passkey-kit 0.16.4 → 0.17.0

package/dist/kit/wallet-ops.js

@@ -14,7 +14,9 @@
  */
 import { Keypair } from "@stellar/stellar-sdk";
 import { Durability } from "@stellar/stellar-sdk/rpc";
+import { Address } from "@stellar/stellar-sdk";
 import base64url from "../base64url.js";
+import { PasskeyKitErrorCode, ValidationError } from "../errors.js";
 import { readContractData } from "../rpc-data.js";
 import { signerKeyToScVal, SIGNER_VAL_UDT } from "./auth-payload.js";
 /** Encode an optional expiration into the contract's `Option<u64>` timestamp. */
@@ -43,7 +45,7 @@ export function toContractSignerLimits(limits) {
     }
     return [map];
 }
-function buildSecp256r1Signer(keyId, publicKey, limits, store, expiration) {
+export function buildSecp256r1Signer(keyId, publicKey, limits, store, expiration) {
     const keyIdBuffer = typeof keyId === "string" ? base64url.toBuffer(keyId) : Buffer.from(keyId);
     const publicKeyBuffer = typeof publicKey === "string"
         ? base64url.toBuffer(publicKey)
@@ -84,11 +86,56 @@ function buildPolicySigner(policy, limits, store, expiration) {
 export function buildSecp256r1SignerTx(deps, fn, keyId, publicKey, limits, store, expiration) {
     return deps.wallet[fn]({ signer: buildSecp256r1Signer(keyId, publicKey, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
 }
+/** Build a proof-carrying Secp256r1 signer addition. */
+export function buildAddSecp256r1SignerTx(deps, keyId, publicKey, limits, store, proof, expiration) {
+    return deps.wallet.add_secp256r1({
+        signer: buildSecp256r1Signer(keyId, publicKey, limits, store, expiration),
+        proof,
+    }, { timeoutInSeconds: deps.timeoutInSeconds });
+}
 export function buildEd25519SignerTx(deps, fn, publicKey, limits, store, expiration) {
     return deps.wallet[fn]({ signer: buildEd25519Signer(publicKey, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
 }
-export function buildPolicySignerTx(deps, fn, policy, limits, store, expiration) {
-    return deps.wallet[fn]({ signer: buildPolicySigner(policy, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
+export async function buildPolicySignerTx(deps, fn, policy, limits, store, expiration, options) {
+    const tx = await deps.wallet[fn]({ signer: buildPolicySigner(policy, limits, store, expiration) }, { timeoutInSeconds: deps.timeoutInSeconds });
+    // `add_signer` on a policy runs the policy's `install` hook while the
+    // wallet's authorization is live. Anything the hook `require_auth`s against
+    // the wallet is recorded by simulation as a sub-invocation of the
+    // `add_signer` root, and a single passkey signature would cover it. A
+    // legitimate install needs no wallet-authorized calls, so refuse by default.
