(async (resolve) => {
- const now = new Date();
-
- now.setMinutes(0, 0, 0);
-
- const nowData = new TextEncoder().encode(now.getTime().toString());
- const hashBuffer = await crypto.subtle.digest('SHA-256', nowData);
- const keypair = Keypair.fromRawEd25519Seed(Buffer.from(hashBuffer))
- const publicKey = keypair.publicKey()
-
- rpc.getAccount(publicKey)
- .catch(() => rpc.requestAirdrop(publicKey))
- .catch(() => { })
-
- resolve(keypair)
-})
-export const fundPubkey = (await fundKeypair).publicKey()
-export const fundSigner = basicNodeSigner(await fundKeypair, import.meta.env.VITE_networkPassphrase)
-
-export const account = new PasskeyKit({
- rpcUrl: import.meta.env.VITE_rpcUrl,
- networkPassphrase: import.meta.env.VITE_networkPassphrase,
- walletWasmHash: import.meta.env.VITE_walletWasmHash,
-});
-export const server = new PasskeyServer({
- rpcUrl: import.meta.env.VITE_rpcUrl,
- relayerUrl: import.meta.env.VITE_relayerUrl,
- relayerApiKey: import.meta.env.VITE_relayerApiKey,
- mercuryProjectName: import.meta.env.VITE_mercuryProjectName,
- mercuryUrl: import.meta.env.VITE_mercuryUrl,
- mercuryJwt: import.meta.env.VITE_mercuryJwt,
-});
-
-export const sac = new SACClient({
- rpcUrl: import.meta.env.VITE_rpcUrl,
- networkPassphrase: import.meta.env.VITE_networkPassphrase,
-});
-export const native = sac.getSACClient(import.meta.env.VITE_nativeContractId)
\ No newline at end of file
diff --git a/demo/src/lib/components/ActivityLog.svelte b/demo/src/lib/components/ActivityLog.svelte
new file mode 100644
index 0000000..c3ffe98
--- /dev/null
+++ b/demo/src/lib/components/ActivityLog.svelte
@@ -0,0 +1,42 @@
+
+
+
+
+
Activity
+
+
+
+
+ {#each app.log as entry (entry.id)}
+
+
+ {entry.message}
+ {time(entry.at)}
+
+ {#if entry.detail}
{entry.detail}
{/if}
+ {#if entry.hash}
+
+ {/if}
+
+ {:else}
+
No activity yet.
+ {/each}
+
+
+ {#each kinds as k}
+
+ {/each}
+
+
+ {#if kind === "Secp256r1"}
+
+
+
+
+ {:else if kind === "Ed25519"}
+
+ Uses the ephemeral Ed25519 key
+ {#if app.ed25519Public}{app.ed25519Public.slice(0, 10)}…{:else}(generated on demand){/if}.
+
+
+ {:else}
+
Policy contract {config.samplePolicyId?.slice(0, 10)}…
+ {/if}
+
+
+
+ {#each [SignerStore.Persistent, SignerStore.Temporary] as s}
+
+ {/each}
+
+
+
+
days
+
+
+
+
+
+
Signer discovery
+
+ {#if !indexer.configured}
+
+ Indexer proxy not configured — set VITE_indexerProxyUrl to query Mercury / Stellar
+ Indexer. (Both backends are verified live in the F2 e2e.)
+
+ {/if}
+
+
+
Backend
+
+
+ {#each INDEXER_BACKENDS as b}
+
+ {/each}
+
+
+
+
+
+
+
+ {#if app.discovered.length}
+
+ {#each app.discovered as row}
+ -
+
+ {row.key.kind}
+ {row.status}
+
+ {shortId(row.key.value, 12)}
+
+ {row.storage}{row.expiration ? ` · expires ${new Date(row.expiration * 1000).toISOString().slice(0, 10)}` : ""}
+
+
+ {/each}
+
+ {:else}
+ No discovery results yet.
+ {/if}
+
diff --git a/demo/src/lib/components/Header.svelte b/demo/src/lib/components/Header.svelte
new file mode 100644
index 0000000..a424075
--- /dev/null
+++ b/demo/src/lib/components/Header.svelte
@@ -0,0 +1,31 @@
+
+
+
diff --git a/demo/src/lib/components/LimitsBuilder.svelte b/demo/src/lib/components/LimitsBuilder.svelte
new file mode 100644
index 0000000..763408f
--- /dev/null
+++ b/demo/src/lib/components/LimitsBuilder.svelte
@@ -0,0 +1,79 @@
+
+
+
+
Signer limits
+
+ {#each modes as m}
+
+ {/each}
+
+
{modes.find((m) => m.id === spec.mode)?.hint}
+
+ {#if spec.mode === "restricted"}
+
+ {#each spec.entries as entry, i}
+
+
+ Contract {i + 1}
+
+
+
+ {#each entry.keys as key, j}
+
+
+
+
+
+ {/each}
+
+ {#if entry.keys.length === 0}
+
No keys ⇒ unrestricted on this contract.
+ {/if}
+
+ {/each}
+
+
+ {/if}
+
+
+ {signer.kind}
+ {#if isAdmin(signer)}admin{:else}session{/if}
+ {#if signer.self}this passkey{/if}
+ {#if active}active signer{/if}
+ {signer.store}
+
+
{shortId(signer.value, 12)}
+
+ {signer.label ?? ""} · limits: {signer.limitsMode} · expires: {expiryLabel}
+
+
+
+
+ {#if signer.kind === "Secp256r1" && isAdmin(signer) && !active}
+
+ {/if}
+
+
+
+
+ {#if editing}
+
+
+
Update signer
+
+
+ {#each [SignerStore.Persistent, SignerStore.Temporary] as s}
+
+ {/each}
+
+
+
+
days
+
+
+
+
+
+
+
Balance & transfers
+
+
+
+
+
+
+
+
+
{balance ? fromStroops(balance) : "—"}
+
{token?.label}
+
+
+
+
+
+
+
+ Only XLM (native) can be funded; other tokens must be acquired separately.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Sign with
+
+
+ {#each signOptions as o}
+
+ {/each}
+
+
+
+ {#if signWith === "ed25519" || signWith === "policy" || signWith === "multisig"}
+
+ Ephemeral Ed25519:
+ {#if app.ed25519Public}{shortId(app.ed25519Public, 6)}{:else}none{/if}
+
+
+ {/if}
+
+
Wallet
+
+ {#if connected}
+
+
Smart wallet
+
{app.contractId}
+
+ active signer: {shortId(app.activeKeyId, 10)}
+
+
+
+
+
+ {:else}
+
+
+
+
+
+
+
+
+
+ {/if}
+
+ {#if app.knownPasskeys.length}
+
+ Known passkeys ({app.knownPasskeys.length})
+
+ {/if}
+
diff --git a/demo/src/lib/config.ts b/demo/src/lib/config.ts
new file mode 100644
index 0000000..b931508
--- /dev/null
+++ b/demo/src/lib/config.ts
@@ -0,0 +1,127 @@
+/**
+ * Public demo configuration + shared singletons.
+ *
+ * Everything constructed here is browser-safe. Submission and indexer discovery
+ * go through server-side proxy workers (URLs below) so no relayer key or indexer
+ * JWT is ever bundled. The old demo inlined the relayer API key + Mercury JWT and
+ * a hard-coded Stellar secret seed into the client — all purged.
+ */
+
+import { Buffer } from "buffer";
+import { Account, Keypair, StrKey } from "@stellar/stellar-sdk";
+import { Server } from "@stellar/stellar-sdk/rpc";
+import { basicNodeSigner } from "@stellar/stellar-sdk/contract";
+import { PasskeyKit, SACClient } from "passkey-kit";
+import { LocalStorageAdapter } from "passkey-kit/storage";
+import { RelayerProxyClient } from "./relayer-proxy";
+import { IndexerProxyClient } from "./indexer-proxy";
+
+const env = import.meta.env;
+
+/** A SAC/SEP-41 token the demo can transfer/read. */
+export interface TokenOption {
+ label: string;
+ contractId: string;
+ native: boolean;
+}
+
+function parseTokens(): TokenOption[] {
+ const tokens: TokenOption[] = [
+ { label: "XLM (native)", contractId: env.VITE_nativeContractId, native: true },
+ ];
+ const extra = env.VITE_extraTokenIds?.trim();
+ if (extra) {
+ for (const raw of extra.split(",")) {
+ const part = raw.trim();
+ if (!part) continue;
+ const idx = part.indexOf(":");
+ const [label, contractId] =
+ idx > 0
+ ? [part.slice(0, idx).trim(), part.slice(idx + 1).trim()]
+ : [`${part.slice(0, 4)}…${part.slice(-4)}`, part];
+ if (contractId) tokens.push({ label, contractId, native: false });
+ }
+ }
+ return tokens;
+}
+
+/** Typed, public-only config surface. */
+export const config = {
+ rpcUrl: env.VITE_rpcUrl,
+ networkPassphrase: env.VITE_networkPassphrase,
+ walletWasmHash: env.VITE_walletWasmHash,
+ nativeContractId: env.VITE_nativeContractId,
+ samplePolicyId: env.VITE_samplePolicyId?.trim() || undefined,
+ relayerProxyUrl: env.VITE_relayerProxyUrl?.trim() || undefined,
+ indexerProxyUrl: env.VITE_indexerProxyUrl?.trim() || undefined,
+ tokens: parseTokens(),
+};
+
+/** Which network the explorer links point at. */
+export const network: "testnet" | "public" = config.networkPassphrase.includes(
+ "Test",
+)
+ ? "testnet"
+ : "public";
+
+export const explorerTx = (hash: string): string =>
+ `https://stellar.expert/explorer/${network}/tx/${hash}`;
+export const explorerContract = (contractId: string): string =>
+ `https://stellar.expert/explorer/${network}/contract/${contractId}`;
+
+export const rpc = new Server(config.rpcUrl);
+
+/** Passkey-record storage (adapter, not hand-rolled localStorage). */
+export const storage = new LocalStorageAdapter();
+
+/** The browser-side kit. Signs; never submits (that's the relayer proxy). */
+export const account = new PasskeyKit({
+ rpcUrl: config.rpcUrl,
+ networkPassphrase: config.networkPassphrase,
+ walletWasmHash: config.walletWasmHash,
+ storage,
+});
+
+/** SAC factory for token balance reads + transfers. */
+export const sac = new SACClient({
+ rpcUrl: config.rpcUrl,
+ networkPassphrase: config.networkPassphrase,
+});
+
+/** Server-side submission (fee-sponsored, keyless — worker mints the key). */
+export const relayer = new RelayerProxyClient(config.relayerProxyUrl);
+
+/** Server-side signer discovery (Mercury + Stellar Indexer behind the proxy). */
+export const indexer = new IndexerProxyClient(config.indexerProxyUrl);
+
+/**
+ * An ephemeral testnet FUNDING source — a deterministic per-hour keypair kept
+ * topped up by Friendbot. This is NOT a wallet secret: it holds only throwaway
+ * testnet XLM used to seed freshly created wallets. Regenerated every hour.
+ */
+export const fundKeypair: Promise = (async () => {
+ const now = new Date();
+ now.setMinutes(0, 0, 0);
+ const seed = new TextEncoder().encode(now.getTime().toString());
+ const hash = await crypto.subtle.digest("SHA-256", seed);
+ const keypair = Keypair.fromRawEd25519Seed(Buffer.from(hash));
+
+ rpc
+ .getAccount(keypair.publicKey())
+ .catch(() => rpc.requestAirdrop(keypair.publicKey()))
+ .catch(() => {});
+
+ return keypair;
+})();
+
+export async function fundPubkey(): Promise {
+ return (await fundKeypair).publicKey();
+}
+
+export async function fundSigner() {
+ return basicNodeSigner(await fundKeypair, config.networkPassphrase);
+}
+
+/** A never-funded placeholder source for read-only simulation. */
+export const mockPubkey = StrKey.encodeEd25519PublicKey(Buffer.alloc(32));
+export const mockSource = new Account(mockPubkey, "0");
diff --git a/demo/src/lib/format.ts b/demo/src/lib/format.ts
new file mode 100644
index 0000000..c9060bc
--- /dev/null
+++ b/demo/src/lib/format.ts
@@ -0,0 +1,77 @@
+/**
+ * Display + typed-error formatting helpers.
+ */
+
+import { ContractError, PasskeyKitError } from "passkey-kit";
+
+/** Abbreviate a long id (contract, key, hash) as `ABCDEF…UVWXYZ`. */
+export function shortId(id: string | undefined, edge = 6): string {
+ if (!id) return "";
+ return id.length <= edge * 2 + 1 ? id : `${id.slice(0, edge)}…${id.slice(-edge)}`;
+}
+
+const STROOPS_PER_UNIT = 10_000_000n;
+
+/**
+ * Format i128 stroops as a human XLM/token amount (7 decimals), using exact
+ * BigInt math (no JS `Number`, which loses integer precision above ~9e15).
+ */
+export function fromStroops(stroops: string | bigint | undefined): string {
+ if (stroops === undefined) return "—";
+ const value = BigInt(stroops);
+ const negative = value < 0n;
+ const abs = negative ? -value : value;
+ const whole = abs / STROOPS_PER_UNIT;
+ const frac = (abs % STROOPS_PER_UNIT).toString().padStart(7, "0").replace(/0+$/, "");
+ return `${negative ? "-" : ""}${whole}${frac ? `.${frac}` : ""}`;
+}
+
+/**
+ * Parse a human token amount into i128 stroops. String inputs are parsed with
+ * exact decimal→BigInt math (no `Number` rounding); numbers fall back to a safe
+ * scale-and-round (demo-scale amounts only).
+ */
+export function toStroops(amount: string | number): bigint {
+ const str = typeof amount === "string" ? amount.trim() : String(amount);
+ const match = /^(\d+)(?:\.(\d+))?$/.exec(str);
+ if (!match) {
+ // Scientific notation etc. from a number input: scale then round.
+ const n = Number(amount);
+ if (!Number.isFinite(n) || n < 0) throw new Error("Invalid amount");
+ return BigInt(Math.round(n * 10_000_000));
+ }
+ const whole = BigInt(match[1]);
+ const frac = BigInt((match[2] ?? "").padEnd(7, "0").slice(0, 7));
+ return whole * STROOPS_PER_UNIT + frac;
+}
+
+/** A structured, human-readable description of any thrown value. */
+export interface ErrorDescription {
+ name: string;
+ message: string;
+ code?: number;
+ contract?: string;
+}
+
+/**
+ * Turn any thrown value into a typed, surfacing-friendly description. Recognizes
+ * the SDK's {@link PasskeyKitError} hierarchy so the UI shows real error codes
+ * and decoded contract-error names instead of `alert(err.message)`.
+ */
+export function describeError(err: unknown): ErrorDescription {
+ if (err instanceof ContractError) {
+ return {
+ name: err.name,
+ message: err.message,
+ code: err.code,
+ contract: `#${err.contractCode} ${err.contractErrorName} (${err.family})`,
+ };
+ }
+ if (err instanceof PasskeyKitError) {
+ return { name: err.name, message: err.message, code: err.code };
+ }
+ if (err instanceof Error) {
+ return { name: err.name || "Error", message: err.message };
+ }
+ return { name: "Error", message: String(err) };
+}
diff --git a/demo/src/lib/indexer-proxy.ts b/demo/src/lib/indexer-proxy.ts
new file mode 100644
index 0000000..2acec07
--- /dev/null
+++ b/demo/src/lib/indexer-proxy.ts
@@ -0,0 +1,127 @@
+/**
+ * Browser client for the indexer-proxy (signer discovery, backend toggle).
+ *
+ * The proxy holds the Mercury / Stellar Indexer credentials; the browser only
+ * picks a backend. The JSON wire shape mirrors the SDK's `src/indexer/types.ts`
+ * `WalletSigner` (B5 / todo 952) — once B5 exports it under a subpath, swap
+ * {@link DiscoveredSigner} for the SDK type. Values are strings/hex because a
+ * `SignerKey` class instance and `Uint8Array` can't survive JSON.
+ */
+
+import {
+ IndexerError,
+ PasskeyKitErrorCode,
+ type SignerKeyTag,
+} from "passkey-kit";
+
+/** The two interchangeable indexer backends. */
+export type IndexerBackend = "mercury" | "stellar-indexer";
+
+export const INDEXER_BACKENDS: { id: IndexerBackend; label: string }[] = [
+ { id: "mercury", label: "Mercury (Zephyr)" },
+ { id: "stellar-indexer", label: "Stellar Indexer" },
+];
+
+/** A signer as returned by an indexer backend (JSON wire form). */
+export interface DiscoveredSigner {
+ key: { kind: SignerKeyTag; value: string };
+ /** 65-byte secp256r1 public key, hex-encoded (Secp256r1 signers). */
+ publicKey?: string;
+ /** Expiration as a UNIX timestamp in seconds (inclusive). */
+ expiration?: number;
+ /** Per-contract limits: contract id → signer keys (`null`/absent = unlimited). */
+ limits?: Record | null;
+ storage: "persistent" | "temporary";
+ status: "live" | "expired" | "evicted" | "removed";
+}
+
+const TIMEOUT_MS = 20_000;
+
+export class IndexerProxyClient {
+ constructor(private readonly baseUrl?: string) {}
+
+ /** Whether an indexer-proxy URL is configured (discovery possible). */
+ get configured(): boolean {
+ return Boolean(this.baseUrl);
+ }
+
+ /** Enumerate every signer a backend has indexed for a wallet. */
+ async getSigners(
+ wallet: string,
+ backend: IndexerBackend,
+ ): Promise {
+ const data = await this.get("/signers", {
+ wallet,
+ backend,
+ });
+ return Array.isArray(data) ? data : [];
+ }
+
+ /** Reverse lookup: the wallet contract ids a signer key belongs to. */
+ async findWallets(
+ key: { kind: SignerKeyTag; value: string },
+ backend: IndexerBackend,
+ ): Promise {
+ const data = await this.get("/wallets", {
+ kind: key.kind,
+ value: key.value,
+ backend,
+ });
+ return Array.isArray(data) ? data : [];
+ }
+
+ /** Probe backend health (throws IndexerError on transport failure). */
+ async health(
+ backend: IndexerBackend,
+ ): Promise<{ ok: boolean; backend: string; detail?: string }> {
+ return this.get("/health", { backend });
+ }
+
+ private async get(
+ path: string,
+ params: Record,
+ ): Promise {
+ if (!this.baseUrl) {
+ throw new IndexerError(
+ "Indexer proxy is not configured (set VITE_indexerProxyUrl)",
+ PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED,
+ );
+ }
+
+ const url = new URL(
+ path.replace(/^\//, ""),
+ this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`,
+ );
+ for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+
+ const controller = new AbortController();
+ const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);
+ try {
+ const res = await fetch(url, { signal: controller.signal });
+ const text = await res.text();
+ if (!res.ok) {
+ throw new IndexerError(
+ `Indexer proxy ${path} failed (HTTP ${res.status}): ${text.slice(0, 200)}`,
+ PasskeyKitErrorCode.INDEXER_REQUEST_FAILED,
+ { path, status: res.status, params },
+ );
+ }
+ return (text ? JSON.parse(text) : undefined) as T;
+ } catch (err) {
+ if (err instanceof IndexerError) throw err;
+ const aborted = err instanceof Error && err.name === "AbortError";
+ throw new IndexerError(
+ aborted
+ ? `Indexer proxy ${path} timed out`
+ : `Indexer proxy ${path} failed: ${
+ err instanceof Error ? err.message : String(err)
+ }`,
+ PasskeyKitErrorCode.INDEXER_REQUEST_FAILED,
+ { path, params },
+ err instanceof Error ? err : undefined,
+ );
+ } finally {
+ clearTimeout(timeout);
+ }
+ }
+}
diff --git a/demo/src/lib/relayer-proxy.ts b/demo/src/lib/relayer-proxy.ts
new file mode 100644
index 0000000..71ceedd
--- /dev/null
+++ b/demo/src/lib/relayer-proxy.ts
@@ -0,0 +1,162 @@
+/**
+ * Browser client for the relayer-proxy worker (todo 954).
+ *
+ * The worker holds the relayer API key (keyless per-IP minting); the browser
+ * sends only transaction material and receives a typed result. Two wire bodies,
+ * mirroring `PasskeyServer.send`'s routing:
+ * - `{ func, auth }` — a Soroban invoke without source-account auth.
+ * - `{ xdr }` — an envelope (deploys / source-account auth) to fee-bump.
+ */
+
+import {
+ PasskeyKitErrorCode,
+ RelayerError,
+ contractErrorFromCode,
+ decodeContractError,
+ type PasskeyKitError,
+ type TransactionResult,
+} from "passkey-kit";
+
+/** `{ func, auth }` (preferred) or `{ xdr }` (envelope) wire body. */
+export type RelayerProxyBody =
+ | { func: string; auth: string[] }
+ | { xdr: string };
+
+/**
+ * The worker's response envelope (relayer-proxy/src/index.ts):
+ * success → `{ success: true, data: { transactionId, hash, status } }`
+ * failure → `{ success: false, error: , data?: { code, details } }`
+ * with a non-2xx HTTP status.
+ * There is no `ledger` field.
+ */
+interface WorkerEnvelope {
+ success?: boolean;
+ error?: string;
+ data?: {
+ transactionId?: string;
+ hash?: string;
+ status?: string;
+ code?: string | number;
+ details?: unknown;
+ };
+}
+
+const TIMEOUT_MS = 6 * 60 * 1000;
+
+export class RelayerProxyClient {
+ constructor(private readonly baseUrl?: string) {}
+
+ /** Whether a proxy URL is configured (submission possible). */
+ get configured(): boolean {
+ return Boolean(this.baseUrl);
+ }
+
+ /**
+ * Submit transaction material through the proxy. Never throws — returns a
+ * discriminated {@link TransactionResult}, matching the SDK's submission
+ * contract so the UI can branch on `result.success`.
+ */
+ async submit(body: RelayerProxyBody): Promise {
+ if (!this.baseUrl) {
+ return fail(
+ new RelayerError(
+ "Relayer proxy is not configured (set VITE_relayerProxyUrl)",
+ PasskeyKitErrorCode.RELAYER_NOT_CONFIGURED,
+ ),
+ );
+ }
+
+ const controller = new AbortController();
+ const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);
+
+ try {
+ const res = await fetch(this.baseUrl, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify(body),
+ signal: controller.signal,
+ });
+
+ const text = await res.text();
+ const payload = text ? (safeParse(text) as WorkerEnvelope | undefined) : undefined;
+
+ // Failure = non-2xx OR an explicit `success: false` (defensive).
+ if (!res.ok || payload?.success === false) {
+ return fail(toError(payload, res.status, text));
+ }
+
+ // Success: unwrap the `data` envelope. The worker returns no `ledger`, so
+ // it stays undefined; `transactionId`/`status` come from `data`.
+ const ok = payload?.data ?? {};
+ if (!ok.hash) {
+ return fail(
+ new RelayerError(
+ `Relayer proxy returned no transaction hash: ${text.slice(0, 200)}`,
+ PasskeyKitErrorCode.RELAYER_REQUEST_FAILED,
+ ),
+ );
+ }
+ return {
+ success: true,
+ hash: ok.hash,
+ transactionId: ok.transactionId,
+ };
+ } catch (err) {
+ const aborted = err instanceof Error && err.name === "AbortError";
+ return fail(
+ new RelayerError(
+ aborted
+ ? "Relayer proxy request timed out"
+ : `Relayer proxy request failed: ${
+ err instanceof Error ? err.message : String(err)
+ }`,
+ PasskeyKitErrorCode.RELAYER_REQUEST_FAILED,
+ ),
+ );
+ } finally {
+ clearTimeout(timeout);
+ }
+ }
+}
+
+function fail(error: PasskeyKitError): TransactionResult {
+ return { success: false, error };
+}
+
+function safeParse(text: string): unknown {
+ try {
+ return JSON.parse(text);
+ } catch {
+ return undefined;
+ }
+}
+
+/** Map the worker error envelope to a typed SDK error (ContractError when decodable). */
+function toError(
+ payload: WorkerEnvelope | undefined,
+ status: number,
+ raw: string,
+): PasskeyKitError {
+ const message =
+ (typeof payload?.error === "string" && payload.error) ||
+ `Relayer proxy failed (HTTP ${status}): ${raw.slice(0, 200)}`;
+ const code = payload?.data?.code;
+ const details = payload?.data?.details;
+
+ // A numeric `data.code` may be a contract error code; otherwise scan the
+ // message + raw body for an `Error(Contract, #N)` marker (the relayer surfaces
+ // the contract failure there) so contract-error codes aren't dropped.
