "sac-sdk": "0.4.3",
+    "passkey-kit-sdk": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
@@ -51,7 +51,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/kalepail/passkey-kit.git"
+    "url": "git+https://github.com/stellar/passkey-kit.git"
   },
   "keywords": [
     "smart wallet",
@@ -67,9 +67,9 @@
     "crypto"
   ],
   "bugs": {
-    "url": "https://github.com/kalepail/passkey-kit/issues"
+    "url": "https://github.com/stellar/passkey-kit/issues"
   },
-  "homepage": "https://github.com/kalepail/passkey-kit/blob/main/README.md",
+  "homepage": "https://github.com/stellar/passkey-kit/blob/main/README.md",
   "scripts": {
     "sync-version": "node scripts/sync-version.js",
     "prebuild": "node scripts/sync-version.js",