+    if (fn === "add_signer" && !options?.allowInstallSubInvocations) {
+        assertNoInstallSubInvocations(tx, deps.wallet.options.contractId, policy);
+    }
+    return tx;
+}
+function assertNoInstallSubInvocations(tx, contractId, policy) {
+    const auth = tx
+        .simulationData?.result?.auth ?? [];
+    for (const entry of auth) {
+        const root = entry.rootInvocation();
+        const fn = root.function();
+        if (fn.switch().name !== "sorobanAuthorizedFunctionTypeContractFn")
+            continue;
+        const args = fn.contractFn();
+        if (Address.fromScAddress(args.contractAddress()).toString() !== contractId)
+            continue;
+        if (args.functionName().toString() !== "add_signer")
+            continue;
+        const subs = root.subInvocations().map(describeInvocation);
+        if (subs.length > 0) {
+            throw new ValidationError(`Policy ${policy} install hook requests wallet-authorized sub-invocations ` +
+                `(${subs.join(", ")}). Refusing to build add_signer. Pass ` +
+                `allowInstallSubInvocations: true to override.`, PasskeyKitErrorCode.INVALID_INPUT, { policy, subInvocations: subs });
+        }
+    }
+}
+function describeInvocation(inv) {
+    const fn = inv.function();
+    if (fn.switch().name !== "sorobanAuthorizedFunctionTypeContractFn") {
+        return fn.switch().name;
+    }
+    const args = fn.contractFn();
+    return `${Address.fromScAddress(args.contractAddress()).toString()}.${args.functionName().toString()}`;
 }
 export function buildRemoveSignerTx(deps, signerKey) {
     return deps.wallet.remove_signer({ signer_key: toContractSignerKey(signerKey) }, { timeoutInSeconds: deps.timeoutInSeconds });

package/dist/kit/wallet-ops.js.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-ops.js","sourceRoot":"","sources":["../../src/kit/wallet-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAe,MAAM,0BAA0B,CAAC;AAcnE,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASrE,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAKD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAa;IAC3D,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;QACnF,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,MAAM,WAAW,GACf,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE;YACN,WAAW;YACX,eAAe;YACf,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,SAAS;QACd,MAAM,EAAE;YACN,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE;YAC/C,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE;YACN,MAAM;YACN,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,EAAY,EACZ,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAC7E,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,EAAY,EACZ,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EACpE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,EAAY,EACZ,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAChE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,SAAoB;IAEpB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAC9B,EAAE,UAAU,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAC9C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,WAAgC;IAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAC3C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAyC,EACzC,UAAkB,EAClB,SAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1E,KAAK,MAAM,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAc,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"wallet-ops.js","sourceRoot":"","sources":["../../src/kit/wallet-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAe,MAAM,0BAA0B,CAAC;AAenE,OAAO,EAAE,OAAO,EAAO,MAAM,sBAAsB,CAAC;AACpD,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASrE,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAKD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAa;IAC3D,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;QACnF,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,MAAM,WAAW,GACf,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE;YACN,WAAW;YACX,eAAe;YACf,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,SAAS;QACd,MAAM,EAAE;YACN,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE;YAC/C,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE;YACN,MAAM;YACN,kBAAkB,CAAC,UAAU,CAAC;YAC9B,sBAAsB,CAAC,MAAM,CAAC;YAC9B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;SAClC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,EAAY,EACZ,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAC7E,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,yBAAyB,CACvC,IAAqB,EACrB,KAA0B,EAC1B,SAA8B,EAC9B,MAAoB,EACpB,KAAkB,EAClB,KAAyB,EACzB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAC9B;QACE,MAAM,EAAE,oBAAoB,CAC1B,KAAK,EACL,SAAS,EACT,MAAM,EACN,KAAK,EACL,UAAU,CACX;QACD,KAAK;KACN,EACD,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,EAAY,EACZ,SAAiB,EACjB,MAAoB,EACpB,KAAkB,EAClB,UAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CACpB,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EACpE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqB,EACrB,EAAY,EACZ,MAAc,EACd,MAAoB,EACpB,KAAkB,EAClB,UAAmB,EACnB,OAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAC9B,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAChE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;IAEF,sEAAsE;IACtE,4EAA4E;IAC5E,kEAAkE;IAClE,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,EAAE,KAAK,YAAY,IAAI,CAAC,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAChE,6BAA6B,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,6BAA6B,CACpC,EAAY,EACZ,UAAkB,EAClB,MAAc;IAEd,MAAM,IAAI,GACP,EAAmF;SACjF,cAAc,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,yCAAyC;YAAE,SAAS;QAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,UAAU;YAAE,SAAS;QACtF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,YAAY;YAAE,SAAS;QAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,UAAU,MAAM,2DAA2D;gBACzE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;gBAC3D,+CAA+C,EACjD,mBAAmB,CAAC,aAAa,EACjC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAoC;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,yCAAyC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAC7B,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,SAAoB;IAEpB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAC9B,EAAE,UAAU,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAC9C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,WAAgC;IAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAC3C,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAyC,EACzC,UAAkB,EAClB,SAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1E,KAAK,MAAM,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAc,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/kit/webauthn-ops.d.ts

@@ -44,6 +44,8 @@ export declare function createPasskey(deps: WebAuthnDeps, appName: string, userN
 export interface AuthenticatedPasskey {
     keyId: string;
     keyIdBuffer: Buffer;
+    /** Raw random challenge used by this authentication ceremony. */
+    challenge: Buffer;
     rawResponse: AuthenticationResponseJSON;
 }
 /**
@@ -51,5 +53,5 @@ export interface AuthenticatedPasskey {
  * `allowCredentials`), returning the selected credential id. Used by
  * `connectWallet` to discover which passkey the user picked.