+ const contract =
+ (typeof code === "number"
+ ? contractErrorFromCode(code, { status, details })
+ : null) ??
+ decodeContractError(message) ??
+ decodeContractError(raw);
+ if (contract) return contract;
+
+ return new RelayerError(message, PasskeyKitErrorCode.RELAYER_REQUEST_FAILED, {
+ status,
+ code: code === undefined ? undefined : String(code),
+ details,
+ });
+}
diff --git a/demo/src/lib/signers.ts b/demo/src/lib/signers.ts
new file mode 100644
index 0000000..1c9b18c
--- /dev/null
+++ b/demo/src/lib/signers.ts
@@ -0,0 +1,96 @@
+/**
+ * Local signer model + `SignerLimits` construction.
+ *
+ * The demo keeps its own optimistic registry of the signers it has added, so the
+ * core flows work before the indexer proxy is live; the Discovery panel then
+ * cross-checks the registry against a real backend. A signer's `limits` are what
+ * define "admin" vs "session": an UNLIMITED signer (`SignerLimits` = None) can
+ * authorize anything (admin); a restricted or empty map is a scoped session key.
+ */
+
+import { SignerKey, SignerStore, type SignerKeyTag, type SignerLimits } from "passkey-kit";
+
+export type SignerKind = SignerKeyTag;
+
+/** Limits presets exposed by the builder. */
+export type LimitsMode = "unlimited" | "none" | "restricted";
+
+/** One restricted-limits row: which signer keys this signer may co-authorize on a contract. */
+export interface LimitsEntry {
+ contract: string;
+ keys: { kind: SignerKind; value: string }[];
+}
+
+/** UI model for building a `SignerLimits`. */
+export interface LimitsSpec {
+ mode: LimitsMode;
+ entries: LimitsEntry[];
+}
+
+export const UNLIMITED: LimitsSpec = { mode: "unlimited", entries: [] };
+
+/** A signer the demo knows about (optimistic registry). */
+export interface LocalSigner {
+ kind: SignerKind;
+ /** keyId (base64url) for Secp256r1, G-address for Ed25519, C-address for Policy. */
+ value: string;
+ store: SignerStore;
+ limitsMode: LimitsMode;
+ expiration?: number;
+ label?: string;
+ /** True when this is the connected passkey. */
+ self?: boolean;
+ /** 65-byte secp256r1 public key (base64url), needed to `update_signer`. */
+ publicKey?: string;
+}
+
+/** Whether a signer is an unlimited "admin" signer. */
+export function isAdmin(signer: { limitsMode: LimitsMode }): boolean {
+ return signer.limitsMode === "unlimited";
+}
+
+/** Build the SDK {@link SignerKey} for a local signer (for remove/lookup). */
+export function toSignerKey(signer: { kind: SignerKind; value: string }): SignerKey {
+ switch (signer.kind) {
+ case "Secp256r1":
+ return SignerKey.Secp256r1(signer.value);
+ case "Ed25519":
+ return SignerKey.Ed25519(signer.value);
+ case "Policy":
+ return SignerKey.Policy(signer.value);
+ }
+}
+
+/** Translate a UI {@link LimitsSpec} into the SDK's {@link SignerLimits}. */
+export function buildSignerLimits(spec: LimitsSpec): SignerLimits {
+ if (spec.mode === "unlimited") return undefined;
+
+ const map = new Map();
+ if (spec.mode === "none") return map; // empty map = fail-closed (no permissions)
+
+ for (const entry of spec.entries) {
+ if (!entry.contract) continue;
+ map.set(
+ entry.contract,
+ entry.keys.length ? entry.keys.map(toSignerKey) : undefined,
+ );
+ }
+ return map;
+}
+
+/** Human summary of a limits spec for badges/log. */
+export function describeLimits(spec: LimitsSpec): string {
+ switch (spec.mode) {
+ case "unlimited":
+ return "unlimited (admin)";
+ case "none":
+ return "no permissions (fail-closed)";
+ case "restricted":
+ return `restricted · ${spec.entries.length} contract${spec.entries.length === 1 ? "" : "s"}`;
+ }
+}
+
+/** Absolute UNIX-second expiration `days` from now (contract stores timestamps). */
+export function expirationInDays(days: number): number {
+ return Math.floor(Date.now() / 1000) + Math.round(days * 86_400);
+}
diff --git a/demo/src/lib/state.svelte.ts b/demo/src/lib/state.svelte.ts
new file mode 100644
index 0000000..57df2ea
--- /dev/null
+++ b/demo/src/lib/state.svelte.ts
@@ -0,0 +1,90 @@
+/**
+ * Shared reactive application state (Svelte 5 runes).
+ *
+ * A single deeply-reactive `$state` object mutated by `actions.ts` and read by
+ * components. Kept intentionally small — flows live in `actions.ts`, config +
+ * singletons in `config.ts`.
+ */
+
+import type { StoredPasskey } from "passkey-kit";
+import type { LocalSigner } from "./signers";
+import type { DiscoveredSigner, IndexerBackend } from "./indexer-proxy";
+
+export type ConnectionStatus = "disconnected" | "connecting" | "connected";
+export type LogLevel = "info" | "success" | "error";
+
+export interface LogEntry {
+ id: number;
+ at: number;
+ level: LogLevel;
+ message: string;
+ /** Transaction hash → block explorer link. */
+ hash?: string;
+ /** Secondary line: error code / contract error / ids. */
+ detail?: string;
+}
+
+export interface AppState {
+ ready: boolean;
+ status: ConnectionStatus;
+ /** Connected passkey keyId (base64url). */
+ keyId?: string;
+ /** Connected wallet contract id (C…). */
+ contractId?: string;
+ /** Passkey keyId currently used to authorize writes (admin rotation target). */
+ activeKeyId?: string;
+ /** Optimistic registry of known signers. */
+ signers: LocalSigner[];
+ /** Passkeys persisted in the storage adapter (for reconnect UI). */
+ knownPasskeys: StoredPasskey[];
+ /** Token contract id → balance (stroops). */
+ balances: Record;
+ /** Selected token for transfers/balance. */
+ selectedToken: string;
+ /** Discovery results from the last indexer query. */
+ discovered: DiscoveredSigner[];
+ discoverBackend: IndexerBackend;
+ /** Runtime-generated ephemeral Ed25519 keypair (demo only; never persisted). */
+ ed25519Secret?: string;
+ ed25519Public?: string;
+ /** Label of the in-flight operation, or null when idle. */
+ busy: string | null;
+ log: LogEntry[];
+}
+
+export const app = $state({
+ ready: false,
+ status: "disconnected",
+ signers: [],
+ knownPasskeys: [],
+ balances: {},
+ selectedToken: "",
+ discovered: [],
+ discoverBackend: "mercury",
+ busy: null,
+ log: [],
+});
+
+let logSeq = 0;
+
+/** Append a log entry (newest first, capped). */
+export function pushLog(
+ level: LogLevel,
+ message: string,
+ extra?: { hash?: string; detail?: string },
+): void {
+ app.log.unshift({
+ id: ++logSeq,
+ at: Date.now(),
+ level,
+ message,
+ hash: extra?.hash,
+ detail: extra?.detail,
+ });
+ if (app.log.length > 80) app.log.length = 80;
+}
+
+/** True when a wallet is connected. */
+export function isConnected(): boolean {
+ return app.status === "connected" && Boolean(app.contractId);
+}
diff --git a/demo/src/lib/submit.ts b/demo/src/lib/submit.ts
new file mode 100644
index 0000000..a78add8
--- /dev/null
+++ b/demo/src/lib/submit.ts
@@ -0,0 +1,95 @@
+/**
+ * Client-side submission routing.
+ *
+ * This mirrors `PasskeyServer.send`'s logic — the routing the server-only SDK
+ * entry performs — but keeps it in the browser and forwards the transaction
+ * material to the relayer-proxy worker instead of holding a relayer key. An
+ * `invokeHostFunction` without source-account auth uses the preferred
+ * `{ func, auth }` Soroban path; everything else (deploys, source-account auth)
+ * is fee-bumped through the `{ xdr }` envelope path.
+ */
+
+import {
+ Operation,
+ TransactionBuilder,
+ type Transaction,
+} from "@stellar/stellar-sdk";
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract";
+import {
+ RelayerError,
+ PasskeyKitErrorCode,
+ type TransactionResult,
+} from "passkey-kit";
+import { config, relayer } from "./config";
+
+// `any` in the generic slot: submission only touches `.built`, which is
+// independent of the result type, and `AssembledTransaction` is invariant in its
+// type parameter — so accept whatever the kit/SAC builders return.
+type Submittable = AssembledTransaction | Transaction | string;
+
+/** Normalize any submittable input to a built {@link Transaction}. */
+function toBuiltTransaction(input: Submittable): Transaction {
+ if (typeof input === "string") {
+ return TransactionBuilder.fromXDR(
+ input,
+ config.networkPassphrase,
+ ) as Transaction;
+ }
+ if (input instanceof AssembledTransaction) {
+ if (!input.built) {
+ throw new RelayerError(
+ "AssembledTransaction has not been simulated/built yet",
+ PasskeyKitErrorCode.RELAYER_REQUEST_FAILED,
+ );
+ }
+ return input.built;
+ }
+ return input;
+}
+
+/** Whether any invokeHostFunction op carries source-account auth. */
+function hasSourceAccountAuth(transaction: Transaction): boolean {
+ for (const op of transaction.operations) {
+ if (op.type !== "invokeHostFunction") continue;
+ for (const entry of (op as Operation.InvokeHostFunction).auth ?? []) {
+ if (
+ entry.credentials().switch().name === "sorobanCredentialsSourceAccount"
+ ) {
+ return true;
+ }
+ }
+ }
+ return false;
+}
+
+/**
+ * Submit a signed transaction via the relayer proxy. Never throws — returns a
+ * discriminated {@link TransactionResult}.
+ */
+export async function submit(input: Submittable): Promise {
+ let built: Transaction;
+ try {
+ built = toBuiltTransaction(input);
+ } catch (err) {
+ return {
+ success: false,
+ error:
+ err instanceof RelayerError
+ ? err
+ : new RelayerError(
+ err instanceof Error ? err.message : String(err),
+ PasskeyKitErrorCode.RELAYER_REQUEST_FAILED,
+ ),
+ };
+ }
+
+ const op = built.operations[0];
+ if (op?.type === "invokeHostFunction" && !hasSourceAccountAuth(built)) {
+ const invokeOp = op as Operation.InvokeHostFunction;
+ const func = invokeOp.func.toXDR("base64");
+ const auth = (invokeOp.auth ?? []).map((entry) => entry.toXDR("base64"));
+ return relayer.submit({ func, auth });
+ }
+
+ return relayer.submit({ xdr: built.toXDR() });
+}
diff --git a/demo/src/main.ts b/demo/src/main.ts
index 4d67e2a..a575b3b 100644
--- a/demo/src/main.ts
+++ b/demo/src/main.ts
@@ -1,8 +1,16 @@
-import './app.css'
-import App from './App.svelte'
+import { Buffer } from "buffer";
+import { mount } from "svelte";
+import "./app.css";
+import App from "./App.svelte";
-const app = new App({
- target: document.getElementById('app')!,
-})
+// stellar-sdk / passkey-kit use Node's `Buffer` for XDR + base64url work; the
+// browser has no global for it. Polyfill before anything else loads.
+if (typeof globalThis.Buffer === "undefined") {
+ globalThis.Buffer = Buffer;
+}
-export default app
+const app = mount(App, {
+ target: document.getElementById("app")!,
+});
+
+export default app;
diff --git a/demo/src/vite-env.d.ts b/demo/src/vite-env.d.ts
index 45c1e21..6580ed0 100644
--- a/demo/src/vite-env.d.ts
+++ b/demo/src/vite-env.d.ts
@@ -1,19 +1,46 @@
///
///
+/**
+ * PUBLIC-ONLY demo configuration.
+ *
+ * Every value here is safe to ship in the browser bundle. There are deliberately
+ * NO secrets: the relayer API key and indexer JWTs live only in the server-side
+ * proxy worker (todo 954), which the demo reaches over `VITE_relayerProxyUrl` /
+ * `VITE_indexerProxyUrl`. Never add a `VITE_`-prefixed secret here.
+ */
interface ImportMetaEnv {
- readonly VITE_walletWasmHash: string;
- readonly VITE_networkPassphrase: string;
- readonly VITE_nativeContractId: string;
- readonly VITE_rpcUrl: string;
- readonly VITE_relayerUrl: string;
- readonly VITE_relayerApiKey: string;
- readonly VITE_mercuryProjectName: string;
- readonly VITE_mercuryUrl: string;
- readonly VITE_mercuryJwt: string;
- readonly VITE_mercuryKey: string;
+ /** Stellar RPC URL (e.g. https://soroban-testnet.stellar.org). */
+ readonly VITE_rpcUrl: string;
+ /** Network passphrase (e.g. "Test SDF Network ; September 2015"). */
+ readonly VITE_networkPassphrase: string;
+ /** Smart-wallet WASM hash (hex), pinned from the deployments manifest. */
+ readonly VITE_walletWasmHash: string;
+ /** Native XLM Stellar Asset Contract id (C…). */
+ readonly VITE_nativeContractId: string;
+ /**
+ * Optional non-native SAC / SEP-41 token ids to offer in the token picker,
+ * comma-separated `label:C…` (or bare `C…`). Exercises non-native SAC support.
+ */
+ readonly VITE_extraTokenIds?: string;
+ /**
+ * Optional deployed `sample-policy` contract id (C…) for the policy-signer
+ * demo. Deploy an instance of the v1 sample policy and set this; when unset,
+ * the policy-signer controls are disabled with a hint.
+ */
+ readonly VITE_samplePolicyId?: string;
+ /**
+ * Relayer-proxy worker base URL (submission). The worker holds the relayer
+ * key. When unset, submission is disabled with a "pending backend" notice.
+ */
+ readonly VITE_relayerProxyUrl?: string;
+ /**
+ * Indexer-proxy base URL (signer discovery). The worker holds the Mercury /
+ * Stellar Indexer credentials. When unset, discovery shows "pending backend".
+ */
+ readonly VITE_indexerProxyUrl?: string;
}
interface ImportMeta {
- readonly env: ImportMetaEnv;
+ readonly env: ImportMetaEnv;
}
diff --git a/demo/tsconfig.json b/demo/tsconfig.json
index 786803d..fa7a4dd 100644
--- a/demo/tsconfig.json
+++ b/demo/tsconfig.json
@@ -4,9 +4,14 @@
"target": "ESNext",
"useDefineForClassFields": true,
"module": "ESNext",
+ "moduleResolution": "bundler",
"resolveJsonModule": true,
+ "allowImportingTsExtensions": false,
"isolatedModules": true,
+ "strict": true,
+ "skipLibCheck": true,
+ "types": ["svelte", "vite/client"]
},
- "include": ["src/**/*.ts", "src/**/*.svelte"],
+ "include": ["src/**/*.ts", "src/**/*.svelte", "src/**/*.svelte.ts"],
"references": [{ "path": "./tsconfig.node.json" }]
}
diff --git a/demo/vite.config.ts b/demo/vite.config.ts
index c543c8d..444b8bd 100644
--- a/demo/vite.config.ts
+++ b/demo/vite.config.ts
@@ -1,10 +1,25 @@
-import { defineConfig } from 'vite'
-import { svelte } from '@sveltejs/vite-plugin-svelte'
+import { defineConfig } from "vite";
+import { svelte } from "@sveltejs/vite-plugin-svelte";
-// https://vitejs.dev/config/
+// https://vite.dev/config/
export default defineConfig({
plugins: [svelte()],
+ define: {
+ // stellar-sdk / passkey-kit expect a Node-style `global`; map it to the
+ // browser realm. `Buffer` itself is polyfilled at runtime in `main.ts`.
+ global: "globalThis",
+ },
+ resolve: {
+ // The demo links `passkey-kit` via `link:..`, so passkey-kit's compiled
+ // `dist/` and the demo resolve `@stellar/stellar-sdk`/`buffer` from two
+ // physical locations. Dedupe to a single instance so `xdr`/`Buffer`
+ // `instanceof` checks hold across the boundary.
+ dedupe: ["@stellar/stellar-sdk", "buffer"],
+ },
+ optimizeDeps: {
+ include: ["@stellar/stellar-sdk", "buffer", "base64url"],
+ },
build: {
- target: "ESNext"
+ target: "esnext",
},
-})
+});
diff --git a/docs/deployments-testnet-2026-07-11.md b/docs/deployments-testnet-2026-07-11.md
new file mode 100644
index 0000000..515ba22
--- /dev/null
+++ b/docs/deployments-testnet-2026-07-11.md
@@ -0,0 +1,129 @@
+# passkey-kit v1 contract build + testnet deployment — 2026-07-11
+
+This manifest is THE canonical hash source for the passkey-kit v1 contract
+set. The Makefile, SDK configuration, `verify:bindings` drift guard, and the
+zephyr (Mercury) ingestion allowlist must all consume the hashes recorded
+here — never a locally rebuilt hash.
+
+> **Status: post-audit-gate (FINAL for testnet).** These are the reworked v1
+> contracts AFTER the independent 3-way audit (Fable + gpt-5.6-sol + terra)
+> and all seven confirmed-closed remediations (FIX-1..7 + FIX-3b). The hashes
+> below supersede the interim pre-audit values (smart-wallet
+> `9e7fad44…`, sample-policy `e6d00383…`). The audit gate's final static
+> `/code-review` pass runs after this re-pin; a further contract change would
+> re-pin this manifest again.
+
+## Build provenance
+
+- Repo commit: `0563520` (branch `overhaul/ground-up`); post-audit contract
+ set spans commit range `067f807..0563520` (A1 rework → A2 tests → A4
+ audit fixes → FIX-3b).
+- Rust/Cargo: `1.94.0` (pinned in `contracts/rust-toolchain.toml`)
+- `soroban-sdk`: `27.0.0` (`e5cb4b52c3da8e56fc48adfd7b85d85976c1a059`)
+- Stellar CLI: `27.0.0` (`5a7c5fe76530bf4248477ac812fc757146b98cc4`)
+- Build target: `wasm32v1-none`
+- Build command: `stellar contract build --locked --package --out-dir out`
+ (optimization is on by default in CLI 27; `out/.wasm` is the final artifact)
+- Contract meta: `binver: 1.0.0`, `rsver: 1.94.0`, `rssdkver: 27.0.0`
+
+Note: the wasm hash is sensitive to source line numbers (panic `Location`
+data is embedded), so only builds from the exact commit above reproduce these
+hashes. Reproducibility was verified by rebuilding from a clean `out/`.
+
+| Component | Cargo package | Bytes | SHA-256 / network WASM hash |
+|---|---|---:|---|
+| Smart wallet | `smart-wallet` | 29,275 | `84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319` |
+| Sample policy | `sample-policy` | 13,064 | `e74af5355f933f2c3421845178ca789c9bcf3ea7612a7c9966b9b57f26e59aed` |
+| Example contract | `example-contract` | 1,047 | `47a3326360bdce2ca360ed1b226ad636e14ac698f63efc11ab28e0d41f1f76aa` |
+
+The smart wallet WASM is uploaded but never deployed as a singleton: every
+user wallet deploys its own instance with a `Signer` constructor argument.
+The sample policy demonstrates the v1 policy lifecycle
+(`install`/`uninstall`/`policy__`) as a cumulative rolling-window spending
+allowance. The example contract is a test fixture (deploy-path and
+multi-transfer auth exercises); it is uploaded for completeness but nothing
+depends on it. The example-contract WASM is byte-identical to the pre-audit
+build (its source was untouched by the audit fixes), so its hash and upload
+are unchanged.
+
+## Testnet
+
+Upload source: `passkey-kit-deployer`
+(`GBUOCX45SICUYPFQG2YYQN2VTBDVG5EBS7Q4AFKAMMZIRR77CE6WHRF6`), funded via
+friendbot. Network: Test SDF Network ; September 2015.
+
+| Component | Upload transaction |
+|---|---|
+| Smart wallet | `ceb4ed26734d4e16344ddc713fe19f1a1c8cd814fcddca56d685f64fb0ae70ba` |
+| Sample policy | `2f36077bc6faf9bc8df1c58bfc1ee4c55079c762844e998da92ee4fd75ab094c` |
+| Example contract | `9d4da6b0992de465154ffea9dca3ea3e72948b0f706ec7e5a7f920dc4ddb2de7` (unchanged since A3) |
+
+### Live smoke
+
+A wallet instance was deployed from the FINAL smart-wallet WASM with an
+Ed25519 constructor signer (tx
+`4a9ff09bfad96cf5398bbac973714690b5d4915c332292dc67c173fd332ad95a`):
+
+- Instance: `CCK7VZBYMIIL7VBSEIORYQ4BTBZCKDKPNHPTYKQCRW4JO7L2IFW3X6WA`
+- `get_signer({"Ed25519": })` returned
+ `{"Ed25519":[[null],[null]]}` — the constructor-stored signer, unlimited,
+ no expiration.
+
+### Verification
+
+Every uploaded WASM was fetched back by hash
+(`stellar contract fetch --wasm-hash --network testnet`) and
+re-hashed with `shasum -a 256`. All three fetched hashes matched the local
+artifacts byte-for-byte.
+
+## Mainnet
+
+Not deployed. Mainnet upload is an orchestrator-gated endgame step and will
+be recorded in a follow-up manifest after the audit gate passes.
+
+## Deterministic wallet address derivation (NORMATIVE)
+
+Every passkey-kit wallet address is derived from the WebAuthn credential id
+(`keyId`) alone — both indexer backends and `connectWallet` reverse lookup
+depend on this exact tuple. **None of these inputs may ever change:**
+
+```text
+contractId = sha256(XDR(HashIdPreimage::EnvelopeTypeContractId {
+ networkId: sha256(network passphrase),
+ contractIdPreimage: ContractIdPreimageFromAddress {
+ address: G-address of the canonical deployer keypair,
+ salt: sha256(keyId),
+ },
+}))
+```
+
+- Canonical deployer keypair: `Keypair.fromRawEd25519Seed(sha256(utf8("kalepail")))`
+ → `GC2C7AWLS2FMFTQAHW3IBUB4ZXVP4E37XNLEF2IK7IVXBB6CMEPCSXFO`.
+ The SDK exposes a `deploySource` override, but the default MUST remain this
+ keypair or previously created wallets become unreachable by derivation.
+- The WASM hash is deliberately NOT part of the preimage: contract upgrades
+ do not move wallet addresses, and the same `keyId` derives the same address
+ across contract versions.
+- **Security consequence (audit F7)**: because the deployer is public and the
+ executable is not bound by the preimage, anyone who learns a `keyId` can
+ front-run the derived address with arbitrary code. Clients MUST verify
+ ownership before trusting a derived or reverse-looked-up address:
+ 1. the `keyId` is an actual stored signer (`get_signer` returns a value), and
+ 2. (recommended) the instance executable hash is on the known-hash list
+ from this manifest (or its legacy predecessor below).
+
+## Legacy (pre-1.0) build
+
+The pre-overhaul contract (soroban-sdk 23, `sw_v1` tuple events, errors 1-9,
+ledger-sequence expirations) has canonical WASM hash:
+
+```text
+e45c42b944a767bd5f37f8c4a469b48917d28e23481dbfd550419c84cdacde92
+```
+
+Wallets deployed from it remain live on both networks and derive from the
+SAME derivation tuple above (the tuple predates v1 and is unchanged). v1 is
+forward-only: no compatibility shims exist, and legacy wallets interact only
+with legacy tooling — but a legacy wallet can be upgraded in place to a v1
+hash via its own auth (`update_contract_code` on legacy, `upgrade` from then
+on), keeping its address.
diff --git a/PROPOSAL.md b/docs/history/PROPOSAL.md
similarity index 97%
rename from PROPOSAL.md
rename to docs/history/PROPOSAL.md
index b58f3f0..3f55c57 100644
--- a/PROPOSAL.md
+++ b/docs/history/PROPOSAL.md
@@ -1,3 +1,15 @@
+
+
# Smart wallet contract interface
With the release of [Protocol 21](https://stellar.org/blog/developers/announcing-protocol-21) (and specifically the inclusion of the secp256r1 verification curve) Soroban now has tremendous first class support for passkey powered smart wallets.
diff --git a/docs/migration-v1.md b/docs/migration-v1.md
new file mode 100644
index 0000000..2e225eb
--- /dev/null
+++ b/docs/migration-v1.md
@@ -0,0 +1,227 @@
+# Migrating to `passkey-kit` v1
+
+v1 is a ground-up overhaul of the contract, SDK, and services. It has **no backwards-compatibility layer** — every change below is a clean cut from the `0.12.x` line. If you only ever call `connectWallet()` and submit through `PasskeyServer`, the two changes that will touch your code are the **signing API** (a `Signer` instance instead of an options object) and the **`TransactionResult`** discriminated union.