  */
-export declare function authenticatePasskey(deps: WebAuthnDeps): Promise<AuthenticatedPasskey>;
+export declare function authenticatePasskey(deps: WebAuthnDeps, keyId?: string | Uint8Array): Promise<AuthenticatedPasskey>;
 //# sourceMappingURL=webauthn-ops.d.ts.map

package/dist/kit/webauthn-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn-ops.d.ts","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,sCAAsC,EACtC,qCAAqC,EACrC,8BAA8B,EAC/B,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,IAAI,EAAE;QACtB,WAAW,EAAE,sCAAsC,CAAC;KACrD,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtC,mBAAmB,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE,qCAAqC,CAAC;KACpD,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACzC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,wBAAwB,CAAC;IACtC,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,sBAAsB,GAAE,8BAGvB,GACA,OAAO,CAAC,cAAc,CAAC,CAoCzB;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,0BAA0B,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B"}
+{"version":3,"file":"webauthn-ops.d.ts","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,sCAAsC,EACtC,qCAAqC,EACrC,8BAA8B,EAC/B,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,IAAI,EAAE;QACtB,WAAW,EAAE,sCAAsC,CAAC;KACrD,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtC,mBAAmB,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE,qCAAqC,CAAC;KACpD,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACzC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,wBAAwB,CAAC;IACtC,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,sBAAsB,GAAE,8BAGvB,GACA,OAAO,CAAC,cAAc,CAAC,CAoCzB;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,0BAA0B,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA+B/B"}

package/dist/kit/webauthn-ops.js

@@ -56,12 +56,17 @@ export async function createPasskey(deps, appName, userName, authenticatorSelect
  * `allowCredentials`), returning the selected credential id. Used by
  * `connectWallet` to discover which passkey the user picked.
  */
-export async function authenticatePasskey(deps) {
+export async function authenticatePasskey(deps, keyId) {
+    const challenge = generateChallenge();
+    const requestedKeyId = keyId instanceof Uint8Array ? base64url(Buffer.from(keyId)) : keyId;
     const optionsJSON = {
-        challenge: generateChallenge(),
+        challenge,
         rpId: deps.rpId,
         userVerification: "preferred",
         timeout: WEBAUTHN_TIMEOUT_MS,
+        ...(requestedKeyId
+            ? { allowCredentials: [{ id: requestedKeyId, type: "public-key" }] }
+            : {}),
     };
     let rawResponse;
     try {
@@ -73,6 +78,7 @@ export async function authenticatePasskey(deps) {
     return {
         keyId: rawResponse.id,
         keyIdBuffer: base64url.toBuffer(rawResponse.id),
+        challenge: base64url.toBuffer(challenge),
         rawResponse,
     };
 }

package/dist/kit/webauthn-ops.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn-ops.js","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA6BlE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,OAAe,EACf,QAAgB,EAChB,yBAAyD;IACvD,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,WAAW;CAC9B;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;IAE5D,MAAM,WAAW,GAA2C;QAC1D,SAAS,EAAE,iBAAiB,EAAE;QAC9B,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB,EAAE;YACvB,IAAI,EAAE,WAAW;YACjB,WAAW;SACZ;QACD,sBAAsB;QACtB,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IAEF,IAAI,WAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,6BAA6B,EAC7B,mBAAmB,CAAC,4BAA4B,EAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE9E,OAAO;QACL,WAAW;QACX,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,SAAS;KACV,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB;IAElB,MAAM,WAAW,GAA0C;QACzD,SAAS,EAAE,iBAAiB,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gBAAgB,EAAE,WAAW;QAC7B,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IAEF,IAAI,WAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,+BAA+B,EAC/B,mBAAmB,CAAC,8BAA8B,EAClD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webauthn-ops.js","sourceRoot":"","sources":["../../src/kit/webauthn-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA6BlE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,OAAe,EACf,QAAgB,EAChB,yBAAyD;IACvD,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,WAAW;CAC9B;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;IAE5D,MAAM,WAAW,GAA2C;QAC1D,SAAS,EAAE,iBAAiB,EAAE;QAC9B,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB,EAAE;YACvB,IAAI,EAAE,WAAW;YACjB,WAAW;SACZ;QACD,sBAAsB;QACtB,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IAEF,IAAI,WAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,6BAA6B,EAC7B,mBAAmB,CAAC,4BAA4B,EAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE9E,OAAO;QACL,WAAW;QACX,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,SAAS;KACV,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB,EAClB,KAA2B;IAE3B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,MAAM,cAAc,GAClB,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,MAAM,WAAW,GAA0C;QACzD,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gBAAgB,EAAE,WAAW;QAC7B,OAAO,EAAE,mBAAmB;QAC5B,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,EAAE;YAC7E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,WAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,+BAA+B,EAC/B,mBAAmB,CAAC,8BAA8B,EAClD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxC,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/kit/webauthn-verify.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Client-side cryptography for the Secp256r1 signer-binding protocol.
+ *
+ * Three things live here, all browser-safe (WebCrypto + stellar-sdk hashing,
+ * no Node-only modules):
+ *
+ * 1. **The binding challenge.** `sha256(XDR(Secp256r1BindingPayload))`, where
+ *    the payload contains the network, wallet, purpose, and complete original
+ *    signer. GENESIS and ADD use separate domains. The payload is encoded
+ *    through the contract `Spec` and canonicalized to the host's map order.
+ *    This is the exact value the wallet contract recomputes.
+ *
+ * 2. **WebAuthn assertion verification.** For a STORED proof (the contract's
+ *    64-byte compact `r||s` signature) and for a FRESH `AuthenticationResponseJSON`
+ *    (DER signature straight from the authenticator). Checks: clientDataJSON
+ *    `type`, `challenge`, optional origin allowlist, `rpIdHash`, User Presence,
+ *    optional User Verification, the credential id where one is available, and
+ *    the P-256 signature over `authenticatorData || sha256(clientDataJSON)`.
+ *
+ * 3. **Binding-record verification.** The record's immutable `keyId` and
+ *    `publicKey` must equal the LIVE signer entry. The proof verifies
+ *    against the ORIGINAL signer in the record. This permits authorized policy
+ *    updates without changing the signed deployment or addition consent.
+ *    The caller must also verify the wallet's accepted birth code. Custom birth
+ *    code can copy a pending proof before it upgrades to accepted current code.
+ *
+ * Every verifier returns a result object rather than throwing, so a candidate
+ * filter can drop a wallet for a named reason without aborting the whole
+ * resolution. Only programmer errors (missing WebCrypto, malformed inputs to the
+ * challenge builder) throw.
+ *
+ * @packageDocumentation
+ */
+import { xdr } from "@stellar/stellar-sdk";
+import type { Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import type { AuthenticationResponseJSON } from "@simplewebauthn/browser";
+import type { BindingPurpose, Secp256r1BindingRecord as ContractSecp256r1BindingRecord, Signer as ContractSigner } from "passkey-kit-sdk";
+/**
+ * Fixed domain separators. These values must equal the contract constants.