+
+> [!IMPORTANT]
+> **Contract compatibility.** v1 is a new on-chain contract (new WASM hash, renumbered errors, new event schema, timestamp expirations). Wallets deployed from the pre-1.0 contract remain live and keep their addresses (the [derivation tuple](./deployments-testnet-2026-07-11.md#deterministic-wallet-address-derivation-normative) is unchanged), but they run the legacy code until upgraded in place. A v1 SDK talks to v1 wallets; it still *decodes* legacy error codes (family `SmartWalletLegacy`) so failures from a legacy wallet are legible.
+
+## Contents
+
+- [Signing pipeline](#signing-pipeline)
+- [Results & error handling](#results--error-handling)
+- [Errors](#errors)
+- [Configuration](#configuration)
+- [Signer model & expiration](#signer-model--expiration)
+- [Storage adapters](#storage-adapters)
+- [Indexer & discovery](#indexer--discovery)
+- [Packaging & imports](#packaging--imports)
+- [Removed exports](#removed-exports)
+- [A/B gap analysis](#ab-gap-analysis)
+- [Contract-side changes](#contract-side-changes)
+- [Behavior changes](#behavior-changes)
+
+---
+
+## Signing pipeline
+
+**`sign` / `signAuthEntry` now take a typed `Signer` instance** instead of a mutually-exclusive `{ keyId | keypair | policy }` options object.
+
+```ts
+// Before (0.12.x)
+await kit.sign(txn, { keyId }); // passkey
+await kit.sign(txn, { keypair }); // Ed25519
+await kit.sign(txn, { policy }); // policy
+await kit.sign(txn, { keyId: "any", expiration }); // any passkey + explicit expiration
+
+// After (v1)
+import { PasskeySigner, Ed25519Signer, PolicySigner } from "passkey-kit";
+
+await kit.sign(txn); // connected passkey (default)
+await kit.sign(txn, new PasskeySigner(keyId)); // specific passkey
+await kit.sign(txn, new Ed25519Signer(keypair)); // Ed25519
+await kit.sign(txn, new PolicySigner(policy)); // policy
+await kit.sign(txn, new PasskeySigner("any"), { expiration }); // any passkey + expiration
+```
+
+Notes:
+
+- The per-call options object is now just `{ expiration?: number }`. Per-call `rpId` is gone — `rpId` moved to the `PasskeyKit` constructor (a single source of truth).
+- `Ed25519Signer.fromSecret("S…")` builds a signer from a secret key (throws `ValidationError` on an invalid key).
+- Multi-sign by calling `sign` once per signer; each merges into the flat `Signatures` map, now sorted in Soroban **host order** (was a `localeCompare` approximation that could produce a map the host rejected).
+
+**`sign` takes a single `AssembledTransaction`.** The old `AssembledTransaction | Tx | string` tri-input silently dropped memo/fee/operations on its fallback path. If you hold XDR, rebuild first:
+
+```ts
+// Before: await kit.sign(xdrString)
+// After:
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract";
+const txn = AssembledTransaction.fromXDR(options, xdrString, spec);
+await kit.sign(txn);
+```
+
+## Results & error handling
+
+**`TransactionResult` is now a discriminated union on `success`.** Narrow on `result.success` before reading `.error` or `.hash`.
+
+```ts
+// Before (0.12.x): an untyped { success, hash, error? } object; error was a string.
+const result = await server.send(txn);
+if (result.success) {
+ console.log(result.hash);
+} else {
+ console.error(result.error); // string
+}
+
+// After (v1)
+const result = await server.send(txn);
+if (result.success) {
+ // TransactionSuccess: { success: true; hash: string; ledger?; transactionId? }
+ console.log(result.hash);
+} else {
+ // TransactionFailure: { success: false; error: PasskeyKitError; hash? }
+ console.error(`[${result.error.code}] ${result.error.message}`);
+}
+```
+
+- `error` is now a **typed `PasskeyKitError`** (a `ContractError` when an on-chain code was decoded), not a string. Branch on `result.error.code`.
+- Success results have **no** `error` field; failure results have an **optional** `hash`.
+- New type exports: `TransactionSuccess`, `TransactionFailure`, `SubmissionMethod`.
+
+**Which methods return this vs. throw.** Only submission methods (`server.send`, `server.getTransaction`) return a `TransactionResult`. **Everything else throws** a typed `PasskeyKitError` subclass. A pending (non-terminal) relayer status is surfaced as a failure carrying `RELAYER_PENDING` — keep polling `getTransaction`; do not treat it as success.
+
+## Errors
+
+- All thrown errors are now `PasskeyKitError` subclasses with a numeric `code`: `ConfigurationError`, `WalletNotConnectedError`, `WalletOwnershipError`, `WebAuthnError`, `SigningError`, `SignerNotFoundError`, `SimulationError`, `SubmissionError`, `ValidationError`, `IndexerError`, `RelayerError`, `ContractError`. Codes are grouped by concern (`1xxx`–`9xxx`, `10000` for contract-level).
+- **New decoding API:** `decodeContractError(diagnostic)`, `contractErrorFromCode(code)`, `CONTRACT_ERROR_REGISTRY`, and types `ContractErrorFamily` / `ContractErrorInfo`.
+- **Contract error codes were renumbered to 100–129** (see [README → Contract error decoding](../README.md#contract-error-decoding)). The legacy 1–9 codes still decode (family `SmartWalletLegacy`), so a failure from a legacy wallet is still legible.
+
+```ts
+if (!result.success && result.error instanceof ContractError) {
+ switch (result.error.contractErrorName) {
+ case "SignerExpired": /* 102 */ break;
+ case "MissingContext": /* 110 */ break;
+ }
+}
+```
+
+## Configuration
+
+**`PasskeyKit` config** gains `rpId`, `deploySource`, and `storage`:
+
+```ts
+// Before
+new PasskeyKit({ rpcUrl, networkPassphrase, walletWasmHash, timeoutInSeconds, WebAuthn });
+
+// After
+new PasskeyKit({
+ rpcUrl, networkPassphrase, walletWasmHash,
+ rpId, // NEW: WebAuthn RP id (was read per sign()/connect() call)
+ deploySource, // NEW: S… secret for the fee payer (default = canonical deployer)
+ storage, // NEW: StorageAdapter for passkey records
+ timeoutInSeconds, WebAuthn,
+});
+```
+
+**`PasskeyServer` config is now nested** (was a flat bag of `relayer*`/`mercury*` keys):
+
+```ts
+// Before
+new PasskeyServer({
+ rpcUrl, relayerUrl, relayerApiKey,
+ mercuryProjectName, mercuryUrl, mercuryJwt, mercuryKey,
+});
+
+// After
+new PasskeyServer({
+ networkPassphrase, // NEW: now required
+ rpcUrl,
+ relayer: { baseUrl, apiKey, adminSecret?, timeout? },
+ mercury: { url, projectName, jwt?, apiKey? }, // supply jwt OR apiKey
+});
+```
+
+`networkPassphrase` is required. `relayer.baseUrl`/`apiKey` replace `relayerUrl`/`relayerApiKey`; `mercury.url`/`projectName`/`jwt`/`apiKey` replace the `mercury*` keys (`mercuryKey` → `mercury.apiKey`).
+
+## Signer model & expiration
+
+- **Expiration is a UNIX timestamp in seconds** (inclusive), not a ledger sequence number. Update any code that computed `latestLedger + N`; use `nowSeconds + N`.
+- **`SignerLimits::Some(empty map)` now means fail-closed (no permissions).** Pre-1.0 an empty map meant *unlimited*. If you passed an empty map to mean "unlimited", pass `undefined` instead.
+- **Deploy permission is decoupled from limits.** A limits entry for the wallet's own address no longer grants deploy permission; `CreateContract*` contexts require an unlimited (`undefined`-limits) signer. Granting a signer a limits entry for the wallet's own address grants it the full admin surface (it can add an unlimited signer) — treat that as full control.
+- **New `upgrade(newWasmHash)` wrapper** (contract `upgrade`, renamed from `update_contract_code`) and **new `getSigner(signerKey)`** read (contract `get_signer`).
+
+## Storage adapters
+
+The kit no longer expects apps to hand-roll `localStorage`. Import an adapter from the new `passkey-kit/storage` subpath and pass it as `storage`:
+
+```ts
+import { IndexedDBStorage } from "passkey-kit/storage";
+const kit = new PasskeyKit({ /* … */, storage: new IndexedDBStorage() });
+```
+
+`createWallet` then remembers the passkey → wallet record automatically, and `connectWallet` can resolve a wallet from local storage before falling back to an indexer.
+
+## Indexer & discovery
+
+- `PasskeyServer.getSigners` / `getContractId` keep their signatures, but the return row (the old `Signer` type) is renamed **`IndexedSigner`** (it collided with the bindings' `Signer` union).
+- A new `SignerIndexer` abstraction (`passkey-kit/server`: `MercuryIndexer`, `StellarIndexerBackend`; browser-safe types + `lookupWithRetry` from `passkey-kit`) replaces the Mercury-only coupling.
+- **The live Mercury query path is gated pending a decision** — see the [gap analysis](#ab-gap-analysis) below and [zephyr/README.md](../zephyr/README.md).
+
+## Packaging & imports
+
+- The package now ships **compiled `dist/`** (ESM + `.d.ts`) with an `exports` map. Remove any `transpilePackages: ["passkey-kit", "passkey-factory-sdk", …]` / bundler workaround you added for the old raw-TypeScript shipping.
+- `@stellar/stellar-sdk` is a **peer dependency** (`>=16.0.0`) — install it in your app.
+- Server-only code moved behind the `passkey-kit/server` subpath. Import `PasskeyServer` from `passkey-kit/server`, not `passkey-kit`, and never from browser code.
+
+```ts
+// Before
+import { PasskeyKit, PasskeyServer } from "passkey-kit";
+
+// After
+import { PasskeyKit } from "passkey-kit";
+import { PasskeyServer } from "passkey-kit/server"; // server-only
+```
+
+## Removed exports
+
+- **`passkey-factory-sdk`** — never a real package; the factory design it referenced was abandoned before v1. Remove it from imports and bundler config.
+- **`PasskeyServer` from the package root** — moved to `passkey-kit/server`.
+- **`mercuryKey` config key** — use `mercury.apiKey`.
+- The `Signer` **row type** exported for indexer results is renamed **`IndexedSigner`** (the name `Signer` now refers to the signing-pipeline interface).
+
+## A/B gap analysis
+
+An explicit accounting of capabilities the pre-1.0 version had that v1 changes, drops, or defers — and what to use instead.
+
+| Old capability | v1 status | What to do instead |
+|---|---|---|
+| `connectWallet({ walletPublicKey })` — resolve/connect a wallet by an Ed25519 `G…` key | **Removed.** `connectWallet` is passkey-ownership-based by design: it verifies the connecting `keyId` is a live secp256r1 signer. | For reverse lookup by an Ed25519 or policy signer, use `server.getContractId({ publicKey })` / `{ policy }`, then operate on that address. There is no "connect as an Ed25519 identity" — sign with an `Ed25519Signer` against a passkey-connected wallet. |
+| `sign(xdrString \| Tx)` — sign a raw XDR string or `Tx` | **Removed** (lossy fallback). | `AssembledTransaction.fromXDR(...)` first, then `sign(txn)`. |
+| Per-call `rpId` on `sign` / `connectWallet` | **Moved to the constructor.** | Set `rpId` once on `new PasskeyKit({ rpId })`. |
+| **Live signer discovery via Mercury** (`getSigners` / `getContractId`) | **Deferred** — the code path exists but the self-serve Zephyr query route Mercury exposed is retired; the backend is gated behind `zephyrExecuteConfirmed` pending a user decision (host on Mercury's Smart Account Indexer vs. self-deploy). | Reconnect via the deterministic `connectWallet()` path — it re-derives the address from the keyId and verifies ownership on-chain, needing **no** indexer, and is more robust than the old reverse-lookup. Full enumeration/reverse-lookup returns live data once the Mercury path is confirmed (see [zephyr/README.md](../zephyr/README.md)). |
+| Legacy `("sw_v1", …)` tuple events | **Replaced** by typed `#[contractevent]` events. | Consume the new `signer_added`/`signer_updated`/`signer_removed`/`upgraded` schema; the rewritten zephyr program already does. |
+| Raw-TypeScript package (import internal source files) | **Removed** — ships compiled `dist/`. | Use the public entry points (`.`, `./storage`, `./server`). |
+
+**Net:** v1 is a superset of the old *contract* surface (adds `upgrade` wrapping + `get_signer`), and a superset of the old *SDK* surface except for the three intentional API-shape changes above. The one true regression is **live server-side discovery**, which is deferred (not lost) pending a user-owned Mercury integration decision; the deterministic reconnect path covers the common case in the meantime.
+
+## Contract-side changes
+
+If you build against the contract directly (not just the SDK):
+
+- `__constructor(signer)` is the only init path (the `init` flag and un-authed first-`add_signer` are gone).
+- `update_contract_code` → `upgrade(new_wasm_hash)`; new `get_signer(signer_key) -> Option` view.
+- `SignerExpiration(Option)` is a UNIX timestamp; `SignerLimits::Some(empty)` is fail-closed; errors renumbered 100–129; events are `#[contractevent]` structs; policies gain `install`/`uninstall`.
+
+See the [CHANGELOG](../CHANGELOG.md#contract-smart-wallet-soroban-sdk-27) for the full list and [`contracts/smart-wallet-interface/src/`](../contracts/smart-wallet-interface/src) for the canonical interface.
+
+## Behavior changes
+
+| Situation | Before | After |
+|---|---|---|
+| Submission failure | `{ success: false, error: string }` | `{ success: false, error: PasskeyKitError }` |
+| Any non-submission failure | plain `Error` / failure object | typed `PasskeyKitError` subclass (thrown) |
+| `connectWallet` with a keyId not on the wallet | trusted the derived/looked-up address | throws `WalletOwnershipError` (verifies the keyId is a live signer) |
+| Empty `SignerLimits` map | unlimited | no permissions (fail-closed) |
+| Signer/signature expiration unit | ledger sequence | UNIX timestamp (seconds) |
+| WebAuthn challenge | fixed string | random 32 bytes |
+| `Signatures` map order | `localeCompare` | Soroban host ScVal order |
+| Address auth credentials | V1 | V2 (binds the wallet address; closes cross-wallet replay) |
diff --git a/docs/releasing.md b/docs/releasing.md
new file mode 100644
index 0000000..3349e41
--- /dev/null
+++ b/docs/releasing.md
@@ -0,0 +1,118 @@
+# Releasing the npm packages
+
+The repository publishes three packages. Release them in this order so each can resolve its workspace dependency to a version that already exists on npm:
+
+1. `passkey-kit-sdk` (generated smart-wallet bindings)
+2. `sac-sdk` (generated SEP-41 bindings)
+3. `passkey-kit` (the SDK — depends on both via `workspace:*`)
+
+The two binding packages are independent; publish them in either order, but both **before** `passkey-kit`. `passkey-kit`'s `dependencies` pin them as `workspace:*`, which pnpm rewrites to the concrete workspace version at pack time — that version must already be on npm for consumers to install.
+
+The versions checked into each `package.json` are authoritative; `npm view` is the source of truth for what is already published. Confirm both before publishing.
+
+| Package | Checked-in version |
+|---|---|
+| `passkey-kit-sdk` | `0.7.3` |
+| `sac-sdk` | `0.4.3` |
+| `passkey-kit` | `0.13.0` (v1 release — see [CHANGELOG](../CHANGELOG.md)) |
+
+> [!IMPORTANT]
+> Publishing is an **outward-facing, user-gated** step. Bump the versions intentionally, and have the person with npm access run the publish commands (they hold the credentials and the OTP device).
+
+## Prerequisites
+
+- Node.js 22 or newer
+- pnpm 10 or newer
+- Stellar CLI 27 or newer (only when regenerating bindings)
+- npm publish access to all three packages
+- A clean tracked Git worktree
+
+## 1. Authenticate & check the registry
+
+```bash
+npm login
+npm whoami
+npm view passkey-kit-sdk version
+npm view sac-sdk version
+npm view passkey-kit version
+```
+
+## 2. Regenerate & verify bindings
+
+Regenerate the bindings whenever the smart-wallet or SAC contract interface changes. Generation goes through `scripts/bindings/build.sh`; it regenerates directly into `packages/` from the canonical WASM and applies the post-generation patch pass (package README, `package.json` peer-demotion, `tsconfig`).
+
+```bash
+pnpm run bindings:regen # regenerate packages/*/src from the canonical WASM
+```
+
+Then prove the committed bindings match the canonical on-chain WASM:
+
+```bash
+pnpm run verify:bindings
+```
+
+`verify:bindings` (`scripts/bindings/verify.sh`) fetches the smart-wallet WASM by the pinned canonical hash recorded in [`deployments-testnet-2026-07-11.md`](./deployments-testnet-2026-07-11.md), regenerates to a temp dir, and diffs the ContractSpec base64 (the wasm-determined semantic content, ignoring CLI formatting). It exits nonzero on drift.
+
+> [!WARNING]
+> **Never hand-edit the generated bindings** to resolve drift. Fix it on the contract side, rebuild, re-pin the canonical hash in the deployments manifest, and regenerate. Hand-edits re-introduce drift that `verify:bindings` will flag.
+
+## 3. Validate
+
+```bash
+pnpm install --frozen-lockfile
+pnpm test --run
+pnpm run verify:bindings
+pnpm run build # build:bindings → tsc → verify-esm
+pnpm run build:demo # ensure the demo still builds against the SDK
+git diff --check
+git status --short
+```
+
+`pnpm run build` runs `build:bindings`, compiles the SDK to `dist/`, and runs the Node-ESM import smoke test (`verify-esm.mjs`). Commit any intended changes before continuing — publish from a clean tree.
+
+## 4. Authenticated dry run
+
+A dry run verifies npm authentication and shows the tarball contents and the versions that would publish, without uploading. Run it for each package from its directory:
+
+```bash
+pnpm --filter passkey-kit-sdk publish --dry-run --no-git-checks
+pnpm --filter sac-sdk publish --dry-run --no-git-checks
+pnpm publish --dry-run --no-git-checks # from the repo root: passkey-kit
+```
+
+Confirm the `files` whitelist (`dist`, `README.md`, `LICENCE`) is what ships, and that `passkey-kit`'s dry run resolved the `workspace:*` deps to the concrete binding versions.
+
+## 5. Publish
+
+Publish the bindings first, then the SDK. `prepublishOnly` on `passkey-kit` re-runs `verify:bindings` and `build` as a final gate.
+
+```bash
+# 1) bindings
+pnpm --filter passkey-kit-sdk publish --no-git-checks
+npm view passkey-kit-sdk version
+
+pnpm --filter sac-sdk publish --no-git-checks
+npm view sac-sdk version
+
+# 2) the SDK
+pnpm publish --no-git-checks # from the repo root
+npm view passkey-kit version
+npm view passkey-kit dependencies # confirm the binding versions resolved
+```
+
+If npm requires a one-time password, append `--otp ` to each `pnpm … publish` command:
+
+```bash
+pnpm --filter passkey-kit-sdk publish --no-git-checks --otp 123456
+```
+
+Use a **fresh** OTP for each publish (codes expire in ~30s). npm package versions are immutable — a re-run after a successful publish fails; check `npm view` before retrying.
+
+## Contract & indexer deploys (separate concerns)
+
+Publishing the npm packages does **not** deploy contracts, the indexer, or the workers. Those are separate, gated steps:
+
+- **Contract WASM** (smart-wallet upload, sample-policy deploy) and the canonical hashes: [`deployments-testnet-2026-07-11.md`](./deployments-testnet-2026-07-11.md). Every user wallet deploys its own instance via the SDK; the smart-wallet WASM is uploaded, never run as a singleton.
+- **Mercury (Zephyr) indexer** deploy/query tooling status (self-serve Zephyr retired; pending a hosting decision): [`zephyr/README.md`](../zephyr/README.md).
+- **Relayer-proxy worker** (Cloudflare): [`relayer-proxy/README.md`](../relayer-proxy/README.md) (`pnpm deploy` / `pnpm deploy:production`).
+- **Demo** (Cloudflare Pages): root `wrangler.toml`, `pnpm run deploy:demo` / `deploy:demo:prod`.
diff --git a/package.json b/package.json
index 8f6d2c0..7106b81 100644
--- a/package.json
+++ b/package.json
@@ -1,26 +1,52 @@
{
"name": "passkey-kit",
- "version": "0.12.0",
+ "version": "0.13.0",
"description": "A helper library for creating and using smart wallet accounts on the Stellar blockchain.",
- "author": "Tyler van der Hoeven",
+ "author": "Tyler van der Hoeven ",
"license": "MIT",
"type": "module",
- "main": "src/index.ts",
- "types": "types/index.d.ts",
+ "main": "dist/index.js",
+ "module": "dist/index.js",
+ "types": "dist/index.d.ts",
+ "sideEffects": false,
+ "exports": {
+ ".": {
+ "import": "./dist/index.js",
+ "types": "./dist/index.d.ts"
+ },
+ "./storage": {
+ "import": "./dist/storage/index.js",
+ "types": "./dist/storage/index.d.ts"
+ },
+ "./server": {
+ "import": "./dist/server.js",
+ "types": "./dist/server.d.ts"
+ }
+ },
+ "files": [
+ "dist",
+ "README.md",
+ "LICENCE"
+ ],
"scripts": {
+ "sync-version": "node scripts/sync-version.js",
+ "prebuild": "node scripts/sync-version.js",
+ "build:bindings": "pnpm --filter sac-sdk run build && pnpm --filter passkey-kit-sdk run build",
+ "bindings:regen": "bash scripts/bindings/build.sh",
+ "verify:bindings": "bash scripts/bindings/verify.sh",
+ "build": "pnpm run build:bindings && tsc && node scripts/verify-esm.mjs",
+ "verify:esm": "node scripts/verify-esm.mjs",
+ "test": "vitest",
+ "clean": "rm -rf dist packages/passkey-kit-sdk/dist packages/sac-sdk/dist",
"build:demo": "cd demo && pnpm --ignore-workspace install && pnpm run build",
"deploy:demo": "npx wrangler pages deploy",
- "deploy:demo:prod": "npx wrangler pages deploy --env production",
- "prepublishOnly": "pnpm run build",
- "build:sac": "pnpm --filter=sac-sdk run build",
- "build:pks": "pnpm --filter=passkey-kit-sdk run build",
- "build": "pnpm run build:sac && pnpm run build:pks && tsc",
- "ext:cp": "./clone-js-sdk.sh"
+ "deploy:demo:prod": "npx wrangler pages deploy --branch production",
+ "prepublishOnly": "pnpm run verify:bindings && pnpm run build"
},
"dependencies": {
- "@openzeppelin/relayer-plugin-channels": "^0.5.0",
- "@simplewebauthn/browser": "^13.2.0",
- "@stellar/stellar-sdk": "^14.2.0",
+ "@openzeppelin/relayer-plugin-channels": "^0.20.0",
+ "@simplewebauthn/browser": "^13.3.0",
+ "@stellar/stellar-sdk": "16.0.1",
"base64url": "^3.0.1",
"buffer": "^6.0.3",
"passkey-kit-sdk": "workspace:*",
@@ -28,18 +54,23 @@
},
"devDependencies": {
"@types/node": "^24.6.0",
- "typescript": "^5.9.2"
+ "fake-indexeddb": "^6.2.5",
+ "typescript": "^5.9.2",
+ "vitest": "^3.2.4"
+ },
+ "peerDependencies": {
+ "@stellar/stellar-sdk": ">=16.0.0"
},
"pnpm": {
"overrides": {
"@stellar/stellar-sdk": "$@stellar/stellar-sdk"
- }
+ },
+ "onlyBuiltDependencies": [
+ "esbuild"
+ ]
},
- "workspaces": [
- "packages/*"
- ],
- "engine": {
- "node": ">=20"
+ "engines": {
+ "node": ">=22.0.0"
},
"repository": {
"type": "git",
diff --git a/packages/passkey-kit-sdk/README.md b/packages/passkey-kit-sdk/README.md
index 1529c74..40d8a97 100644
--- a/packages/passkey-kit-sdk/README.md
+++ b/packages/passkey-kit-sdk/README.md
@@ -1,6 +1,6 @@
-# passkey-kit-sdk JS
+# pks-gen JS
-JS library for interacting with [Soroban](https://soroban.stellar.org/) smart contract `passkey-kit-sdk` via Soroban RPC.