+ */
+export declare const SECP256R1_GENESIS_DOMAIN = "secp256r1_genesis_v1";
+export declare const SECP256R1_ADD_DOMAIN = "secp256r1_add_v1";
+/** The contract spec UDT name of the binding payload struct. */
+export declare const SECP256R1_BINDING_PAYLOAD_TYPE = "Secp256r1BindingPayload";
+/** Inputs that fully determine a binding challenge. */
+export interface BindingChallengeInput {
+    /** A contract `Spec` that defines `Secp256r1BindingPayload`. */
+    spec: ContractSpec;
+    /** Network passphrase; hashed to the `network_id` the wallet reads. */
+    networkPassphrase: string;
+    /** The wallet contract address (`C…`) the proof binds to. */
+    contractId: string;
+    /** Entry point that will consume this proof. */
+    purpose: BindingPurpose["tag"];
+    /** The complete original signer value, including its mutable policy fields. */
+    signer: ContractSigner;
+}
+/** Normalize a base64url string or raw bytes to bytes. */
+export declare function toKeyIdBytes(keyId: Uint8Array | string): Uint8Array;
+/**
+ * Canonicalize an `ScVal` map into the host's storage order.
+ *
+ * The contract hashes `to_xdr(payload)`, and the host serializes a struct as
+ * an `ScMap` sorted by key. `Spec.nativeToScVal` emits struct fields in spec
+ * declaration order, which for the Rust struct is NOT sorted, so the map is
+ * re-sorted here by symbol key (bytewise, the host's order for symbols).
+ * Non-map values pass through unchanged.
+ */
+export declare function canonicalScVal(value: xdr.ScVal): xdr.ScVal;
+/**
+ * The binding payload as a canonical `ScVal`, encoded through the contract
+ * `Spec` so field types are exactly the on-chain ones.
+ */
+export declare function bindingPayloadScVal(input: BindingChallengeInput): xdr.ScVal;
+/**
+ * The 32-byte binding challenge: `sha256(XDR(payload))`. This is the value a
+ * WebAuthn ceremony must carry (base64url-encoded) as its `challenge`.
+ */
+export declare function bindingChallenge(input: BindingChallengeInput): Uint8Array;
+/** The binding challenge as the base64url string WebAuthn puts in clientDataJSON. */
+export declare function bindingChallengeBase64url(input: BindingChallengeInput): string;
+/** Why an assertion failed to verify. */
+export type AssertionFailure = "key_id" | "client_data" | "type" | "challenge" | "origin" | "authenticator_data" | "rp_id" | "user_presence" | "user_verification" | "public_key" | "signature";
+export type AssertionResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: AssertionFailure;
+    detail: string;
+};
+/** What an assertion must satisfy. */
+export interface AssertionPolicy {
+    /** The 32-byte challenge the assertion must carry. */
+    expectedChallenge: Uint8Array;
+    /** Relying Party id; `sha256(rpId)` must equal `authenticatorData[0..32]`. */
+    rpId: string;
+    /** 65-byte P-256 public key the signature must verify under. */
+    publicKey: Uint8Array;
+    /**
+     * Credential id the assertion must come from. Checked only where the
+     * assertion carries one (a fresh response has `id`; a stored proof does not).
+     */
+    expectedKeyId?: Uint8Array | string;
+    /** Require the User Verification flag (biometric/PIN). Default: UP only. */
+    requireUserVerification?: boolean;
+    /** When set (non-empty), `clientDataJSON.origin` must be listed. */
+    allowedOrigins?: readonly string[];
+}
+/** A stored proof as the contract keeps it (compact 64-byte `r||s`). */
+export interface StoredWebAuthnProof {
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** 64 bytes: `r || s`, low-S. */
+    signature: Uint8Array;
+}
+/**
+ * Verify one WebAuthn assertion with a compact signature against a policy.
+ * Every structural check runs before the signature, so a malformed assertion
+ * never costs a curve operation.