+JS library for interacting with [Soroban](https://soroban.stellar.org/) smart contract `pks-gen` via Soroban RPC.
This library was automatically generated by Soroban CLI using a command similar to:
@@ -9,7 +9,7 @@ soroban contract bindings ts \
--rpc-url INSERT_RPC_URL_HERE \
--network-passphrase "INSERT_NETWORK_PASSPHRASE_HERE" \
--contract-id INSERT_CONTRACT_ID_HERE \
- --output-dir ./path/to/passkey-kit-sdk
+ --output-dir ./path/to/pks-gen
```
The network passphrase and contract ID are exported from [index.ts](./src/index.ts) in the `networks` constant. If you are the one who generated this library and you know that this contract is also deployed to other networks, feel free to update `networks` with other valid options. This will help your contract consumers use this library more easily.
@@ -22,7 +22,7 @@ But you don't need to publish this library to NPM to use it. You can add it to y
```json
"dependencies": {
- "passkey-kit-sdk": "./path/to/this/folder"
+ "pks-gen": "./path/to/this/folder"
}
```
@@ -30,7 +30,7 @@ However, we've actually encountered [frustration](https://github.com/stellar/sor
```json
"scripts": {
- "postinstall": "soroban contract bindings ts --rpc-url INSERT_RPC_URL_HERE --network-passphrase \"INSERT_NETWORK_PASSPHRASE_HERE\" --id INSERT_CONTRACT_ID_HERE --name passkey-kit-sdk"
+ "postinstall": "soroban contract bindings ts --rpc-url INSERT_RPC_URL_HERE --network-passphrase \"INSERT_NETWORK_PASSPHRASE_HERE\" --id INSERT_CONTRACT_ID_HERE --name pks-gen"
}
```
@@ -41,7 +41,7 @@ Obviously you need to adjust the above command based on the actual command you u
Now that you have your library up-to-date and added to your project, you can import it in a file and see inline documentation for all of its exported methods:
```js
-import { Contract, networks } from "passkey-kit-sdk"
+import { Contract, networks } from "pks-gen"
const contract = new Contract({
...networks.futurenet, // for example; check which networks this library exports
diff --git a/packages/passkey-kit-sdk/package.json b/packages/passkey-kit-sdk/package.json
index 15164ec..f9d2000 100644
--- a/packages/passkey-kit-sdk/package.json
+++ b/packages/passkey-kit-sdk/package.json
@@ -1,18 +1,36 @@
{
- "version": "0.7.2",
+ "version": "0.7.3",
"name": "passkey-kit-sdk",
"type": "module",
- "main": "src/index.ts",
- "types": "types/index.d.ts",
+ "main": "dist/index.js",
+ "module": "dist/index.js",
+ "types": "dist/index.d.ts",
+ "sideEffects": false,
+ "exports": {
+ ".": {
+ "import": "./dist/index.js",
+ "types": "./dist/index.d.ts"
+ }
+ },
+ "files": [
+ "dist",
+ "README.md"
+ ],
"scripts": {
"prepublishOnly": "pnpm run build",
"build": "tsc"
},
"dependencies": {
- "@stellar/stellar-sdk": "^14.2.0",
"buffer": "^6.0.3"
},
+ "peerDependencies": {
+ "@stellar/stellar-sdk": ">=16.0.0"
+ },
"devDependencies": {
+ "@stellar/stellar-sdk": "16.0.1",
"typescript": "^5.9.2"
+ },
+ "engines": {
+ "node": ">=22.0.0"
}
}
diff --git a/packages/passkey-kit-sdk/src/index.ts b/packages/passkey-kit-sdk/src/index.ts
index c405224..edaed05 100644
--- a/packages/passkey-kit-sdk/src/index.ts
+++ b/packages/passkey-kit-sdk/src/index.ts
@@ -1,132 +1,232 @@
import { Buffer } from "buffer";
+import { Address } from "@stellar/stellar-sdk";
import {
AssembledTransaction,
Client as ContractClient,
ClientOptions as ContractClientOptions,
MethodOptions,
+ Result,
Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from "@stellar/stellar-sdk/contract";
import type {
u32,
+ i32,
+ u64,
+ i64,
+ u128,
+ i128,
+ u256,
+ i256,
Option,
-} from '@stellar/stellar-sdk/minimal/contract';
+ Timepoint,
+ Duration,
+} from "@stellar/stellar-sdk/contract";
+export * from "@stellar/stellar-sdk";
+export * as contract from "@stellar/stellar-sdk/contract";
+export * as rpc from "@stellar/stellar-sdk/rpc";
-if (typeof window !== 'undefined') {
+if (typeof window !== "undefined") {
//@ts-ignore Buffer exists
window.Buffer = window.Buffer || Buffer;
}
+
+
+
+/**
+ * Contract errors.
+ *
+ * Deliberately renumbered for the v1 interface so the error space is disjoint
+ * from the legacy (pre-1.0) contract's 1-9 range. A client decoding an error
+ * code < 100 is talking to a legacy wallet.
+ *
+ * Ranges:
+ * - 100-109: signer storage / management
+ * - 110-119: auth (`__check_auth`)
+ * - 120-129: WebAuthn (secp256r1) verification
+ */
export const Errors = {
- 1: { message: "NotFound" },
- 2: { message: "AlreadyExists" },
- 3: { message: "MissingContext" },
- 4: { message: "SignerExpired" },
- 5: { message: "FailedSignerLimits" },
- 6: { message: "FailedPolicySignerLimits" },
- 7: { message: "SignatureKeyValueMismatch" },
- 8: { message: "ClientDataJsonChallengeIncorrect" },
- 9: { message: "JsonParseError" }
+ /**
+ * The requested signer does not exist on this smart wallet.
+ */
+ 100: {message:"SignerNotFound"},
+ /**
+ * `add_signer` was called with a signer key that already exists.
+ */
+ 101: {message:"SignerAlreadyExists"},
+ /**
+ * The signer's expiration timestamp is in the past.
+ */
+ 102: {message:"SignerExpired"},
+ /**
+ * No signer in the signatures map is permitted to authorize one of the
+ * requested auth contexts.
+ */
+ 110: {message:"MissingContext"},
+ /**
+ * A signature's variant does not match the stored signer it claims to be
+ * for (e.g. an Ed25519 signature submitted for a Policy signer key).
+ */
+ 111: {message:"SignatureKeyValueMismatch"},
+ /**
+ * clientDataJSON exceeds the 1024 byte parse buffer.
+ */
+ 120: {message:"ClientDataJsonTooLarge"},
+ /**
+ * clientDataJSON is not parseable JSON (or is missing required fields).
+ */
+ 121: {message:"ClientDataJsonParseError"},
+ /**
+ * The challenge in clientDataJSON does not match the base64url-encoded
+ * signature payload. This binds the WebAuthn assertion to the Soroban
+ * authorization entry and MUST NOT be weakened.
+ */
+ 122: {message:"ClientDataJsonChallengeIncorrect"},
+ /**
+ * clientDataJSON `type` is not "webauthn.get".
+ */
+ 123: {message:"InvalidWebAuthnType"},
+ /**
+ * authenticatorData is shorter than the WebAuthn minimum of 37 bytes
+ * (rpIdHash 32 + flags 1 + signCount 4).
+ */
+ 124: {message:"InvalidAuthenticatorData"},
+ /**
+ * The authenticator did not set the User Present (UP) flag.
+ *
+ * UP-only is the deliberate default (audit FIX-7). Requiring UP keeps
+ * silent, non-interactive assertions out while staying compatible with
+ * authenticators that cannot do User Verification (UV — biometric/PIN).
+ * UV is therefore NOT required by this contract. A deployment that wants
+ * UV-required assertions should enforce it at the client/relayer layer,
+ * or via a future per-signer flag (which would be a signer-model change,
+ * not a change to this check); the contract cannot upgrade UP-only
+ * signers to UV-required retroactively without such a flag.
+ */
+ 125: {message:"UserPresenceRequired"}
}
-export type SignerExpiration = readonly [Option];
+
+/**
+ * Full signer description used by `__constructor`, `add_signer` and
+ * `update_signer`.
+ */
+export type Signer = {tag: "Policy", values: readonly [string, SignerExpiration, SignerLimits, SignerStorage]} | {tag: "Ed25519", values: readonly [Buffer, SignerExpiration, SignerLimits, SignerStorage]} | {tag: "Secp256r1", values: readonly [Buffer, Buffer, SignerExpiration, SignerLimits, SignerStorage]};
+
+/**
+ * A signature entry in the signatures map. `Policy` carries no signature
+ * material: inclusion of the policy key authorizes an on-chain `policy__`
+ * check instead.
+ */
+export type Signature = {tag: "Policy", values: void} | {tag: "Ed25519", values: readonly [Buffer]} | {tag: "Secp256r1", values: readonly [Secp256r1Signature]};
+
+/**
+ * Storage key identifying a signer. Secp256r1 carries the WebAuthn
+ * credential id (`keyId`).
+ */
+export type SignerKey = {tag: "Policy", values: readonly [string]} | {tag: "Ed25519", values: readonly [Buffer]} | {tag: "Secp256r1", values: readonly [Buffer]};
+
+/**
+ * Stored signer value. Secp256r1 carries the SEC-1 uncompressed public key.
+ */
+export type SignerVal = {tag: "Policy", values: readonly [SignerExpiration, SignerLimits]} | {tag: "Ed25519", values: readonly [SignerExpiration, SignerLimits]} | {tag: "Secp256r1", values: readonly [Buffer, SignerExpiration, SignerLimits]};
+
+/**
+ * The `__check_auth` signature object: a map of signer keys to signatures.
+ * Map ordering is the host's ScVal ordering. EVERY entry must verify (pass
+ * 2 of `__check_auth`) — include only signatures that are needed.
+ */
+export type Signatures = readonly [Map];
+
+/**
+ * Restrictions on which auth contexts a signer may authorize.
+ *
+ * - `None`: unlimited. The signer can authorize anything, including
+ * `CreateContract*` (deploy) contexts and this wallet's own admin
+ * functions.
+ * - `Some(empty map)`: NO permissions (fail-closed). The signer can authorize
+ * nothing except removing itself (see below). v1 breaking change: pre-1.0
+ * an empty map meant unlimited, leaving two unlimited encodings and no
+ * "none" encoding.
+ * - `Some({address -> None})`: the signer may authorize any invocation of
+ * contract `address`, with no co-signers required.
+ * - `Some({address -> Some([keys])})`: the signer may authorize invocations
+ * of contract `address` only if every listed key also APPROVES. The listed
+ * keys are required CO-SIGNERS.
+ *
+ * ## Required co-signers are scope-independent approvers (audit FIX-5)
+ *
+ * A required co-signer's OWN `SignerLimits` do NOT constrain its co-signer
+ * role — a key's limits govern only its INDEPENDENT authority (whether it can
+ * cover a context on its own). This is symmetric across key kinds:
+ *
+ * -
+ */
export type SignerLimits = readonly [Option>>>];
-export type SignerStorage = { tag: "Persistent", values: void } | { tag: "Temporary", values: void };
-export type Signer = { tag: "Policy", values: readonly [string, SignerExpiration, SignerLimits, SignerStorage] } | { tag: "Ed25519", values: readonly [Buffer, SignerExpiration, SignerLimits, SignerStorage] } | { tag: "Secp256r1", values: readonly [Buffer, Buffer, SignerExpiration, SignerLimits, SignerStorage] };
-export type SignerKey = { tag: "Policy", values: readonly [string] } | { tag: "Ed25519", values: readonly [Buffer] } | { tag: "Secp256r1", values: readonly [Buffer] };
-export type SignerVal = { tag: "Policy", values: readonly [SignerExpiration, SignerLimits] } | { tag: "Ed25519", values: readonly [SignerExpiration, SignerLimits] } | { tag: "Secp256r1", values: readonly [Buffer, SignerExpiration, SignerLimits] };
+/**
+ * Which durability a signer entry is stored under. At most one entry exists
+ * per signer key; lookups check Temporary before Persistent.
+ */
+export type SignerStorage = {tag: "Persistent", values: void} | {tag: "Temporary", values: void};
+
+/**
+ * Optional expiration for a signer as a UNIX timestamp in seconds, INCLUSIVE:
+ * the signer is valid while `ledger timestamp <= expiration` and expired once
+ * `ledger timestamp > expiration`. `None` never expires.
+ *
+ * v1 breaking change: this was a ledger sequence number pre-1.0. Timestamps
+ * don't drift with changes to ledger close time (e.g. CAP-0070 dynamic
+ * timing), which ledger-sequence expirations did.
+ */
+export type SignerExpiration = readonly [Option];
+
+
+/**
+ * A WebAuthn assertion over the Soroban authorization payload. The signed
+ * message is `authenticator_data || sha256(client_data_json)` and the
+ * payload binding lives in clientDataJSON's `challenge` field.
+ */
export interface Secp256r1Signature {
authenticator_data: Buffer;
client_data_json: Buffer;
signature: Buffer;
}
-export type Signature = { tag: "Policy", values: void } | { tag: "Ed25519", values: readonly [Buffer] } | { tag: "Secp256r1", values: readonly [Secp256r1Signature] };
-export type Signatures = readonly [Map];
-export interface Client {
- /**
- * Construct and simulate a add_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
- */
- add_signer: ({ signer }: { signer: Signer }, options?: {
- /**
- * The fee to pay for the transaction. Default: BASE_FEE
- */
- fee?: number;
- /**
- * The maximum amount of time to wait for the transaction to complete. Default: DEFAULT_TIMEOUT
- */
- timeoutInSeconds?: number;
- /**
- * Whether to automatically simulate the transaction when constructing the AssembledTransaction. Default: true
- */
- simulate?: boolean;
- }) => Promise>
+
+export interface Client {
/**
- * Construct and simulate a update_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
+ * Construct and simulate a upgrade transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
*/
- update_signer: ({ signer }: { signer: Signer }, options?: {
- /**
- * The fee to pay for the transaction. Default: BASE_FEE
- */
- fee?: number;
+ upgrade: ({new_wasm_hash}: {new_wasm_hash: Buffer}, options?: MethodOptions) => Promise>>
- /**
- * The maximum amount of time to wait for the transaction to complete. Default: DEFAULT_TIMEOUT
- */
- timeoutInSeconds?: number;
+ /**
+ * Construct and simulate a add_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
+ */
+ add_signer: ({signer}: {signer: Signer}, options?: MethodOptions) => Promise>>
- /**
- * Whether to automatically simulate the transaction when constructing the AssembledTransaction. Default: true
- */
- simulate?: boolean;
- }) => Promise>
+ /**
+ * Construct and simulate a get_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
+ */
+ get_signer: ({signer_key}: {signer_key: SignerKey}, options?: MethodOptions) => Promise>>
/**
* Construct and simulate a remove_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
*/
- remove_signer: ({ signer_key }: { signer_key: SignerKey }, options?: {
- /**
- * The fee to pay for the transaction. Default: BASE_FEE
- */
- fee?: number;
-
- /**
- * The maximum amount of time to wait for the transaction to complete. Default: DEFAULT_TIMEOUT
- */
- timeoutInSeconds?: number;
-
- /**
- * Whether to automatically simulate the transaction when constructing the AssembledTransaction. Default: true
- */
- simulate?: boolean;
- }) => Promise>
-
- /**
- * Construct and simulate a update_contract_code transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
- */
- update_contract_code: ({ hash }: { hash: Buffer }, options?: {
- /**
- * The fee to pay for the transaction. Default: BASE_FEE
- */
- fee?: number;
-
- /**
- * The maximum amount of time to wait for the transaction to complete. Default: DEFAULT_TIMEOUT
- */
- timeoutInSeconds?: number;
-
- /**
- * Whether to automatically simulate the transaction when constructing the AssembledTransaction. Default: true
- */
- simulate?: boolean;
- }) => Promise>
+ remove_signer: ({signer_key}: {signer_key: SignerKey}, options?: MethodOptions) => Promise>>
+
+ /**
+ * Construct and simulate a update_signer transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.
+ */
+ update_signer: ({signer}: {signer: Signer}, options?: MethodOptions) => Promise>>
+
}
export class Client extends ContractClient {
static async deploy(
- /** Constructor/Initialization Args for the contract's `__constructor` method */
- { signer }: { signer: Signer },
+ /** Constructor/Initialization Args for the contract's `__constructor` method */
+ {signer}: {signer: Signer},
/** Options for initializing a Client as well as for calling a method, with extras specific to deploying. */
options: MethodOptions &
Omit & {
@@ -136,36 +236,41 @@ export class Client extends ContractClient {
salt?: Buffer | Uint8Array;
/** The format used to decode `wasmHash`, if it's provided as a string. */
format?: "hex" | "base64";
- address?: string;
}
): Promise> {
- return ContractClient.deploy({ signer }, options)
+ return ContractClient.deploy({signer}, options)
}
constructor(public readonly options: ContractClientOptions) {
super(
- new ContractSpec(["AAAABAAAAAAAAAAAAAAABUVycm9yAAAAAAAACQAAAAAAAAAITm90Rm91bmQAAAABAAAAAAAAAA1BbHJlYWR5RXhpc3RzAAAAAAAAAgAAAAAAAAAOTWlzc2luZ0NvbnRleHQAAAAAAAMAAAAAAAAADVNpZ25lckV4cGlyZWQAAAAAAAAEAAAAAAAAABJGYWlsZWRTaWduZXJMaW1pdHMAAAAAAAUAAAAAAAAAGEZhaWxlZFBvbGljeVNpZ25lckxpbWl0cwAAAAYAAAAAAAAAGVNpZ25hdHVyZUtleVZhbHVlTWlzbWF0Y2gAAAAAAAAHAAAAAAAAACBDbGllbnREYXRhSnNvbkNoYWxsZW5nZUluY29ycmVjdAAAAAgAAAAAAAAADkpzb25QYXJzZUVycm9yAAAAAAAJ",
- "AAAAAQAAAAAAAAAAAAAAEFNpZ25lckV4cGlyYXRpb24AAAABAAAAAAAAAAEwAAAAAAAD6AAAAAQ=",
- "AAAAAQAAAAAAAAAAAAAADFNpZ25lckxpbWl0cwAAAAEAAAAAAAAAATAAAAAAAAPoAAAD7AAAABMAAAPoAAAD6gAAB9AAAAAJU2lnbmVyS2V5AAAA",
- "AAAAAgAAAAAAAAAAAAAADVNpZ25lclN0b3JhZ2UAAAAAAAACAAAAAAAAAAAAAAAKUGVyc2lzdGVudAAAAAAAAAAAAAAAAAAJVGVtcG9yYXJ5AAAA",
- "AAAAAgAAAAAAAAAAAAAABlNpZ25lcgAAAAAAAwAAAAEAAAAAAAAABlBvbGljeQAAAAAABAAAABMAAAfQAAAAEFNpZ25lckV4cGlyYXRpb24AAAfQAAAADFNpZ25lckxpbWl0cwAAB9AAAAANU2lnbmVyU3RvcmFnZQAAAAAAAAEAAAAAAAAAB0VkMjU1MTkAAAAABAAAA+4AAAAgAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHMAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAABAAAAAAAAAAlTZWNwMjU2cjEAAAAAAAAFAAAADgAAA+4AAABBAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHMAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAA=",
- "AAAAAgAAAAAAAAAAAAAACVNpZ25lcktleQAAAAAAAAMAAAABAAAAAAAAAAZQb2xpY3kAAAAAAAEAAAATAAAAAQAAAAAAAAAHRWQyNTUxOQAAAAABAAAD7gAAACAAAAABAAAAAAAAAAlTZWNwMjU2cjEAAAAAAAABAAAADg==",
- "AAAAAgAAAAAAAAAAAAAACVNpZ25lclZhbAAAAAAAAAMAAAABAAAAAAAAAAZQb2xpY3kAAAAAAAIAAAfQAAAAEFNpZ25lckV4cGlyYXRpb24AAAfQAAAADFNpZ25lckxpbWl0cwAAAAEAAAAAAAAAB0VkMjU1MTkAAAAAAgAAB9AAAAAQU2lnbmVyRXhwaXJhdGlvbgAAB9AAAAAMU2lnbmVyTGltaXRzAAAAAQAAAAAAAAAJU2VjcDI1NnIxAAAAAAAAAwAAA+4AAABBAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHM=",
- "AAAAAQAAAAAAAAAAAAAAElNlY3AyNTZyMVNpZ25hdHVyZQAAAAAAAwAAAAAAAAASYXV0aGVudGljYXRvcl9kYXRhAAAAAAAOAAAAAAAAABBjbGllbnRfZGF0YV9qc29uAAAADgAAAAAAAAAJc2lnbmF0dXJlAAAAAAAD7gAAAEA=",
- "AAAAAgAAAAAAAAAAAAAACVNpZ25hdHVyZQAAAAAAAAMAAAAAAAAAAAAAAAZQb2xpY3kAAAAAAAEAAAAAAAAAB0VkMjU1MTkAAAAAAQAAA+4AAABAAAAAAQAAAAAAAAAJU2VjcDI1NnIxAAAAAAAAAQAAB9AAAAASU2VjcDI1NnIxU2lnbmF0dXJlAAA=",
- "AAAAAQAAAAAAAAAAAAAAClNpZ25hdHVyZXMAAAAAAAEAAAAAAAAAATAAAAAAAAPsAAAH0AAAAAlTaWduZXJLZXkAAAAAAAfQAAAACVNpZ25hdHVyZQAAAA==",
+ new ContractSpec([ "AAAAAAAAAAAAAAAHdXBncmFkZQAAAAABAAAAAAAAAA1uZXdfd2FzbV9oYXNoAAAAAAAD7gAAACAAAAABAAAD6QAAAAIAAAAD",
+ "AAAAAAAAAAAAAAAKYWRkX3NpZ25lcgAAAAAAAQAAAAAAAAAGc2lnbmVyAAAAAAfQAAAABlNpZ25lcgAAAAAAAQAAA+kAAAACAAAAAw==",
+ "AAAAAAAAAAAAAAAKZ2V0X3NpZ25lcgAAAAAAAQAAAAAAAAAKc2lnbmVyX2tleQAAAAAH0AAAAAlTaWduZXJLZXkAAAAAAAABAAAD6AAAB9AAAAAJU2lnbmVyVmFsAAAA",
+ "AAAAAAAAAAAAAAAMX19jaGVja19hdXRoAAAAAwAAAAAAAAARc2lnbmF0dXJlX3BheWxvYWQAAAAAAAPuAAAAIAAAAAAAAAAKc2lnbmF0dXJlcwAAAAAH0AAAAApTaWduYXR1cmVzAAAAAAAAAAAADWF1dGhfY29udGV4dHMAAAAAAAPqAAAH0AAAAAdDb250ZXh0AAAAAAEAAAPpAAAAAgAAAAM=",
"AAAAAAAAAAAAAAANX19jb25zdHJ1Y3RvcgAAAAAAAAEAAAAAAAAABnNpZ25lcgAAAAAH0AAAAAZTaWduZXIAAAAAAAA=",
- "AAAAAAAAAAAAAAAKYWRkX3NpZ25lcgAAAAAAAQAAAAAAAAAGc2lnbmVyAAAAAAfQAAAABlNpZ25lcgAAAAAAAA==",
- "AAAAAAAAAAAAAAANdXBkYXRlX3NpZ25lcgAAAAAAAAEAAAAAAAAABnNpZ25lcgAAAAAH0AAAAAZTaWduZXIAAAAAAAA=",
- "AAAAAAAAAAAAAAANcmVtb3ZlX3NpZ25lcgAAAAAAAAEAAAAAAAAACnNpZ25lcl9rZXkAAAAAB9AAAAAJU2lnbmVyS2V5AAAAAAAAAA==",
- "AAAAAAAAAAAAAAAUdXBkYXRlX2NvbnRyYWN0X2NvZGUAAAABAAAAAAAAAARoYXNoAAAD7gAAACAAAAAA",
- "AAAAAAAAAAAAAAAMX19jaGVja19hdXRoAAAAAwAAAAAAAAARc2lnbmF0dXJlX3BheWxvYWQAAAAAAAPuAAAAIAAAAAAAAAAKc2lnbmF0dXJlcwAAAAAH0AAAAApTaWduYXR1cmVzAAAAAAAAAAAADWF1dGhfY29udGV4dHMAAAAAAAPqAAAH0AAAAAdDb250ZXh0AAAAAAEAAAPpAAAD7QAAAAAAAAAD"]),