+ */
+export declare function verifyAssertion(proof: StoredWebAuthnProof, policy: AssertionPolicy, presentedKeyId?: string): Promise<AssertionResult>;
+/** Verify a STORED binding proof (contract compact signature). */
+export declare function verifyStoredProof(proof: StoredWebAuthnProof, policy: AssertionPolicy): Promise<AssertionResult>;
+/**
+ * Verify a FRESH `AuthenticationResponseJSON` from `startAuthentication`. The
+ * DER signature is converted to compact form (with low-S) through the same
+ * `compactSignature` the signing pipeline uses, and `response.id` is checked
+ * against `policy.expectedKeyId` when that is set.
+ */
+export declare function verifyFreshAssertion(response: AuthenticationResponseJSON, policy: AssertionPolicy): Promise<AssertionResult>;
+/** The contract's `Secp256r1BindingRecord`, as read from the ledger. */
+export type Secp256r1BindingRecord = ContractSecp256r1BindingRecord;
+/** The live `Secp256r1` signer entry the record must agree with. */
+export interface LiveSecp256r1Signer {
+    keyId: Uint8Array | string;
+    publicKey: Uint8Array;
+}
+/** What a binding record must satisfy for one candidate wallet. */
+export interface BindingRecordPolicy {
+    spec: ContractSpec;
+    networkPassphrase: string;
+    /** The CANDIDATE address the challenge is recomputed for. */
+    contractId: string;
+    rpId: string;
+    allowedOrigins?: readonly string[];
+    requireUserVerification?: boolean;
+}
+export type BindingFailure = AssertionFailure | "signer_kind" | "key_id_mismatch" | "public_key_mismatch";
+export type BindingResult = {
+    ok: true;
+    challenge: Uint8Array;
+} | {
+    ok: false;
+    reason: BindingFailure;
+    detail: string;
+};
+/**
+ * Verify that `record` binds `liveSigner` to `policy.contractId`.
+ *
+ * 1. The record's signer keyId and public key equal the live signer.
+ * 2. The challenge uses the record's original full signer and purpose.
+ * 3. The stored proof must be a valid `webauthn.get` assertion over that
+ *    challenge under that key, with the rpId/UP/UV/origin policy applied.
+ */
+export declare function verifyBindingRecord(record: Secp256r1BindingRecord, liveSigner: LiveSecp256r1Signer, policy: BindingRecordPolicy): Promise<BindingResult>;
+//# sourceMappingURL=webauthn-verify.d.ts.map

package/dist/kit/webauthn-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-verify.d.ts","sourceRoot":"","sources":["../../src/kit/webauthn-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAQ,GAAG,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,IAAI,8BAA8B,EACxD,MAAM,IAAI,cAAc,EACzB,MAAM,iBAAiB,CAAC;AAwBzB;;GAEG;AACH,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,gEAAgE;AAChE,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAExE,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,IAAI,EAAE,YAAY,CAAC;IACnB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAInE;AASD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAqB1D;AAmBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,GAAG,CAAC,KAAK,CA6B3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAEzE;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAMD,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,aAAa,GACb,MAAM,GACN,WAAW,GACX,QAAQ,GACR,oBAAoB,GACpB,OAAO,GACP,eAAe,GACf,mBAAmB,GACnB,YAAY,GACZ,WAAW,CAAC;AAEhB,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,iBAAiB,EAAE,UAAU,CAAC;IAC9B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,SAAS,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACpC,4EAA4E;IAC5E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,oEAAoE;IACpE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,EAAE,UAAU,CAAC;IAC9B,cAAc,EAAE,UAAU,CAAC;IAC3B,iCAAiC;IACjC,SAAS,EAAE,UAAU,CAAC;CACvB;AA0ED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,eAAe,EACvB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,eAAe,CAAC,CAqD1B;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,0BAA0B,EACpC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAMD,wEAAwE;AACxE,MAAM,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAEpE,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,YAAY,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,cAAc,GACtB,gBAAgB,GAChB,aAAa,GACb,iBAAiB,GACjB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAgDxB"}