+ "AAAAAAAAAAAAAAANcmVtb3ZlX3NpZ25lcgAAAAAAAAEAAAAAAAAACnNpZ25lcl9rZXkAAAAAB9AAAAAJU2lnbmVyS2V5AAAAAAAAAQAAA+kAAAACAAAAAw==",
+ "AAAAAAAAAAAAAAANdXBkYXRlX3NpZ25lcgAAAAAAAAEAAAAAAAAABnNpZ25lcgAAAAAH0AAAAAZTaWduZXIAAAAAAAEAAAPpAAAAAgAAAAM=",
+ "AAAABAAAAVBDb250cmFjdCBlcnJvcnMuCgpEZWxpYmVyYXRlbHkgcmVudW1iZXJlZCBmb3IgdGhlIHYxIGludGVyZmFjZSBzbyB0aGUgZXJyb3Igc3BhY2UgaXMgZGlzam9pbnQKZnJvbSB0aGUgbGVnYWN5IChwcmUtMS4wKSBjb250cmFjdCdzIDEtOSByYW5nZS4gQSBjbGllbnQgZGVjb2RpbmcgYW4gZXJyb3IKY29kZSA8IDEwMCBpcyB0YWxraW5nIHRvIGEgbGVnYWN5IHdhbGxldC4KClJhbmdlczoKLSAxMDAtMTA5OiBzaWduZXIgc3RvcmFnZSAvIG1hbmFnZW1lbnQKLSAxMTAtMTE5OiBhdXRoIChgX19jaGVja19hdXRoYCkKLSAxMjAtMTI5OiBXZWJBdXRobiAoc2VjcDI1NnIxKSB2ZXJpZmljYXRpb24AAAAAAAAABUVycm9yAAAAAAAACwAAADlUaGUgcmVxdWVzdGVkIHNpZ25lciBkb2VzIG5vdCBleGlzdCBvbiB0aGlzIHNtYXJ0IHdhbGxldC4AAAAAAAAOU2lnbmVyTm90Rm91bmQAAAAAAGQAAAA+YGFkZF9zaWduZXJgIHdhcyBjYWxsZWQgd2l0aCBhIHNpZ25lciBrZXkgdGhhdCBhbHJlYWR5IGV4aXN0cy4AAAAAABNTaWduZXJBbHJlYWR5RXhpc3RzAAAAAGUAAAAxVGhlIHNpZ25lcidzIGV4cGlyYXRpb24gdGltZXN0YW1wIGlzIGluIHRoZSBwYXN0LgAAAAAAAA1TaWduZXJFeHBpcmVkAAAAAAAAZgAAAF1ObyBzaWduZXIgaW4gdGhlIHNpZ25hdHVyZXMgbWFwIGlzIHBlcm1pdHRlZCB0byBhdXRob3JpemUgb25lIG9mIHRoZQpyZXF1ZXN0ZWQgYXV0aCBjb250ZXh0cy4AAAAAAAAOTWlzc2luZ0NvbnRleHQAAAAAAG4AAACJQSBzaWduYXR1cmUncyB2YXJpYW50IGRvZXMgbm90IG1hdGNoIHRoZSBzdG9yZWQgc2lnbmVyIGl0IGNsYWltcyB0byBiZQpmb3IgKGUuZy4gYW4gRWQyNTUxOSBzaWduYXR1cmUgc3VibWl0dGVkIGZvciBhIFBvbGljeSBzaWduZXIga2V5KS4AAAAAAAAZU2lnbmF0dXJlS2V5VmFsdWVNaXNtYXRjaAAAAAAAAG8AAAAyY2xpZW50RGF0YUpTT04gZXhjZWVkcyB0aGUgMTAyNCBieXRlIHBhcnNlIGJ1ZmZlci4AAAAAABZDbGllbnREYXRhSnNvblRvb0xhcmdlAAAAAAB4AAAARWNsaWVudERhdGFKU09OIGlzIG5vdCBwYXJzZWFibGUgSlNPTiAob3IgaXMgbWlzc2luZyByZXF1aXJlZCBmaWVsZHMpLgAAAAAAABhDbGllbnREYXRhSnNvblBhcnNlRXJyb3IAAAB5AAAAtlRoZSBjaGFsbGVuZ2UgaW4gY2xpZW50RGF0YUpTT04gZG9lcyBub3QgbWF0Y2ggdGhlIGJhc2U2NHVybC1lbmNvZGVkCnNpZ25hdHVyZSBwYXlsb2FkLiBUaGlzIGJpbmRzIHRoZSBXZWJBdXRobiBhc3NlcnRpb24gdG8gdGhlIFNvcm9iYW4KYXV0aG9yaXphdGlvbiBlbnRyeSBhbmQgTVVTVCBOT1QgYmUgd2Vha2VuZWQuAAAAAAAgQ2xpZW50RGF0YUpzb25DaGFsbGVuZ2VJbmNvcnJlY3QAAAB6AAAALGNsaWVudERhdGFKU09OIGB0eXBlYCBpcyBub3QgIndlYmF1dGhuLmdldCIuAAAAE0ludmFsaWRXZWJBdXRoblR5cGUAAAAAewAAAGlhdXRoZW50aWNhdG9yRGF0YSBpcyBzaG9ydGVyIHRoYW4gdGhlIFdlYkF1dGhuIG1pbmltdW0gb2YgMzcgYnl0ZXMKKHJwSWRIYXNoIDMyICsgZmxhZ3MgMSArIHNpZ25Db3VudCA0KS4AAAAAAAAYSW52YWxpZEF1dGhlbnRpY2F0b3JEYXRhAAAAfAAAAlpUaGUgYXV0aGVudGljYXRvciBkaWQgbm90IHNldCB0aGUgVXNlciBQcmVzZW50IChVUCkgZmxhZy4KClVQLW9ubHkgaXMgdGhlIGRlbGliZXJhdGUgZGVmYXVsdCAoYXVkaXQgRklYLTcpLiBSZXF1aXJpbmcgVVAga2VlcHMKc2lsZW50LCBub24taW50ZXJhY3RpdmUgYXNzZXJ0aW9ucyBvdXQgd2hpbGUgc3RheWluZyBjb21wYXRpYmxlIHdpdGgKYXV0aGVudGljYXRvcnMgdGhhdCBjYW5ub3QgZG8gVXNlciBWZXJpZmljYXRpb24gKFVWIOKAlCBiaW9tZXRyaWMvUElOKS4KVVYgaXMgdGhlcmVmb3JlIE5PVCByZXF1aXJlZCBieSB0aGlzIGNvbnRyYWN0LiBBIGRlcGxveW1lbnQgdGhhdCB3YW50cwpVVi1yZXF1aXJlZCBhc3NlcnRpb25zIHNob3VsZCBlbmZvcmNlIGl0IGF0IHRoZSBjbGllbnQvcmVsYXllciBsYXllciwKb3IgdmlhIGEgZnV0dXJlIHBlci1zaWduZXIgZmxhZyAod2hpY2ggd291bGQgYmUgYSBzaWduZXItbW9kZWwgY2hhbmdlLApub3QgYSBjaGFuZ2UgdG8gdGhpcyBjaGVjayk7IHRoZSBjb250cmFjdCBjYW5ub3QgdXBncmFkZSBVUC1vbmx5CnNpZ25lcnMgdG8gVVYtcmVxdWlyZWQgcmV0cm9hY3RpdmVseSB3aXRob3V0IHN1Y2ggYSBmbGFnLgAAAAAAFFVzZXJQcmVzZW5jZVJlcXVpcmVkAAAAfQ==",
+ "AAAAAgAAAFJGdWxsIHNpZ25lciBkZXNjcmlwdGlvbiB1c2VkIGJ5IGBfX2NvbnN0cnVjdG9yYCwgYGFkZF9zaWduZXJgIGFuZApgdXBkYXRlX3NpZ25lcmAuAAAAAAAAAAAABlNpZ25lcgAAAAAAAwAAAAEAAAAAAAAABlBvbGljeQAAAAAABAAAABMAAAfQAAAAEFNpZ25lckV4cGlyYXRpb24AAAfQAAAADFNpZ25lckxpbWl0cwAAB9AAAAANU2lnbmVyU3RvcmFnZQAAAAAAAAEAAAAAAAAAB0VkMjU1MTkAAAAABAAAA+4AAAAgAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHMAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAABAAAAAAAAAAlTZWNwMjU2cjEAAAAAAAAFAAAADgAAA+4AAABBAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHMAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAA=",
+ "AAAAAgAAAJ1BIHNpZ25hdHVyZSBlbnRyeSBpbiB0aGUgc2lnbmF0dXJlcyBtYXAuIGBQb2xpY3lgIGNhcnJpZXMgbm8gc2lnbmF0dXJlCm1hdGVyaWFsOiBpbmNsdXNpb24gb2YgdGhlIHBvbGljeSBrZXkgYXV0aG9yaXplcyBhbiBvbi1jaGFpbiBgcG9saWN5X19gCmNoZWNrIGluc3RlYWQuAAAAAAAAAAAAAAlTaWduYXR1cmUAAAAAAAADAAAAAAAAAAAAAAAGUG9saWN5AAAAAAABAAAAAAAAAAdFZDI1NTE5AAAAAAEAAAPuAAAAQAAAAAEAAAAAAAAACVNlY3AyNTZyMQAAAAAAAAEAAAfQAAAAElNlY3AyNTZyMVNpZ25hdHVyZQAA",
+ "AAAAAgAAAFlTdG9yYWdlIGtleSBpZGVudGlmeWluZyBhIHNpZ25lci4gU2VjcDI1NnIxIGNhcnJpZXMgdGhlIFdlYkF1dGhuCmNyZWRlbnRpYWwgaWQgKGBrZXlJZGApLgAAAAAAAAAAAAAJU2lnbmVyS2V5AAAAAAAAAwAAAAEAAAAAAAAABlBvbGljeQAAAAAAAQAAABMAAAABAAAAAAAAAAdFZDI1NTE5AAAAAAEAAAPuAAAAIAAAAAEAAAAAAAAACVNlY3AyNTZyMQAAAAAAAAEAAAAO",
+ "AAAAAgAAAElTdG9yZWQgc2lnbmVyIHZhbHVlLiBTZWNwMjU2cjEgY2FycmllcyB0aGUgU0VDLTEgdW5jb21wcmVzc2VkIHB1YmxpYyBrZXkuAAAAAAAAAAAAAAlTaWduZXJWYWwAAAAAAAADAAAAAQAAAAAAAAAGUG9saWN5AAAAAAACAAAH0AAAABBTaWduZXJFeHBpcmF0aW9uAAAH0AAAAAxTaWduZXJMaW1pdHMAAAABAAAAAAAAAAdFZDI1NTE5AAAAAAIAAAfQAAAAEFNpZ25lckV4cGlyYXRpb24AAAfQAAAADFNpZ25lckxpbWl0cwAAAAEAAAAAAAAACVNlY3AyNTZyMQAAAAAAAAMAAAPuAAAAQQAAB9AAAAAQU2lnbmVyRXhwaXJhdGlvbgAAB9AAAAAMU2lnbmVyTGltaXRz",
+ "AAAAAQAAANNUaGUgYF9fY2hlY2tfYXV0aGAgc2lnbmF0dXJlIG9iamVjdDogYSBtYXAgb2Ygc2lnbmVyIGtleXMgdG8gc2lnbmF0dXJlcy4KTWFwIG9yZGVyaW5nIGlzIHRoZSBob3N0J3MgU2NWYWwgb3JkZXJpbmcuIEVWRVJZIGVudHJ5IG11c3QgdmVyaWZ5IChwYXNzCjIgb2YgYF9fY2hlY2tfYXV0aGApIOKAlCBpbmNsdWRlIG9ubHkgc2lnbmF0dXJlcyB0aGF0IGFyZSBuZWVkZWQuAAAAAAAAAAAKU2lnbmF0dXJlcwAAAAAAAQAAAAAAAAABMAAAAAAAA+wAAAfQAAAACVNpZ25lcktleQAAAAAAB9AAAAAJU2lnbmF0dXJlAAAA",
+ "AAAAAQAABABSZXN0cmljdGlvbnMgb24gd2hpY2ggYXV0aCBjb250ZXh0cyBhIHNpZ25lciBtYXkgYXV0aG9yaXplLgoKLSBgTm9uZWA6IHVubGltaXRlZC4gVGhlIHNpZ25lciBjYW4gYXV0aG9yaXplIGFueXRoaW5nLCBpbmNsdWRpbmcKYENyZWF0ZUNvbnRyYWN0KmAgKGRlcGxveSkgY29udGV4dHMgYW5kIHRoaXMgd2FsbGV0J3Mgb3duIGFkbWluCmZ1bmN0aW9ucy4KLSBgU29tZShlbXB0eSBtYXApYDogTk8gcGVybWlzc2lvbnMgKGZhaWwtY2xvc2VkKS4gVGhlIHNpZ25lciBjYW4gYXV0aG9yaXplCm5vdGhpbmcgZXhjZXB0IHJlbW92aW5nIGl0c2VsZiAoc2VlIGJlbG93KS4gdjEgYnJlYWtpbmcgY2hhbmdlOiBwcmUtMS4wCmFuIGVtcHR5IG1hcCBtZWFudCB1bmxpbWl0ZWQsIGxlYXZpbmcgdHdvIHVubGltaXRlZCBlbmNvZGluZ3MgYW5kIG5vCiJub25lIiBlbmNvZGluZy4KLSBgU29tZSh7YWRkcmVzcyAtPiBOb25lfSlgOiB0aGUgc2lnbmVyIG1heSBhdXRob3JpemUgYW55IGludm9jYXRpb24gb2YKY29udHJhY3QgYGFkZHJlc3NgLCB3aXRoIG5vIGNvLXNpZ25lcnMgcmVxdWlyZWQuCi0gYFNvbWUoe2FkZHJlc3MgLT4gU29tZShba2V5c10pfSlgOiB0aGUgc2lnbmVyIG1heSBhdXRob3JpemUgaW52b2NhdGlvbnMKb2YgY29udHJhY3QgYGFkZHJlc3NgIG9ubHkgaWYgZXZlcnkgbGlzdGVkIGtleSBhbHNvIEFQUFJPVkVTLiBUaGUgbGlzdGVkCmtleXMgYXJlIHJlcXVpcmVkIENPLVNJR05FUlMuCgojIyBSZXF1aXJlZCBjby1zaWduZXJzIGFyZSBzY29wZS1pbmRlcGVuZGVudCBhcHByb3ZlcnMgKGF1ZGl0IEZJWC01KQoKQSByZXF1aXJlZCBjby1zaWduZXIncyBPV04gYFNpZ25lckxpbWl0c2AgZG8gTk9UIGNvbnN0cmFpbiBpdHMgY28tc2lnbmVyCnJvbGUg4oCUIGEga2V5J3MgbGltaXRzIGdvdmVybiBvbmx5IGl0cyBJTkRFUEVOREVOVCBhdXRob3JpdHkgKHdoZXRoZXIgaXQgY2FuCmNvdmVyIGEgY29udGV4dCBvbiBpdHMgb3duKS4gVGhpcyBpcyBzeW1tZXRyaWMgYWNyb3NzIGtleSBraW5kczoKCi0gAAAAAAAAAAxTaWduZXJMaW1pdHMAAAABAAAAAAAAAAEwAAAAAAAD6AAAA+wAAAATAAAD6AAAA+oAAAfQAAAACVNpZ25lcktleQAAAA==",
+ "AAAAAgAAAIRXaGljaCBkdXJhYmlsaXR5IGEgc2lnbmVyIGVudHJ5IGlzIHN0b3JlZCB1bmRlci4gQXQgbW9zdCBvbmUgZW50cnkgZXhpc3RzCnBlciBzaWduZXIga2V5OyBsb29rdXBzIGNoZWNrIFRlbXBvcmFyeSBiZWZvcmUgUGVyc2lzdGVudC4AAAAAAAAADVNpZ25lclN0b3JhZ2UAAAAAAAACAAAAAAAAAAAAAAAKUGVyc2lzdGVudAAAAAAAAAAAAAAAAAAJVGVtcG9yYXJ5AAAA",
+ "AAAAAQAAAY5PcHRpb25hbCBleHBpcmF0aW9uIGZvciBhIHNpZ25lciBhcyBhIFVOSVggdGltZXN0YW1wIGluIHNlY29uZHMsIElOQ0xVU0lWRToKdGhlIHNpZ25lciBpcyB2YWxpZCB3aGlsZSBgbGVkZ2VyIHRpbWVzdGFtcCA8PSBleHBpcmF0aW9uYCBhbmQgZXhwaXJlZCBvbmNlCmBsZWRnZXIgdGltZXN0YW1wID4gZXhwaXJhdGlvbmAuIGBOb25lYCBuZXZlciBleHBpcmVzLgoKdjEgYnJlYWtpbmcgY2hhbmdlOiB0aGlzIHdhcyBhIGxlZGdlciBzZXF1ZW5jZSBudW1iZXIgcHJlLTEuMC4gVGltZXN0YW1wcwpkb24ndCBkcmlmdCB3aXRoIGNoYW5nZXMgdG8gbGVkZ2VyIGNsb3NlIHRpbWUgKGUuZy4gQ0FQLTAwNzAgZHluYW1pYwp0aW1pbmcpLCB3aGljaCBsZWRnZXItc2VxdWVuY2UgZXhwaXJhdGlvbnMgZGlkLgAAAAAAAAAAABBTaWduZXJFeHBpcmF0aW9uAAAAAQAAAAAAAAABMAAAAAAAA+gAAAAG",
+ "AAAAAQAAAMhBIFdlYkF1dGhuIGFzc2VydGlvbiBvdmVyIHRoZSBTb3JvYmFuIGF1dGhvcml6YXRpb24gcGF5bG9hZC4gVGhlIHNpZ25lZAptZXNzYWdlIGlzIGBhdXRoZW50aWNhdG9yX2RhdGEgfHwgc2hhMjU2KGNsaWVudF9kYXRhX2pzb24pYCBhbmQgdGhlCnBheWxvYWQgYmluZGluZyBsaXZlcyBpbiBjbGllbnREYXRhSlNPTidzIGBjaGFsbGVuZ2VgIGZpZWxkLgAAAAAAAAASU2VjcDI1NnIxU2lnbmF0dXJlAAAAAAADAAAAAAAAABJhdXRoZW50aWNhdG9yX2RhdGEAAAAAAA4AAAAAAAAAEGNsaWVudF9kYXRhX2pzb24AAAAOAAAAAAAAAAlzaWduYXR1cmUAAAAAAAPuAAAAQA==",
+ "AAAABQAAASBUaGUgY29udHJhY3QncyB3YXNtIHdhcyByZXBsYWNlZCB2aWEgYHVwZ3JhZGVgLiBgb2xkX2hhc2hgIGlzIGBOb25lYCBvbiBhCndhbGxldCdzIGZpcnN0LWV2ZXIgdXBncmFkZTogdGhlIGhvc3QgZXhwb3NlcyBubyB3YXkgZm9yIGEgY29udHJhY3QgdG8KcmVhZCBpdHMgb3duIGV4ZWN1dGFibGUgaGFzaCwgc28gdGhlIHdhbGxldCBjYWNoZXMgdGhlIGhhc2ggaW4gaW5zdGFuY2UKc3RvcmFnZSBhdCBlYWNoIHVwZ3JhZGUgYW5kIHRoZSBnZW5lc2lzIGhhc2ggaXMgdW5rbm93YWJsZSBpbi1jb250cmFjdC4AAAAAAAAACFVwZ3JhZGVkAAAAAQAAAAh1cGdyYWRlZAAAAAIAAAAAAAAACG9sZF9oYXNoAAAD6AAAA+4AAAAgAAAAAAAAAAAAAAAIbmV3X2hhc2gAAAPuAAAAIAAAAAAAAAAC",
+ "AAAABQAAADlBIHNpZ25lciB3YXMgYWRkZWQgKHZpYSBgX19jb25zdHJ1Y3RvcmAgb3IgYGFkZF9zaWduZXJgKS4AAAAAAAAAAAAAC1NpZ25lckFkZGVkAAAAAAEAAAAMc2lnbmVyX2FkZGVkAAAAAwAAAAAAAAADa2V5AAAAB9AAAAAJU2lnbmVyS2V5AAAAAAAAAQAAAAAAAAADdmFsAAAAB9AAAAAJU2lnbmVyVmFsAAAAAAAAAAAAAAAAAAAHc3RvcmFnZQAAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAAAAAAAAg==",
+ "AAAABQAAAGFBIHNpZ25lciB3YXMgcmVtb3ZlZCB2aWEgYHJlbW92ZV9zaWduZXJgLiBgc3RvcmFnZWAgaXMgdGhlIGR1cmFiaWxpdHkgdGhlCmVudHJ5IHdhcyByZW1vdmVkIGZyb20uAAAAAAAAAAAAAA1TaWduZXJSZW1vdmVkAAAAAAAAAQAAAA5zaWduZXJfcmVtb3ZlZAAAAAAAAgAAAAAAAAADa2V5AAAAB9AAAAAJU2lnbmVyS2V5AAAAAAAAAQAAAAAAAAAHc3RvcmFnZQAAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAAAAAAAAg==",
+ "AAAABQAAADRBbiBleGlzdGluZyBzaWduZXIgd2FzIG1vZGlmaWVkIHZpYSBgdXBkYXRlX3NpZ25lcmAuAAAAAAAAAA1TaWduZXJVcGRhdGVkAAAAAAAAAQAAAA5zaWduZXJfdXBkYXRlZAAAAAAABAAAAAAAAAADa2V5AAAAB9AAAAAJU2lnbmVyS2V5AAAAAAAAAQAAAAAAAAADdmFsAAAAB9AAAAAJU2lnbmVyVmFsAAAAAAAAAAAAAAAAAAAHc3RvcmFnZQAAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAAAAAAAAAAAAAtvbGRfc3RvcmFnZQAAAAfQAAAADVNpZ25lclN0b3JhZ2UAAAAAAAAAAAAAAg==" ]),
options
)
}
public readonly fromJSON = {
- add_signer: this.txFromJSON,
- update_signer: this.txFromJSON,
- remove_signer: this.txFromJSON,
- update_contract_code: this.txFromJSON
+ upgrade: this.txFromJSON>,
+ add_signer: this.txFromJSON>,
+ get_signer: this.txFromJSON>,
+ remove_signer: this.txFromJSON>,
+ update_signer: this.txFromJSON>
}
}
\ No newline at end of file
diff --git a/packages/passkey-kit-sdk/tsconfig.json b/packages/passkey-kit-sdk/tsconfig.json
index 9d42a28..2ab5e5f 100644
--- a/packages/passkey-kit-sdk/tsconfig.json
+++ b/packages/passkey-kit-sdk/tsconfig.json
@@ -1,98 +1,16 @@
{
"compilerOptions": {
- /* Visit https://aka.ms/tsconfig to read more about this file */
- /* Projects */
- // "incremental": true, /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
- // "composite": true, /* Enable constraints that allow a TypeScript project to be used with project references. */
- // "tsBuildInfoFile": "./.tsbuildinfo", /* Specify the path to .tsbuildinfo incremental compilation file. */
- // "disableSourceOfProjectReferenceRedirect": true, /* Disable preferring source files instead of declaration files when referencing composite projects. */
- // "disableSolutionSearching": true, /* Opt a project out of multi-project reference checking when editing. */
- // "disableReferencedProjectLoad": true, /* Reduce the number of projects loaded automatically by TypeScript. */
- /* Language and Environment */
- "target": "ESNext", /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
- // "lib": [], /* Specify a set of bundled library declaration files that describe the target runtime environment. */
- // "jsx": "preserve", /* Specify what JSX code is generated. */
- // "experimentalDecorators": true, /* Enable experimental support for TC39 stage 2 draft decorators. */
- // "emitDecoratorMetadata": true, /* Emit design-type metadata for decorated declarations in source files. */
- // "jsxFactory": "", /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
- // "jsxFragmentFactory": "", /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
- // "jsxImportSource": "", /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
- // "reactNamespace": "", /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
- // "noLib": true, /* Disable including any library files, including the default lib.d.ts. */
- // "useDefineForClassFields": true, /* Emit ECMAScript-standard-compliant class fields. */
- // "moduleDetection": "auto", /* Control what method is used to detect module-format JS files. */
- /* Modules */
- "module": "NodeNext", /* Specify what module code is generated. */
- // "rootDir": "./", /* Specify the root folder within your source files. */
- "moduleResolution": "nodenext", /* Specify how TypeScript looks up a file from a given module specifier. */
- // "baseUrl": "./", /* Specify the base directory to resolve non-relative module names. */
- // "paths": {}, /* Specify a set of entries that re-map imports to additional lookup locations. */
- // "rootDirs": [], /* Allow multiple folders to be treated as one when resolving modules. */
- // "typeRoots": [], /* Specify multiple folders that act like './node_modules/@types'. */
- // "types": [], /* Specify type package names to be included without being referenced in a source file. */
- // "allowUmdGlobalAccess": true, /* Allow accessing UMD globals from modules. */
- // "moduleSuffixes": [], /* List of file name suffixes to search when resolving a module. */
- // "resolveJsonModule": true, /* Enable importing .json files. */
- // "noResolve": true, /* Disallow 'import's, 'require's or ''s from expanding the number of files TypeScript should add to a project. */
- /* JavaScript Support */
- // "allowJs": true, /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
- // "checkJs": true, /* Enable error reporting in type-checked JavaScript files. */
- // "maxNodeModuleJsDepth": 1, /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
- /* Emit */
- "declaration": true, /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
- // "declarationMap": true, /* Create sourcemaps for d.ts files. */
- "emitDeclarationOnly": true, /* Only output d.ts files and not JavaScript files. */
- // "sourceMap": true, /* Create source map files for emitted JavaScript files. */
- // "outFile": "./", /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
- "outDir": "./types", /* Specify an output folder for all emitted files. */
- // "removeComments": true, /* Disable emitting comments. */
- // "noEmit": true, /* Disable emitting files from a compilation. */
- // "importHelpers": true, /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
- // "importsNotUsedAsValues": "remove", /* Specify emit/checking behavior for imports that are only used for types. */
- // "downlevelIteration": true, /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
- // "sourceRoot": "", /* Specify the root path for debuggers to find the reference source code. */
- // "mapRoot": "", /* Specify the location where debugger should locate map files instead of generated locations. */
- // "inlineSourceMap": true, /* Include sourcemap files inside the emitted JavaScript. */
- // "inlineSources": true, /* Include source code in the sourcemaps inside the emitted JavaScript. */
- // "emitBOM": true, /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
- // "newLine": "crlf", /* Set the newline character for emitting files. */
- // "stripInternal": true, /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
- // "noEmitHelpers": true, /* Disable generating custom helper functions like '__extends' in compiled output. */
- // "noEmitOnError": true, /* Disable emitting files if any type checking errors are reported. */
- // "preserveConstEnums": true, /* Disable erasing 'const enum' declarations in generated code. */
- // "declarationDir": "./", /* Specify the output directory for generated declaration files. */
- // "preserveValueImports": true, /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
- /* Interop Constraints */
- // "isolatedModules": true, /* Ensure that each file can be safely transpiled without relying on other imports. */
- // "allowSyntheticDefaultImports": true, /* Allow 'import x from y' when a module doesn't have a default export. */
- // "esModuleInterop": true, /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
- // "preserveSymlinks": true, /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
- // "forceConsistentCasingInFileNames": true, /* Ensure that casing is correct in imports. */
- /* Type Checking */
- // "strict": true, /* Enable all strict type-checking options. */
- // "noImplicitAny": true, /* Enable error reporting for expressions and declarations with an implied 'any' type. */
- "strictNullChecks": true, /* When type checking, take into account 'null' and 'undefined'. */
- // "strictFunctionTypes": true, /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
- // "strictBindCallApply": true, /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
- // "strictPropertyInitialization": true, /* Check for class properties that are declared but not set in the constructor. */
- // "noImplicitThis": true, /* Enable error reporting when 'this' is given the type 'any'. */
- // "useUnknownInCatchVariables": true, /* Default catch clause variables as 'unknown' instead of 'any'. */
- // "alwaysStrict": true, /* Ensure 'use strict' is always emitted. */
- // "noUnusedLocals": true, /* Enable error reporting when local variables aren't read. */
- // "noUnusedParameters": true, /* Raise an error when a function parameter isn't read. */
- // "exactOptionalPropertyTypes": true, /* Interpret optional property types as written, rather than adding 'undefined'. */
- // "noImplicitReturns": true, /* Enable error reporting for codepaths that do not explicitly return in a function. */
- // "noFallthroughCasesInSwitch": true, /* Enable error reporting for fallthrough cases in switch statements. */
- // "noUncheckedIndexedAccess": true, /* Add 'undefined' to a type when accessed using an index. */
- // "noImplicitOverride": true, /* Ensure overriding members in derived classes are marked with an override modifier. */
- // "noPropertyAccessFromIndexSignature": true, /* Enforces using indexed accessors for keys declared using an indexed type. */
- // "allowUnusedLabels": true, /* Disable error reporting for unused labels. */
- // "allowUnreachableCode": true, /* Disable error reporting for unreachable code. */
- /* Completeness */
- // "skipDefaultLibCheck": true, /* Skip type checking .d.ts files that are included with TypeScript. */
- "skipLibCheck": true /* Skip type checking all .d.ts files. */
+ "target": "ES2022",
+ "module": "NodeNext",
+ "moduleResolution": "NodeNext",
+ "lib": ["ES2022", "DOM"],
+ "declaration": true,
+ "outDir": "./dist",
+ "rootDir": "./src",
+ "esModuleInterop": true,
+ "skipLibCheck": true,
+ "strictNullChecks": true,
+ "forceConsistentCasingInFileNames": true
},
- "include": [
- "src/*"
- ]
-}
\ No newline at end of file
+ "include": ["src/**/*"]
+}
diff --git a/packages/sac-sdk/package.json b/packages/sac-sdk/package.json
index a89ea55..3fd45df 100644
--- a/packages/sac-sdk/package.json
+++ b/packages/sac-sdk/package.json
@@ -1,18 +1,36 @@
{
- "version": "0.4.2",
+ "version": "0.4.3",
"name": "sac-sdk",
"type": "module",
- "main": "src/index.ts",
- "types": "types/index.d.ts",
+ "main": "dist/index.js",
+ "module": "dist/index.js",
+ "types": "dist/index.d.ts",
+ "sideEffects": false,
+ "exports": {
+ ".": {
+ "import": "./dist/index.js",
+ "types": "./dist/index.d.ts"
+ }
+ },
+ "files": [
+ "dist",
+ "README.md"
+ ],
"scripts": {
"prepublishOnly": "pnpm run build",
"build": "tsc"
},
"dependencies": {
- "@stellar/stellar-sdk": "^14.2.0",
"buffer": "^6.0.3"
},
+ "peerDependencies": {
+ "@stellar/stellar-sdk": ">=16.0.0"
+ },
"devDependencies": {
+ "@stellar/stellar-sdk": "16.0.1",
"typescript": "^5.9.2"
+ },
+ "engines": {
+ "node": ">=22.0.0"
}
}
diff --git a/packages/sac-sdk/src/index.ts b/packages/sac-sdk/src/index.ts
index fe60b54..af5697d 100644
--- a/packages/sac-sdk/src/index.ts
+++ b/packages/sac-sdk/src/index.ts
@@ -5,11 +5,11 @@ import {
ClientOptions as ContractClientOptions,
MethodOptions,
Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
import type {
u32,
i128,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
if (typeof window !== 'undefined') {
//@ts-ignore Buffer exists
diff --git a/packages/sac-sdk/tsconfig.json b/packages/sac-sdk/tsconfig.json
index 9d42a28..2ab5e5f 100644
--- a/packages/sac-sdk/tsconfig.json
+++ b/packages/sac-sdk/tsconfig.json
@@ -1,98 +1,16 @@
{
"compilerOptions": {
- /* Visit https://aka.ms/tsconfig to read more about this file */
- /* Projects */
- // "incremental": true, /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
- // "composite": true, /* Enable constraints that allow a TypeScript project to be used with project references. */
- // "tsBuildInfoFile": "./.tsbuildinfo", /* Specify the path to .tsbuildinfo incremental compilation file. */
- // "disableSourceOfProjectReferenceRedirect": true, /* Disable preferring source files instead of declaration files when referencing composite projects. */
- // "disableSolutionSearching": true, /* Opt a project out of multi-project reference checking when editing. */
- // "disableReferencedProjectLoad": true, /* Reduce the number of projects loaded automatically by TypeScript. */
- /* Language and Environment */
- "target": "ESNext", /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
- // "lib": [], /* Specify a set of bundled library declaration files that describe the target runtime environment. */
- // "jsx": "preserve", /* Specify what JSX code is generated. */
- // "experimentalDecorators": true, /* Enable experimental support for TC39 stage 2 draft decorators. */
- // "emitDecoratorMetadata": true, /* Emit design-type metadata for decorated declarations in source files. */
- // "jsxFactory": "", /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
- // "jsxFragmentFactory": "", /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
- // "jsxImportSource": "", /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
- // "reactNamespace": "", /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
- // "noLib": true, /* Disable including any library files, including the default lib.d.ts. */
- // "useDefineForClassFields": true, /* Emit ECMAScript-standard-compliant class fields. */
- // "moduleDetection": "auto", /* Control what method is used to detect module-format JS files. */
- /* Modules */
- "module": "NodeNext", /* Specify what module code is generated. */
- // "rootDir": "./", /* Specify the root folder within your source files. */
- "moduleResolution": "nodenext", /* Specify how TypeScript looks up a file from a given module specifier. */
- // "baseUrl": "./", /* Specify the base directory to resolve non-relative module names. */
- // "paths": {}, /* Specify a set of entries that re-map imports to additional lookup locations. */
- // "rootDirs": [], /* Allow multiple folders to be treated as one when resolving modules. */
- // "typeRoots": [], /* Specify multiple folders that act like './node_modules/@types'. */
- // "types": [], /* Specify type package names to be included without being referenced in a source file. */
- // "allowUmdGlobalAccess": true, /* Allow accessing UMD globals from modules. */
- // "moduleSuffixes": [], /* List of file name suffixes to search when resolving a module. */
- // "resolveJsonModule": true, /* Enable importing .json files. */
- // "noResolve": true, /* Disallow 'import's, 'require's or ''s from expanding the number of files TypeScript should add to a project. */
- /* JavaScript Support */
- // "allowJs": true, /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
- // "checkJs": true, /* Enable error reporting in type-checked JavaScript files. */
- // "maxNodeModuleJsDepth": 1, /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
- /* Emit */
- "declaration": true, /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
- // "declarationMap": true, /* Create sourcemaps for d.ts files. */
- "emitDeclarationOnly": true, /* Only output d.ts files and not JavaScript files. */
- // "sourceMap": true, /* Create source map files for emitted JavaScript files. */
- // "outFile": "./", /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
- "outDir": "./types", /* Specify an output folder for all emitted files. */
- // "removeComments": true, /* Disable emitting comments. */
- // "noEmit": true, /* Disable emitting files from a compilation. */
- // "importHelpers": true, /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
- // "importsNotUsedAsValues": "remove", /* Specify emit/checking behavior for imports that are only used for types. */
- // "downlevelIteration": true, /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
- // "sourceRoot": "", /* Specify the root path for debuggers to find the reference source code. */
- // "mapRoot": "", /* Specify the location where debugger should locate map files instead of generated locations. */
- // "inlineSourceMap": true, /* Include sourcemap files inside the emitted JavaScript. */
- // "inlineSources": true, /* Include source code in the sourcemaps inside the emitted JavaScript. */
- // "emitBOM": true, /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
- // "newLine": "crlf", /* Set the newline character for emitting files. */
- // "stripInternal": true, /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
- // "noEmitHelpers": true, /* Disable generating custom helper functions like '__extends' in compiled output. */
- // "noEmitOnError": true, /* Disable emitting files if any type checking errors are reported. */
- // "preserveConstEnums": true, /* Disable erasing 'const enum' declarations in generated code. */
- // "declarationDir": "./", /* Specify the output directory for generated declaration files. */
- // "preserveValueImports": true, /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
- /* Interop Constraints */
- // "isolatedModules": true, /* Ensure that each file can be safely transpiled without relying on other imports. */
- // "allowSyntheticDefaultImports": true, /* Allow 'import x from y' when a module doesn't have a default export. */
- // "esModuleInterop": true, /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
- // "preserveSymlinks": true, /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
- // "forceConsistentCasingInFileNames": true, /* Ensure that casing is correct in imports. */
- /* Type Checking */
- // "strict": true, /* Enable all strict type-checking options. */
- // "noImplicitAny": true, /* Enable error reporting for expressions and declarations with an implied 'any' type. */
- "strictNullChecks": true, /* When type checking, take into account 'null' and 'undefined'. */
- // "strictFunctionTypes": true, /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
- // "strictBindCallApply": true, /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
- // "strictPropertyInitialization": true, /* Check for class properties that are declared but not set in the constructor. */
- // "noImplicitThis": true, /* Enable error reporting when 'this' is given the type 'any'. */
- // "useUnknownInCatchVariables": true, /* Default catch clause variables as 'unknown' instead of 'any'. */
- // "alwaysStrict": true, /* Ensure 'use strict' is always emitted. */
- // "noUnusedLocals": true, /* Enable error reporting when local variables aren't read. */
- // "noUnusedParameters": true, /* Raise an error when a function parameter isn't read. */
- // "exactOptionalPropertyTypes": true, /* Interpret optional property types as written, rather than adding 'undefined'. */
- // "noImplicitReturns": true, /* Enable error reporting for codepaths that do not explicitly return in a function. */
- // "noFallthroughCasesInSwitch": true, /* Enable error reporting for fallthrough cases in switch statements. */
- // "noUncheckedIndexedAccess": true, /* Add 'undefined' to a type when accessed using an index. */
- // "noImplicitOverride": true, /* Ensure overriding members in derived classes are marked with an override modifier. */
- // "noPropertyAccessFromIndexSignature": true, /* Enforces using indexed accessors for keys declared using an indexed type. */
- // "allowUnusedLabels": true, /* Disable error reporting for unused labels. */
- // "allowUnreachableCode": true, /* Disable error reporting for unreachable code. */
- /* Completeness */
- // "skipDefaultLibCheck": true, /* Skip type checking .d.ts files that are included with TypeScript. */
- "skipLibCheck": true /* Skip type checking all .d.ts files. */
+ "target": "ES2022",
+ "module": "NodeNext",
+ "moduleResolution": "NodeNext",
+ "lib": ["ES2022", "DOM"],
+ "declaration": true,
+ "outDir": "./dist",
+ "rootDir": "./src",
+ "esModuleInterop": true,
+ "skipLibCheck": true,
+ "strictNullChecks": true,
+ "forceConsistentCasingInFileNames": true
},
- "include": [
- "src/*"
- ]
-}
\ No newline at end of file
+ "include": ["src/**/*"]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e14f8ca..66c9da9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,21 +5,21 @@ settings:
excludeLinksFromLockfile: false
overrides:
- '@stellar/stellar-sdk': ^14.2.0
+ '@stellar/stellar-sdk': 16.0.1
importers:
.:
dependencies:
'@openzeppelin/relayer-plugin-channels':
- specifier: ^0.5.0
- version: 0.5.0
+ specifier: ^0.20.0
+ version: 0.20.0
'@simplewebauthn/browser':
- specifier: ^13.2.0
- version: 13.2.0
+ specifier: ^13.3.0
+ version: 13.3.0
'@stellar/stellar-sdk':
- specifier: ^14.2.0
- version: 14.2.0
+ specifier: 16.0.1
+ version: 16.0.1
base64url:
specifier: ^3.0.1
version: 3.0.1
@@ -36,32 +36,38 @@ importers:
'@types/node':
specifier: ^24.6.0
version: 24.6.0
+ fake-indexeddb:
+ specifier: ^6.2.5
+ version: 6.2.5
typescript:
specifier: ^5.9.2
version: 5.9.2
+ vitest:
+ specifier: ^3.2.4
+ version: 3.2.7(@types/node@24.6.0)
packages/passkey-kit-sdk:
dependencies:
- '@stellar/stellar-sdk':
- specifier: ^14.2.0
- version: 14.2.0
buffer:
specifier: ^6.0.3
version: 6.0.3
devDependencies:
+ '@stellar/stellar-sdk':
+ specifier: 16.0.1
+ version: 16.0.1
typescript:
specifier: ^5.9.2
version: 5.9.2
packages/sac-sdk:
dependencies:
- '@stellar/stellar-sdk':
- specifier: ^14.2.0
- version: 14.2.0
buffer:
specifier: ^6.0.3
version: 6.0.3
devDependencies:
+ '@stellar/stellar-sdk':
+ specifier: 16.0.1
+ version: 16.0.1
typescript:
specifier: ^5.9.2
version: 5.9.2
@@ -74,51 +80,384 @@ packages:
'@actions/io@1.1.3':
resolution: {integrity: sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==}
- '@noble/curves@1.9.7':
- resolution: {integrity: sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==}
- engines: {node: ^14.21.3 || >=16}
-
- '@noble/hashes@1.8.0':
- resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
- engines: {node: ^14.21.3 || >=16}
-
- '@openzeppelin/relayer-plugin-channels@0.5.0':
- resolution: {integrity: sha512-mn8TklTFwwqKVVOjYQtJGGX/8IKJwg4hbwfAsz7kvb5L5EhjJzwCjgfT84TL6ZVmHb7DoQ6h2lPgNussDiHy5g==}
+ '@esbuild/aix-ppc64@0.28.1':
+ resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [aix]
+
+ '@esbuild/android-arm64@0.28.1':
+ resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [android]
+
+ '@esbuild/android-arm@0.28.1':
+ resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [android]
+
+ '@esbuild/android-x64@0.28.1':
+ resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [android]
+
+ '@esbuild/darwin-arm64@0.28.1':
+ resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@esbuild/darwin-x64@0.28.1':
+ resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [darwin]
+
+ '@esbuild/freebsd-arm64@0.28.1':
+ resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [freebsd]
+
+ '@esbuild/freebsd-x64@0.28.1':
+ resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@esbuild/linux-arm64@0.28.1':
+ resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [linux]
+
+ '@esbuild/linux-arm@0.28.1':
+ resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [linux]
+
+ '@esbuild/linux-ia32@0.28.1':
+ resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [linux]
+
+ '@esbuild/linux-loong64@0.28.1':
+ resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
+ engines: {node: '>=18'}
+ cpu: [loong64]
+ os: [linux]
+
+ '@esbuild/linux-mips64el@0.28.1':
+ resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
+ engines: {node: '>=18'}
+ cpu: [mips64el]
+ os: [linux]
+
+ '@esbuild/linux-ppc64@0.28.1':
+ resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [linux]
+
+ '@esbuild/linux-riscv64@0.28.1':
+ resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
+ engines: {node: '>=18'}
+ cpu: [riscv64]
+ os: [linux]
+
+ '@esbuild/linux-s390x@0.28.1':
+ resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
+ engines: {node: '>=18'}
+ cpu: [s390x]
+ os: [linux]
+
+ '@esbuild/linux-x64@0.28.1':
+ resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [linux]
+
+ '@esbuild/netbsd-arm64@0.28.1':
+ resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [netbsd]
+
+ '@esbuild/netbsd-x64@0.28.1':
+ resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [netbsd]
+
+ '@esbuild/openbsd-arm64@0.28.1':
+ resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openbsd]
+
+ '@esbuild/openbsd-x64@0.28.1':
+ resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [openbsd]
+
+ '@esbuild/openharmony-arm64@0.28.1':
+ resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openharmony]
+
+ '@esbuild/sunos-x64@0.28.1':
+ resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [sunos]
+
+ '@esbuild/win32-arm64@0.28.1':
+ resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [win32]
+
+ '@esbuild/win32-ia32@0.28.1':
+ resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [win32]
+
+ '@esbuild/win32-x64@0.28.1':
+ resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [win32]
+
+ '@jridgewell/sourcemap-codec@1.5.5':
+ resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+ '@noble/ed25519@3.1.0':
+ resolution: {integrity: sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==}
+
+ '@noble/hashes@2.2.0':
+ resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
+ engines: {node: '>= 20.19.0'}
+
+ '@openzeppelin/relayer-plugin-channels@0.20.0':
+ resolution: {integrity: sha512-buZ0Xcir1mPcevMBU3vzbq4v77YUsikWX+E1k31YxdE6p97GEn40RnxNzow/eLNVnS3WNwYZ1SuEZgsQE7KHAg==}
engines: {node: '>=22.18.0', npm: use pnpm, pnpm: '>=9', yarn: use pnpm}
- '@openzeppelin/relayer-sdk@1.8.0':
- resolution: {integrity: sha512-2nMn9Sg0j52kp/GdhavvL8zgwRJqDqXq4yM1uYewfYndns6WGUS3zxcDICgHenMVURo8YWdJG7E7Ockck3SNFg==}
+ '@openzeppelin/relayer-sdk@1.10.0':
+ resolution: {integrity: sha512-C7v4C63VnFR4keISicpcDf4Ix646sa1OdokzddFeSPEGlJIY2b/XJ9sIWiXOBVJVGzbB+RdX3/fbkygAPhcVNw==}
engines: {node: '>=22.14.0', npm: use pnpm, pnpm: '>=9', yarn: use pnpm}
- '@simplewebauthn/browser@13.2.0':
- resolution: {integrity: sha512-N3fuA1AAnTo5gCStYoIoiasPccC+xPLx2YU88Dv0GeAmPQTWHETlZQq5xZ0DgUq1H9loXMWQH5qqUjcI7BHJ1A==}
+ '@rollup/rollup-android-arm-eabi@4.62.2':
+ resolution: {integrity: sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==}
+ cpu: [arm]
+ os: [android]
+
+ '@rollup/rollup-android-arm64@4.62.2':
+ resolution: {integrity: sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==}
+ cpu: [arm64]
+ os: [android]
+
+ '@rollup/rollup-darwin-arm64@4.62.2':
+ resolution: {integrity: sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@rollup/rollup-darwin-x64@4.62.2':
+ resolution: {integrity: sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==}
+ cpu: [x64]
+ os: [darwin]
+
+ '@rollup/rollup-freebsd-arm64@4.62.2':
+ resolution: {integrity: sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==}
+ cpu: [arm64]
+ os: [freebsd]
+
+ '@rollup/rollup-freebsd-x64@4.62.2':
+ resolution: {integrity: sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+ resolution: {integrity: sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==}
+ cpu: [arm]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+ resolution: {integrity: sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==}
+ cpu: [arm]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-arm64-gnu@4.62.2':
+ resolution: {integrity: sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-arm64-musl@4.62.2':
+ resolution: {integrity: sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-loong64-gnu@4.62.2':
+ resolution: {integrity: sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==}
+ cpu: [loong64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-loong64-musl@4.62.2':
+ resolution: {integrity: sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==}
+ cpu: [loong64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+ resolution: {integrity: sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-ppc64-musl@4.62.2':
+ resolution: {integrity: sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+ resolution: {integrity: sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-riscv64-musl@4.62.2':
+ resolution: {integrity: sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-s390x-gnu@4.62.2':
+ resolution: {integrity: sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-x64-gnu@4.62.2':
+ resolution: {integrity: sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-x64-musl@4.62.2':
+ resolution: {integrity: sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-openbsd-x64@4.62.2':
+ resolution: {integrity: sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==}
+ cpu: [x64]
+ os: [openbsd]
+
+ '@rollup/rollup-openharmony-arm64@4.62.2':
+ resolution: {integrity: sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==}
+ cpu: [arm64]
+ os: [openharmony]
+
+ '@rollup/rollup-win32-arm64-msvc@4.62.2':
+ resolution: {integrity: sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==}
+ cpu: [arm64]
+ os: [win32]
+
+ '@rollup/rollup-win32-ia32-msvc@4.62.2':
+ resolution: {integrity: sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==}
+ cpu: [ia32]
+ os: [win32]
+
+ '@rollup/rollup-win32-x64-gnu@4.62.2':
+ resolution: {integrity: sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==}
+ cpu: [x64]
+ os: [win32]
+
+ '@rollup/rollup-win32-x64-msvc@4.62.2':
+ resolution: {integrity: sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==}
+ cpu: [x64]
+ os: [win32]
+
+ '@simplewebauthn/browser@13.3.0':
+ resolution: {integrity: sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==}
+
+ '@stellar/js-xdr@4.0.0':
+ resolution: {integrity: sha512-+NmNa7Tk5BI5XFdy/6xGTqAN4J9a9KgCrCGhj2uEUTCBhLkch0M+QbKzNH8zEnejWe0p8w+0q5hUVX6L3OzoVA==}
+ engines: {node: '>=20.0.0', pnpm: '>=9.0.0'}
+
+ '@stellar/stellar-sdk@16.0.1':
+ resolution: {integrity: sha512-bxKohaiyKVqoudRhbOOHeHhHIaeYV5Zab4rCjxhP4Ty1h1ozTLBOv8lWFnZz9ilBzXG8Bb7usQI3rlEcfvUynA==}
+ engines: {node: '>=22.0.0'}
+ hasBin: true
- '@stellar/js-xdr@3.1.2':
- resolution: {integrity: sha512-VVolPL5goVEIsvuGqDc5uiKxV03lzfWdvYg1KikvwheDmTBO68CKDji3bAZ/kppZrx5iTA8z3Ld5yuytcvhvOQ==}
+ '@types/chai@5.2.3':
+ resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
- '@stellar/stellar-base@14.0.1':
- resolution: {integrity: sha512-mI6Kjh9hGWDA1APawQTtCbR7702dNT/8Te1uuRFPqqdoAKBk3WpXOQI3ZSZO+5olW7BSHpmVG5KBPZpIpQxIvw==}
- engines: {node: '>=20.0.0'}
+ '@types/deep-eql@4.0.2':
+ resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
- '@stellar/stellar-sdk@14.2.0':
- resolution: {integrity: sha512-7nh2ogzLRMhfkIC0fGjn1LHUzk3jqVw8tjAuTt5ADWfL9CSGBL18ILucE9igz2L/RU2AZgeAvhujAnW91Ut/oQ==}
- engines: {node: '>=20.0.0'}
+ '@types/estree@1.0.9':
+ resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
'@types/node@24.6.0':
resolution: {integrity: sha512-F1CBxgqwOMc4GKJ7eY22hWhBVQuMYTtqI8L0FcszYcpYX0fzfDGpez22Xau8Mgm7O9fI+zA/TYIdq3tGWfweBA==}
- asynckit@0.4.0:
- resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+ '@vitest/expect@3.2.7':
+ resolution: {integrity: sha512-E8eBXaKibuvH2pSZErOjdVb5vF4PbKYcrnluBTYxEk1l/VhhwZg1kZQsdtjq+CsF5CFydf2Rdkz7jDHKSisi3w==}
- available-typed-arrays@1.0.7:
- resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
- engines: {node: '>= 0.4'}
+ '@vitest/mocker@3.2.7':
+ resolution: {integrity: sha512-Trr0hYO9CM3Wj6ksWHRhK9IZpIY6wTMO5u/MqXurMxT57sWBaOPEtP3Oq60ihZuh5JsiagKfz95OcxdEP6dBrA==}
+ peerDependencies:
+ msw: ^2.4.9
+ vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
+ peerDependenciesMeta:
+ msw:
+ optional: true
+ vite:
+ optional: true
- axios@1.12.2:
- resolution: {integrity: sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==}
+ '@vitest/pretty-format@3.2.7':
+ resolution: {integrity: sha512-KUHlwqVu0sRlhCdyPdQ/wBoTfRahjUky1MubOmYw9fWfIZy1gNoHpuaaQBPAaMaVYdQYHJLurzj8ECCj5OwTqA==}
- axios@1.13.2:
- resolution: {integrity: sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==}
+ '@vitest/runner@3.2.7':
+ resolution: {integrity: sha512-sB9y4ovltoQP+WaUPwmSxO9WIg9Ig694Di5PalVPsYHklAdE027mehpWF2SQSVq+k6sFgaivbTjTJwZLSHbedA==}
+
+ '@vitest/snapshot@3.2.7':
+ resolution: {integrity: sha512-7C+MwShwtBSI5Buwoyg3s/iY1eHL9PKAf+O1wVh/TdnjXUtkoL/9YQtre90i4MtNXM6edP1wJ2zOBpfCyhIS7g==}
+
+ '@vitest/spy@3.2.7':
+ resolution: {integrity: sha512-Q2eQGI6d2L/hBtZ0qNuKcAGid68XK6cv1xsoaIma6PaJhHPoqcEJhYpXZ/5myCMqkNgtP6UKuBhbc0nHKnrkuQ==}
+
+ '@vitest/utils@3.2.7':
+ resolution: {integrity: sha512-x6BDOd7dyo3PFLY3I9/HJ25X/6OurhGXk2/B9gOZNPF7XDVjeBK4k01lQE5uvDpbuheErh91qYuE1E2OEjK3Rw==}
+
+ agent-base@6.0.2:
+ resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+ engines: {node: '>= 6.0.0'}
+
+ assertion-error@2.0.1:
+ resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+ engines: {node: '>=12'}
+
+ asynckit@0.4.0:
+ resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+ axios@1.16.1:
+ resolution: {integrity: sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==}
base32.js@0.1.0:
resolution: {integrity: sha512-n3TkB02ixgBOhTvANakDb4xaMXnYUVkNoRFJjQflcqMQhyEKxEHdj3E6N8t8sUQ0mjH/3/JxzlXuz3ul/J90pQ==}
@@ -131,31 +470,48 @@ packages:
resolution: {integrity: sha512-ir1UPr3dkwexU7FdV8qBBbNDRUhMmIekYMFZfi+C/sLNnRESKPl23nB9b2pltqfOQNnGzsDdId90AEtG5tCx4A==}
engines: {node: '>=6.0.0'}
- bignumber.js@9.3.1:
- resolution: {integrity: sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==}
+ bignumber.js@11.1.3:
+ resolution: {integrity: sha512-+esZiNSo6VgFokTsYX6mYqNJfFd/IczzZCd4Z7cR8e+AQWhvIcj6nqQ1h9814D9u/TApU0jjTVmfWL0Pd1ZBdA==}
buffer@6.0.3:
resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+ cac@6.7.14:
+ resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
+ engines: {node: '>=8'}
+
call-bind-apply-helpers@1.0.2:
resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
engines: {node: '>= 0.4'}
- call-bind@1.0.8:
- resolution: {integrity: sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==}
- engines: {node: '>= 0.4'}
+ chai@5.3.3:
+ resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+ engines: {node: '>=18'}
- call-bound@1.0.4:
- resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
- engines: {node: '>= 0.4'}
+ check-error@2.1.3:
+ resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
+ engines: {node: '>= 16'}
combined-stream@1.0.8:
resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
engines: {node: '>= 0.8'}
- define-data-property@1.1.4:
- resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
- engines: {node: '>= 0.4'}
+ commander@14.0.3:
+ resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+ engines: {node: '>=20'}
+
+ debug@4.4.3:
+ resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+ engines: {node: '>=6.0'}
+ peerDependencies:
+ supports-color: '*'
+ peerDependenciesMeta:
+ supports-color:
+ optional: true
+
+ deep-eql@5.0.2:
+ resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+ engines: {node: '>=6'}
delayed-stream@1.0.0:
resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
@@ -173,6 +529,9 @@ packages:
resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
engines: {node: '>= 0.4'}
+ es-module-lexer@1.7.0:
+ resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
es-object-atoms@1.1.1:
resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
engines: {node: '>= 0.4'}
@@ -181,15 +540,44 @@ packages:
resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
engines: {node: '>= 0.4'}
- eventsource@2.0.2:
- resolution: {integrity: sha512-IzUmBGPR3+oUG9dUeXynyNmf91/3zUSJg1lCktzKw47OXuhco54U3r9B7O4XX+Rb1Itm9OZ2b0RkTs10bICOxA==}
+ esbuild@0.28.1:
+ resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
+ engines: {node: '>=18'}
+ hasBin: true
+
+ estree-walker@3.0.3:
+ resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
+ eventsource-parser@3.1.0:
+ resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
+ engines: {node: '>=18.0.0'}
+
+ eventsource@4.1.0:
+ resolution: {integrity: sha512-2GuF51iuHX6A9xdTccMTsNb7VO0lHZihApxhvQzJB5A03DvHDd2FQepodbMaztPBmBcE/ox7o2gqaxGhYB9LhQ==}
+ engines: {node: '>=20.0.0'}
+
+ expect-type@1.4.0:
+ resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
engines: {node: '>=12.0.0'}
+ fake-indexeddb@6.2.5:
+ resolution: {integrity: sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w==}
+ engines: {node: '>=18'}
+
+ fdir@6.5.0:
+ resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+ engines: {node: '>=12.0.0'}
+ peerDependencies:
+ picomatch: ^3 || ^4
+ peerDependenciesMeta:
+ picomatch:
+ optional: true
+
feaxios@0.0.23:
resolution: {integrity: sha512-eghR0A21fvbkcQBgZuMfQhrXxJzC0GNUGC9fXhBge33D+mFDTwl0aJ35zoQQn575BhyjQitRc5N4f+L4cP708g==}
- follow-redirects@1.15.9:
- resolution: {integrity: sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==}
+ follow-redirects@1.16.0:
+ resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
engines: {node: '>=4.0'}
peerDependencies:
debug: '*'
@@ -197,14 +585,15 @@ packages:
debug:
optional: true
- for-each@0.3.5:
- resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
- engines: {node: '>= 0.4'}
-
- form-data@4.0.4:
- resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==}
+ form-data@4.0.5:
+ resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
engines: {node: '>= 6'}
+ fsevents@2.3.3:
+ resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+ engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+ os: [darwin]
+
function-bind@1.1.2:
resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
@@ -220,9 +609,6 @@ packages:
resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
engines: {node: '>= 0.4'}
- has-property-descriptors@1.0.2:
- resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
-
has-symbols@1.1.0:
resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
engines: {node: '>= 0.4'}
@@ -235,26 +621,25 @@ packages:
resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
engines: {node: '>= 0.4'}
+ https-proxy-agent@5.0.1:
+ resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+ engines: {node: '>= 6'}
+
ieee754@1.2.1:
resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
- inherits@2.0.4:
- resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
-
- is-callable@1.2.7:
- resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
- engines: {node: '>= 0.4'}
-
is-retry-allowed@3.0.0:
resolution: {integrity: sha512-9xH0xvoggby+u0uGF7cZXdrutWiBiaFG8ZT4YFPXL8NzkyAwX3AKGLeFQLvzDpM430+nDFBZ1LHkie/8ocL06A==}
engines: {node: '>=12'}
- is-typed-array@1.1.15:
- resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
- engines: {node: '>= 0.4'}
+ js-tokens@9.0.1:
+ resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
- isarray@2.0.5:
- resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+ loupe@3.2.1:
+ resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
+
+ magic-string@0.30.21:
+ resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
math-intrinsics@1.1.0:
resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
@@ -268,53 +653,172 @@ packages:
resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
engines: {node: '>= 0.6'}
- possible-typed-array-names@1.1.0:
- resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
- engines: {node: '>= 0.4'}
+ ms@2.1.3:
+ resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
- proxy-from-env@1.1.0:
- resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
+ nanoid@3.3.15:
+ resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
+ engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+ hasBin: true
- randombytes@2.1.0:
- resolution: {integrity: sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==}
+ pathe@2.0.3:
+ resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
- safe-buffer@5.2.1:
- resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+ pathval@2.0.1:
+ resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
+ engines: {node: '>= 14.16'}
- set-function-length@1.2.2:
- resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
- engines: {node: '>= 0.4'}
+ picocolors@1.1.1:
+ resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+ picomatch@4.0.5:
+ resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+ engines: {node: '>=12'}
+
+ postcss@8.5.17:
+ resolution: {integrity: sha512-J7EF+8X+CzRPaJPOv9Ck2wNWJvGnnl3PcNPAdGg6GTLjyVpyQ0yATMSXRFRV01BviT/9Gwuc3rjEyJbDJG9a4w==}
+ engines: {node: ^10 || ^12 || >=14}
- sha.js@2.4.12:
- resolution: {integrity: sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==}
- engines: {node: '>= 0.10'}
+ proxy-from-env@2.1.0:
+ resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+ engines: {node: '>=10'}
+
+ rollup@4.62.2:
+ resolution: {integrity: sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==}
+ engines: {node: '>=18.0.0', npm: '>=8.0.0'}
hasBin: true
- to-buffer@1.2.1:
- resolution: {integrity: sha512-tB82LpAIWjhLYbqjx3X4zEeHN6M8CiuOEy2JY8SEQVdYRe3CCHOFaqrBW1doLDrfpWhplcW7BL+bO3/6S3pcDQ==}
- engines: {node: '>= 0.4'}
+ siginfo@2.0.0:
+ resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
- toml@3.0.0:
- resolution: {integrity: sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==}
+ smol-toml@1.6.1:
+ resolution: {integrity: sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==}
+ engines: {node: '>= 18'}
- typed-array-buffer@1.0.3:
- resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
- engines: {node: '>= 0.4'}
+ source-map-js@1.2.1:
+ resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+ engines: {node: '>=0.10.0'}
+
+ stackback@0.0.2:
+ resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
+ std-env@3.10.0:
+ resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+
+ strip-literal@3.1.0:
+ resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
+
+ tinybench@2.9.0:
+ resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+ tinyexec@0.3.2:
+ resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
+ tinyglobby@0.2.17:
+ resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+ engines: {node: '>=12.0.0'}
+
+ tinypool@1.1.1:
+ resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
+ engines: {node: ^18.0.0 || >=20.0.0}
+
+ tinyrainbow@2.0.0:
+ resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
+ engines: {node: '>=14.0.0'}
+
+ tinyspy@4.0.4:
+ resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
+ engines: {node: '>=14.0.0'}
typescript@5.9.2:
resolution: {integrity: sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==}
engines: {node: '>=14.17'}
hasBin: true
+ uint8array-extras@1.5.0:
+ resolution: {integrity: sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==}
+ engines: {node: '>=18'}
+
undici-types@7.13.0:
resolution: {integrity: sha512-Ov2Rr9Sx+fRgagJ5AX0qvItZG/JKKoBRAVITs1zk7IqZGTJUwgUr7qoYBpWwakpWilTZFM98rG/AFRocu10iIQ==}
- urijs@1.19.11:
- resolution: {integrity: sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==}
+ vite-node@3.2.4:
+ resolution: {integrity: sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==}
+ engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+ hasBin: true
- which-typed-array@1.1.19:
- resolution: {integrity: sha512-rEvr90Bck4WZt9HHFC4DJMsjvu7x+r6bImz0/BrbWb7A2djJ8hnZMrWnHo9F8ssv0OMErasDhftrfROTyqSDrw==}
- engines: {node: '>= 0.4'}
+ vite@7.3.6:
+ resolution: {integrity: sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==}
+ engines: {node: ^20.19.0 || >=22.12.0}
+ hasBin: true
+ peerDependencies:
+ '@types/node': ^20.19.0 || >=22.12.0
+ jiti: '>=1.21.0'
+ less: ^4.0.0
+ lightningcss: ^1.21.0
+ sass: ^1.70.0
+ sass-embedded: ^1.70.0
+ stylus: '>=0.54.8'
+ sugarss: ^5.0.0
+ terser: ^5.16.0
+ tsx: ^4.8.1
+ yaml: ^2.4.2
+ peerDependenciesMeta:
+ '@types/node':
+ optional: true
+ jiti:
+ optional: true
+ less:
+ optional: true
+ lightningcss:
+ optional: true
+ sass:
+ optional: true
+ sass-embedded:
+ optional: true
+ stylus:
+ optional: true
+ sugarss:
+ optional: true
+ terser:
+ optional: true
+ tsx:
+ optional: true
+ yaml:
+ optional: true
+
+ vitest@3.2.7:
+ resolution: {integrity: sha512-KrxIJ62Fd89gfysR4WotlgZABiz2dqFPgqGzX7s+CwsqLFomRH7777ZcrOD6+WVAh7khPQP41A+BKbpcJFrdEg==}
+ engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+ hasBin: true
+ peerDependencies:
+ '@edge-runtime/vm': '*'
+ '@types/debug': ^4.1.12
+ '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+ '@vitest/browser': 3.2.7
+ '@vitest/ui': 3.2.7
+ happy-dom: '*'
+ jsdom: '*'
+ peerDependenciesMeta:
+ '@edge-runtime/vm':
+ optional: true
+ '@types/debug':
+ optional: true
+ '@types/node':
+ optional: true
+ '@vitest/browser':
+ optional: true
+ '@vitest/ui':
+ optional: true
+ happy-dom:
+ optional: true
+ jsdom:
+ optional: true
+
+ why-is-node-running@2.3.0:
+ resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+ engines: {node: '>=8'}
+ hasBin: true
snapshots:
@@ -324,78 +828,278 @@ snapshots:
'@actions/io@1.1.3': {}
- '@noble/curves@1.9.7':
- dependencies:
- '@noble/hashes': 1.8.0
+ '@esbuild/aix-ppc64@0.28.1':
+ optional: true
+
+ '@esbuild/android-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/android-arm@0.28.1':
+ optional: true
+
+ '@esbuild/android-x64@0.28.1':
+ optional: true
+
+ '@esbuild/darwin-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/darwin-x64@0.28.1':
+ optional: true
+
+ '@esbuild/freebsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/freebsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-arm@0.28.1':
+ optional: true
+
+ '@esbuild/linux-ia32@0.28.1':
+ optional: true
- '@noble/hashes@1.8.0': {}
+ '@esbuild/linux-loong64@0.28.1':
+ optional: true
- '@openzeppelin/relayer-plugin-channels@0.5.0':
+ '@esbuild/linux-mips64el@0.28.1':
+ optional: true
+
+ '@esbuild/linux-ppc64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-riscv64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-s390x@0.28.1':
+ optional: true
+
+ '@esbuild/linux-x64@0.28.1':
+ optional: true
+
+ '@esbuild/netbsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/netbsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/openbsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/openbsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/openharmony-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/sunos-x64@0.28.1':
+ optional: true
+
+ '@esbuild/win32-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/win32-ia32@0.28.1':
+ optional: true
+
+ '@esbuild/win32-x64@0.28.1':
+ optional: true
+
+ '@jridgewell/sourcemap-codec@1.5.5': {}
+
+ '@noble/ed25519@3.1.0': {}
+
+ '@noble/hashes@2.2.0': {}
+
+ '@openzeppelin/relayer-plugin-channels@0.20.0':
dependencies:
'@actions/exec': 1.1.1
- '@openzeppelin/relayer-sdk': 1.8.0
- '@stellar/stellar-sdk': 14.2.0
- axios: 1.13.2
+ '@openzeppelin/relayer-sdk': 1.10.0
+ '@stellar/stellar-sdk': 16.0.1
+ axios: 1.16.1
transitivePeerDependencies:
- debug
+ - supports-color
- '@openzeppelin/relayer-sdk@1.8.0':
+ '@openzeppelin/relayer-sdk@1.10.0':
dependencies:
- axios: 1.13.2
+ axios: 1.16.1
transitivePeerDependencies:
- debug
+ - supports-color
+
+ '@rollup/rollup-android-arm-eabi@4.62.2':
+ optional: true
+
+ '@rollup/rollup-android-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-darwin-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-darwin-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-freebsd-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-freebsd-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-loong64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-loong64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+ optional: true
- '@simplewebauthn/browser@13.2.0': {}
+ '@rollup/rollup-linux-ppc64-musl@4.62.2':
+ optional: true
- '@stellar/js-xdr@3.1.2': {}
+ '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+ optional: true
- '@stellar/stellar-base@14.0.1':
+ '@rollup/rollup-linux-riscv64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-s390x-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-x64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-x64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-openbsd-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-openharmony-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-arm64-msvc@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-ia32-msvc@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-x64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-x64-msvc@4.62.2':
+ optional: true
+
+ '@simplewebauthn/browser@13.3.0': {}
+
+ '@stellar/js-xdr@4.0.0': {}
+
+ '@stellar/stellar-sdk@16.0.1':
dependencies:
- '@noble/curves': 1.9.7
- '@stellar/js-xdr': 3.1.2
+ '@noble/ed25519': 3.1.0
+ '@noble/hashes': 2.2.0
+ '@stellar/js-xdr': 4.0.0
+ axios: 1.16.1
base32.js: 0.1.0
- bignumber.js: 9.3.1
+ bignumber.js: 11.1.3
buffer: 6.0.3
- sha.js: 2.4.12
-
- '@stellar/stellar-sdk@14.2.0':
- dependencies:
- '@stellar/stellar-base': 14.0.1
- axios: 1.12.2
- bignumber.js: 9.3.1
- eventsource: 2.0.2
+ commander: 14.0.3
+ eventsource: 4.1.0
feaxios: 0.0.23
- randombytes: 2.1.0
- toml: 3.0.0
- urijs: 1.19.11
+ smol-toml: 1.6.1
+ uint8array-extras: 1.5.0
transitivePeerDependencies:
- debug
+ - supports-color
+
+ '@types/chai@5.2.3':
+ dependencies:
+ '@types/deep-eql': 4.0.2
+ assertion-error: 2.0.1
+
+ '@types/deep-eql@4.0.2': {}
+
+ '@types/estree@1.0.9': {}
'@types/node@24.6.0':
dependencies:
undici-types: 7.13.0
- asynckit@0.4.0: {}
+ '@vitest/expect@3.2.7':
+ dependencies:
+ '@types/chai': 5.2.3
+ '@vitest/spy': 3.2.7
+ '@vitest/utils': 3.2.7
+ chai: 5.3.3
+ tinyrainbow: 2.0.0
+
+ '@vitest/mocker@3.2.7(vite@7.3.6(@types/node@24.6.0))':
+ dependencies:
+ '@vitest/spy': 3.2.7
+ estree-walker: 3.0.3
+ magic-string: 0.30.21
+ optionalDependencies:
+ vite: 7.3.6(@types/node@24.6.0)
+
+ '@vitest/pretty-format@3.2.7':
+ dependencies:
+ tinyrainbow: 2.0.0
+
+ '@vitest/runner@3.2.7':
+ dependencies:
+ '@vitest/utils': 3.2.7
+ pathe: 2.0.3
+ strip-literal: 3.1.0
+
+ '@vitest/snapshot@3.2.7':
+ dependencies:
+ '@vitest/pretty-format': 3.2.7
+ magic-string: 0.30.21
+ pathe: 2.0.3
+
+ '@vitest/spy@3.2.7':
+ dependencies:
+ tinyspy: 4.0.4
- available-typed-arrays@1.0.7:
+ '@vitest/utils@3.2.7':
dependencies:
- possible-typed-array-names: 1.1.0
+ '@vitest/pretty-format': 3.2.7
+ loupe: 3.2.1
+ tinyrainbow: 2.0.0
- axios@1.12.2:
+ agent-base@6.0.2:
dependencies:
- follow-redirects: 1.15.9
- form-data: 4.0.4
- proxy-from-env: 1.1.0
+ debug: 4.4.3
transitivePeerDependencies:
- - debug
+ - supports-color
+
+ assertion-error@2.0.1: {}
+
+ asynckit@0.4.0: {}
- axios@1.13.2:
+ axios@1.16.1:
dependencies:
- follow-redirects: 1.15.9
- form-data: 4.0.4
- proxy-from-env: 1.1.0
+ follow-redirects: 1.16.0
+ form-data: 4.0.5
+ https-proxy-agent: 5.0.1
+ proxy-from-env: 2.1.0
transitivePeerDependencies:
- debug
+ - supports-color
base32.js@0.1.0: {}
@@ -403,39 +1107,41 @@ snapshots:
base64url@3.0.1: {}
- bignumber.js@9.3.1: {}
+ bignumber.js@11.1.3: {}
buffer@6.0.3:
dependencies:
base64-js: 1.5.1
ieee754: 1.2.1
+ cac@6.7.14: {}
+
call-bind-apply-helpers@1.0.2:
dependencies:
es-errors: 1.3.0
function-bind: 1.1.2
- call-bind@1.0.8:
+ chai@5.3.3:
dependencies:
- call-bind-apply-helpers: 1.0.2
- es-define-property: 1.0.1
- get-intrinsic: 1.3.0
- set-function-length: 1.2.2
+ assertion-error: 2.0.1
+ check-error: 2.1.3
+ deep-eql: 5.0.2
+ loupe: 3.2.1
+ pathval: 2.0.1
- call-bound@1.0.4:
- dependencies:
- call-bind-apply-helpers: 1.0.2
- get-intrinsic: 1.3.0
+ check-error@2.1.3: {}
combined-stream@1.0.8:
dependencies:
delayed-stream: 1.0.0
- define-data-property@1.1.4:
+ commander@14.0.3: {}
+
+ debug@4.4.3:
dependencies:
- es-define-property: 1.0.1
- es-errors: 1.3.0
- gopd: 1.2.0
+ ms: 2.1.3
+
+ deep-eql@5.0.2: {}
delayed-stream@1.0.0: {}
@@ -449,6 +1155,8 @@ snapshots:
es-errors@1.3.0: {}
+ es-module-lexer@1.7.0: {}
+
es-object-atoms@1.1.1:
dependencies:
es-errors: 1.3.0
@@ -460,19 +1168,60 @@ snapshots:
has-tostringtag: 1.0.2
hasown: 2.0.2
- eventsource@2.0.2: {}
+ esbuild@0.28.1:
+ optionalDependencies:
+ '@esbuild/aix-ppc64': 0.28.1
+ '@esbuild/android-arm': 0.28.1
+ '@esbuild/android-arm64': 0.28.1
+ '@esbuild/android-x64': 0.28.1
+ '@esbuild/darwin-arm64': 0.28.1
+ '@esbuild/darwin-x64': 0.28.1
+ '@esbuild/freebsd-arm64': 0.28.1
+ '@esbuild/freebsd-x64': 0.28.1
+ '@esbuild/linux-arm': 0.28.1
+ '@esbuild/linux-arm64': 0.28.1
+ '@esbuild/linux-ia32': 0.28.1
+ '@esbuild/linux-loong64': 0.28.1
+ '@esbuild/linux-mips64el': 0.28.1
+ '@esbuild/linux-ppc64': 0.28.1
+ '@esbuild/linux-riscv64': 0.28.1
+ '@esbuild/linux-s390x': 0.28.1
+ '@esbuild/linux-x64': 0.28.1
+ '@esbuild/netbsd-arm64': 0.28.1
+ '@esbuild/netbsd-x64': 0.28.1
+ '@esbuild/openbsd-arm64': 0.28.1
+ '@esbuild/openbsd-x64': 0.28.1
+ '@esbuild/openharmony-arm64': 0.28.1
+ '@esbuild/sunos-x64': 0.28.1
+ '@esbuild/win32-arm64': 0.28.1
+ '@esbuild/win32-ia32': 0.28.1
+ '@esbuild/win32-x64': 0.28.1
+
+ estree-walker@3.0.3:
+ dependencies:
+ '@types/estree': 1.0.9
- feaxios@0.0.23:
+ eventsource-parser@3.1.0: {}
+
+ eventsource@4.1.0:
dependencies:
- is-retry-allowed: 3.0.0
+ eventsource-parser: 3.1.0
+
+ expect-type@1.4.0: {}
+
+ fake-indexeddb@6.2.5: {}
- follow-redirects@1.15.9: {}
+ fdir@6.5.0(picomatch@4.0.5):
+ optionalDependencies:
+ picomatch: 4.0.5
- for-each@0.3.5:
+ feaxios@0.0.23:
dependencies:
- is-callable: 1.2.7
+ is-retry-allowed: 3.0.0
- form-data@4.0.4:
+ follow-redirects@1.16.0: {}
+
+ form-data@4.0.5:
dependencies:
asynckit: 0.4.0
combined-stream: 1.0.8
@@ -480,6 +1229,9 @@ snapshots:
hasown: 2.0.2
mime-types: 2.1.35
+ fsevents@2.3.3:
+ optional: true
+
function-bind@1.1.2: {}
get-intrinsic@1.3.0:
@@ -502,10 +1254,6 @@ snapshots:
gopd@1.2.0: {}
- has-property-descriptors@1.0.2:
- dependencies:
- es-define-property: 1.0.1
-
has-symbols@1.1.0: {}
has-tostringtag@1.0.2:
@@ -516,19 +1264,24 @@ snapshots:
dependencies:
function-bind: 1.1.2
+ https-proxy-agent@5.0.1:
+ dependencies:
+ agent-base: 6.0.2
+ debug: 4.4.3
+ transitivePeerDependencies:
+ - supports-color
+
ieee754@1.2.1: {}
- inherits@2.0.4: {}
+ is-retry-allowed@3.0.0: {}
- is-callable@1.2.7: {}
+ js-tokens@9.0.1: {}
- is-retry-allowed@3.0.0: {}
+ loupe@3.2.1: {}
- is-typed-array@1.1.15:
+ magic-string@0.30.21:
dependencies:
- which-typed-array: 1.1.19
-
- isarray@2.0.5: {}
+ '@jridgewell/sourcemap-codec': 1.5.5
math-intrinsics@1.1.0: {}
@@ -538,57 +1291,167 @@ snapshots:
dependencies:
mime-db: 1.52.0
- possible-typed-array-names@1.1.0: {}
+ ms@2.1.3: {}
- proxy-from-env@1.1.0: {}
+ nanoid@3.3.15: {}
- randombytes@2.1.0:
- dependencies:
- safe-buffer: 5.2.1
+ pathe@2.0.3: {}
- safe-buffer@5.2.1: {}
+ pathval@2.0.1: {}
- set-function-length@1.2.2:
- dependencies:
- define-data-property: 1.1.4
- es-errors: 1.3.0
- function-bind: 1.1.2
- get-intrinsic: 1.3.0
- gopd: 1.2.0
- has-property-descriptors: 1.0.2
+ picocolors@1.1.1: {}
- sha.js@2.4.12:
+ picomatch@4.0.5: {}
+
+ postcss@8.5.17:
dependencies:
- inherits: 2.0.4
- safe-buffer: 5.2.1
- to-buffer: 1.2.1
+ nanoid: 3.3.15
+ picocolors: 1.1.1
+ source-map-js: 1.2.1
+
+ proxy-from-env@2.1.0: {}
- to-buffer@1.2.1:
+ rollup@4.62.2:
+ dependencies:
+ '@types/estree': 1.0.9
+ optionalDependencies:
+ '@rollup/rollup-android-arm-eabi': 4.62.2
+ '@rollup/rollup-android-arm64': 4.62.2
+ '@rollup/rollup-darwin-arm64': 4.62.2
+ '@rollup/rollup-darwin-x64': 4.62.2
+ '@rollup/rollup-freebsd-arm64': 4.62.2
+ '@rollup/rollup-freebsd-x64': 4.62.2
+ '@rollup/rollup-linux-arm-gnueabihf': 4.62.2
+ '@rollup/rollup-linux-arm-musleabihf': 4.62.2
+ '@rollup/rollup-linux-arm64-gnu': 4.62.2
+ '@rollup/rollup-linux-arm64-musl': 4.62.2
+ '@rollup/rollup-linux-loong64-gnu': 4.62.2
+ '@rollup/rollup-linux-loong64-musl': 4.62.2
+ '@rollup/rollup-linux-ppc64-gnu': 4.62.2
+ '@rollup/rollup-linux-ppc64-musl': 4.62.2
+ '@rollup/rollup-linux-riscv64-gnu': 4.62.2
+ '@rollup/rollup-linux-riscv64-musl': 4.62.2
+ '@rollup/rollup-linux-s390x-gnu': 4.62.2
+ '@rollup/rollup-linux-x64-gnu': 4.62.2
+ '@rollup/rollup-linux-x64-musl': 4.62.2
+ '@rollup/rollup-openbsd-x64': 4.62.2
+ '@rollup/rollup-openharmony-arm64': 4.62.2
+ '@rollup/rollup-win32-arm64-msvc': 4.62.2
+ '@rollup/rollup-win32-ia32-msvc': 4.62.2
+ '@rollup/rollup-win32-x64-gnu': 4.62.2
+ '@rollup/rollup-win32-x64-msvc': 4.62.2
+ fsevents: 2.3.3
+
+ siginfo@2.0.0: {}
+
+ smol-toml@1.6.1: {}
+
+ source-map-js@1.2.1: {}
+
+ stackback@0.0.2: {}
+
+ std-env@3.10.0: {}
+
+ strip-literal@3.1.0:
dependencies:
- isarray: 2.0.5
- safe-buffer: 5.2.1
- typed-array-buffer: 1.0.3
+ js-tokens: 9.0.1
- toml@3.0.0: {}
+ tinybench@2.9.0: {}
- typed-array-buffer@1.0.3:
+ tinyexec@0.3.2: {}
+
+ tinyglobby@0.2.17:
dependencies:
- call-bound: 1.0.4
- es-errors: 1.3.0
- is-typed-array: 1.1.15
+ fdir: 6.5.0(picomatch@4.0.5)
+ picomatch: 4.0.5
+
+ tinypool@1.1.1: {}
+
+ tinyrainbow@2.0.0: {}
+
+ tinyspy@4.0.4: {}
typescript@5.9.2: {}
- undici-types@7.13.0: {}
+ uint8array-extras@1.5.0: {}
- urijs@1.19.11: {}
+ undici-types@7.13.0: {}
- which-typed-array@1.1.19:
+ vite-node@3.2.4(@types/node@24.6.0):
dependencies:
- available-typed-arrays: 1.0.7
- call-bind: 1.0.8
- call-bound: 1.0.4
- for-each: 0.3.5
- get-proto: 1.0.1
- gopd: 1.2.0
- has-tostringtag: 1.0.2
+ cac: 6.7.14
+ debug: 4.4.3
+ es-module-lexer: 1.7.0
+ pathe: 2.0.3
+ vite: 7.3.6(@types/node@24.6.0)
+ transitivePeerDependencies:
+ - '@types/node'
+ - jiti
+ - less
+ - lightningcss
+ - sass
+ - sass-embedded
+ - stylus
+ - sugarss
+ - supports-color
+ - terser
+ - tsx
+ - yaml
+
+ vite@7.3.6(@types/node@24.6.0):
+ dependencies:
+ esbuild: 0.28.1
+ fdir: 6.5.0(picomatch@4.0.5)
+ picomatch: 4.0.5
+ postcss: 8.5.17
+ rollup: 4.62.2
+ tinyglobby: 0.2.17
+ optionalDependencies:
+ '@types/node': 24.6.0
+ fsevents: 2.3.3
+
+ vitest@3.2.7(@types/node@24.6.0):
+ dependencies:
+ '@types/chai': 5.2.3
+ '@vitest/expect': 3.2.7
+ '@vitest/mocker': 3.2.7(vite@7.3.6(@types/node@24.6.0))
+ '@vitest/pretty-format': 3.2.7
+ '@vitest/runner': 3.2.7
+ '@vitest/snapshot': 3.2.7
+ '@vitest/spy': 3.2.7
+ '@vitest/utils': 3.2.7
+ chai: 5.3.3
+ debug: 4.4.3
+ expect-type: 1.4.0
+ magic-string: 0.30.21
+ pathe: 2.0.3
+ picomatch: 4.0.5
+ std-env: 3.10.0
+ tinybench: 2.9.0
+ tinyexec: 0.3.2
+ tinyglobby: 0.2.17
+ tinypool: 1.1.1
+ tinyrainbow: 2.0.0
+ vite: 7.3.6(@types/node@24.6.0)
+ vite-node: 3.2.4(@types/node@24.6.0)
+ why-is-node-running: 2.3.0
+ optionalDependencies:
+ '@types/node': 24.6.0
+ transitivePeerDependencies:
+ - jiti
+ - less
+ - lightningcss
+ - msw
+ - sass
+ - sass-embedded
+ - stylus
+ - sugarss
+ - supports-color
+ - terser
+ - tsx
+ - yaml
+
+ why-is-node-running@2.3.0:
+ dependencies:
+ siginfo: 2.0.0
+ stackback: 0.0.2
diff --git a/relayer-proxy/.dev.vars.example b/relayer-proxy/.dev.vars.example
new file mode 100644
index 0000000..8628bc3
--- /dev/null
+++ b/relayer-proxy/.dev.vars.example
@@ -0,0 +1,7 @@
+# passkey-kit relayer-proxy local overrides.
+# Copy to .dev.vars only if you want to override the wrangler.toml [vars]
+# defaults during `wrangler dev`. No secrets are required — the worker mints
+# Relayer API keys itself via the keyless /gen endpoint.
+
+NETWORK="testnet"
+RELAYER_BASE_URL="https://channels.openzeppelin.com/testnet"
diff --git a/relayer-proxy/.gitignore b/relayer-proxy/.gitignore
new file mode 100644
index 0000000..9a16be9
--- /dev/null
+++ b/relayer-proxy/.gitignore
@@ -0,0 +1,7 @@
+node_modules/
+dist/
+.wrangler/
+.dev.vars
+.dev.vars.*
+!.dev.vars.example
+*.log
diff --git a/relayer-proxy/README.md b/relayer-proxy/README.md
new file mode 100644
index 0000000..84a3e15
--- /dev/null
+++ b/relayer-proxy/README.md
@@ -0,0 +1,82 @@
+# passkey-kit relayer-proxy
+
+A Cloudflare Worker that fronts the [OpenZeppelin Relayer Channels](https://docs.openzeppelin.com/relayer/stellar)
+service so the browser can submit fee-sponsored transactions with **zero
+secrets in the bundle**. It mints and caches one Relayer API key per client IP,
+so `PasskeyKit`/`PasskeyServer` never ship a relayer key to the client.
+
+This replaces passkey-kit's old defect of inlining `VITE_relayerApiKey` into the
+demo's client JS (audit #597/#598).
+
+## How it works
+
+- **Keyless per-IP key minting.** On the first request from an IP the worker
+ calls the Relayer's unauthenticated `GET {RELAYER_BASE_URL}/gen` endpoint and
+ stores the returned key. Custody lives in a **per-IP Durable Object**
+ (`ApiKeyStore`, one instance per `CF-Connecting-IP`): its `blockConcurrencyWhile`
+ serializes get-or-create, so N concurrent first-requests from one IP mint at
+ most ONE key — the atomic get-or-create that KV cannot provide (no CAS). The
+ key persists indefinitely; the Relayer resets usage limits every 24h.
+- **Client IP** is taken ONLY from `CF-Connecting-IP` (always set at the CF
+ edge, unspoofable). `X-Forwarded-For` / `X-Real-IP` are client-controlled and
+ deliberately not trusted for key custody.
+- **Two submission modes** (`POST /`):
+ - `{ func, auth }` → `submitSorobanTransaction` — Relayer builds the tx with
+ channel accounts (Address credentials: transfers, wallet ops).
+ - `{ xdr }` → `submitTransaction` — Relayer fee-bumps an already-signed tx
+ (source-account auth: deploys).
+ Exactly one of the two must be present (400 otherwise).
+- **Error mapping**: `PluginExecutionError` → 400 `{error, data:{code,details}}`;
+ `PluginTransportError` → its `statusCode`; malformed JSON → 400; anything else
+ → 500. Success → `{ success: true, data: { transactionId, hash, status } }`.
+- **Testnet Friendbot retry**: if the Relayer reports a missing channel account
+ (after a testnet reset), the worker funds it via Friendbot and retries for up
+ to 5 minutes. Mainnet never retries (no Friendbot).
+
+## Endpoints
+
+| Method | Path | Purpose |
+|---|---|---|
+| GET | `/` | health: `{ status, service, network }` |
+| POST | `/` | submit: `{ func, auth } \| { xdr }` |
+| GET | `/status` | client IP, network, whether a key is cached |
+
+## Config
+
+`wrangler.toml`:
+
+- Testnet (default): `NETWORK=testnet`, `RELAYER_BASE_URL=https://channels.openzeppelin.com/testnet`.
+- Mainnet (`[env.production]`): `NETWORK=mainnet`, `RELAYER_BASE_URL=https://channels.openzeppelin.com`.
+- Durable Object binding `API_KEY_DO` → class `ApiKeyStore` (+ a `[[migrations]]`
+ entry), one per environment. No namespace id to provision — the class is bound
+ directly, and the DO is created on first use.
+
+No secrets are needed; the worker mints Relayer keys itself.
+
+## Develop / test
+
+```sh
+cd relayer-proxy
+pnpm install --ignore-workspace # or: npm install
+pnpm test # vitest — worker unit tests
+pnpm typecheck # tsc --noEmit
+pnpm dev # wrangler dev (local)
+```
+
+The tests mock `@openzeppelin/relayer-plugin-channels` and the DO namespace, and
+cover: IP extraction (CF-Connecting-IP only), mode validation, both submission
+paths, the three error mappings, testnet-vs-mainnet retry behavior, and the
+`ApiKeyStore` DO get-or-create logic (returns stored / mints from `/gen` /
+502-on-mint-failure / `/peek`).
+
+## Deploy
+
+> Deploys are orchestrator-gated (not run from the services todo).
+
+```sh
+pnpm deploy # testnet: wrangler deploy
+pnpm deploy:production # mainnet: wrangler deploy --env production
+```
+
+Relayer keys for live verification can be generated at
+`{RELAYER_BASE_URL}/gen` (testnet: `https://channels.openzeppelin.com/testnet/gen`).
diff --git a/relayer-proxy/package.json b/relayer-proxy/package.json
new file mode 100644
index 0000000..c65542e
--- /dev/null
+++ b/relayer-proxy/package.json
@@ -0,0 +1,23 @@
+{
+ "name": "passkey-kit-relayer-proxy",
+ "version": "1.0.0",
+ "private": true,
+ "type": "module",
+ "scripts": {
+ "dev": "wrangler dev",
+ "deploy": "wrangler deploy",
+ "deploy:production": "wrangler deploy --env production",
+ "test": "vitest run",
+ "typecheck": "tsc --noEmit"
+ },
+ "dependencies": {
+ "@openzeppelin/relayer-plugin-channels": "^0.20.0",
+ "hono": "^4.12.11"
+ },
+ "devDependencies": {
+ "@cloudflare/workers-types": "^4.20241202.0",
+ "typescript": "^5.7.2",
+ "vitest": "^2.1.8",
+ "wrangler": "^4.80.0"
+ }
+}
diff --git a/relayer-proxy/pnpm-lock.yaml b/relayer-proxy/pnpm-lock.yaml
new file mode 100644
index 0000000..ee99738
--- /dev/null
+++ b/relayer-proxy/pnpm-lock.yaml
@@ -0,0 +1,2279 @@
+lockfileVersion: '9.0'
+
+settings:
+ autoInstallPeers: true
+ excludeLinksFromLockfile: false
+
+importers:
+
+ .:
+ dependencies:
+ '@openzeppelin/relayer-plugin-channels':
+ specifier: ^0.20.0
+ version: 0.20.0
+ hono:
+ specifier: ^4.12.11
+ version: 4.12.29
+ devDependencies:
+ '@cloudflare/workers-types':
+ specifier: ^4.20241202.0
+ version: 4.20260702.1
+ typescript:
+ specifier: ^5.7.2
+ version: 5.9.3
+ vitest:
+ specifier: ^2.1.8
+ version: 2.1.9
+ wrangler:
+ specifier: ^4.80.0
+ version: 4.110.0(@cloudflare/workers-types@4.20260702.1)
+
+packages:
+
+ '@actions/exec@1.1.1':
+ resolution: {integrity: sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==}
+
+ '@actions/io@1.1.3':
+ resolution: {integrity: sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==}
+
+ '@cloudflare/kv-asset-handler@0.5.0':
+ resolution: {integrity: sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==}
+ engines: {node: '>=22.0.0'}
+
+ '@cloudflare/unenv-preset@2.16.1':
+ resolution: {integrity: sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==}
+ peerDependencies:
+ unenv: 2.0.0-rc.24
+ workerd: '>1.20260305.0 <2.0.0-0'
+ peerDependenciesMeta:
+ workerd:
+ optional: true
+
+ '@cloudflare/workerd-darwin-64@1.20260708.1':
+ resolution: {integrity: sha512-HXFCvhS1wpg3uXO0CLUwmwC41i2loM5FSK69EUchOBpmYBAXxT1oHLm6EOA5lqhTk5Mu9kjRiQYxa1GwKPwfJg==}
+ engines: {node: '>=16'}
+ cpu: [x64]
+ os: [darwin]
+
+ '@cloudflare/workerd-darwin-arm64@1.20260708.1':
+ resolution: {integrity: sha512-JVlJaKDoRTVKSroHIlf8g3UCPjKj4iDbMZE2CNYht5qQ+2rL0FAUiVlV82G3BqKnnw9kHYnnsMzC08b9zVtdzA==}
+ engines: {node: '>=16'}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@cloudflare/workerd-linux-64@1.20260708.1':
+ resolution: {integrity: sha512-3daE60YdD7YX0Jtuzc9DE/r/qMkmx8ZvHTkF8Mzmp3F5tbzlV0DAzmu5PFUPF2WuvtKbAhZKbvC2cHmWpQYxnA==}
+ engines: {node: '>=16'}
+ cpu: [x64]
+ os: [linux]
+
+ '@cloudflare/workerd-linux-arm64@1.20260708.1':
+ resolution: {integrity: sha512-VLdNYOx5Hj+9C6isy0ACWZsbMtSxex2DIJWEe7cZxUdlphZ58ZT8zxNXK8yunFiowd34hn3VwGMopdvdj8lvmA==}
+ engines: {node: '>=16'}
+ cpu: [arm64]
+ os: [linux]
+
+ '@cloudflare/workerd-windows-64@1.20260708.1':
+ resolution: {integrity: sha512-bC/aSAwLy16Vjo24i9XU3aWH+eRgz7NeR5xPKavGbembO18ZywYTQbXh14eXtY6fAqN3RzRG8psijTdhX4xydA==}
+ engines: {node: '>=16'}
+ cpu: [x64]
+ os: [win32]
+
+ '@cloudflare/workers-types@4.20260702.1':
+ resolution: {integrity: sha512-mOhf5TUEB1m2vPrxtqoIGfz0fUC9xyxRDx5gWHy5s+OCo6dcV+g7wI1R7gYCMFohhqF/2y2xeKVwMwCJjfn/WA==}
+
+ '@cspotcode/source-map-support@0.8.1':
+ resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
+ engines: {node: '>=12'}
+
+ '@emnapi/runtime@1.11.2':
+ resolution: {integrity: sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==}
+
+ '@esbuild/aix-ppc64@0.21.5':
+ resolution: {integrity: sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==}
+ engines: {node: '>=12'}
+ cpu: [ppc64]
+ os: [aix]
+
+ '@esbuild/aix-ppc64@0.28.1':
+ resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [aix]
+
+ '@esbuild/android-arm64@0.21.5':
+ resolution: {integrity: sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==}
+ engines: {node: '>=12'}
+ cpu: [arm64]
+ os: [android]
+
+ '@esbuild/android-arm64@0.28.1':
+ resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [android]
+
+ '@esbuild/android-arm@0.21.5':
+ resolution: {integrity: sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==}
+ engines: {node: '>=12'}
+ cpu: [arm]
+ os: [android]
+
+ '@esbuild/android-arm@0.28.1':
+ resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [android]
+
+ '@esbuild/android-x64@0.21.5':
+ resolution: {integrity: sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [android]
+
+ '@esbuild/android-x64@0.28.1':
+ resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [android]
+
+ '@esbuild/darwin-arm64@0.21.5':
+ resolution: {integrity: sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==}
+ engines: {node: '>=12'}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@esbuild/darwin-arm64@0.28.1':
+ resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@esbuild/darwin-x64@0.21.5':
+ resolution: {integrity: sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [darwin]
+
+ '@esbuild/darwin-x64@0.28.1':
+ resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [darwin]
+
+ '@esbuild/freebsd-arm64@0.21.5':
+ resolution: {integrity: sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==}
+ engines: {node: '>=12'}
+ cpu: [arm64]
+ os: [freebsd]
+
+ '@esbuild/freebsd-arm64@0.28.1':
+ resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [freebsd]
+
+ '@esbuild/freebsd-x64@0.21.5':
+ resolution: {integrity: sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@esbuild/freebsd-x64@0.28.1':
+ resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@esbuild/linux-arm64@0.21.5':
+ resolution: {integrity: sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==}
+ engines: {node: '>=12'}
+ cpu: [arm64]
+ os: [linux]
+
+ '@esbuild/linux-arm64@0.28.1':
+ resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [linux]
+
+ '@esbuild/linux-arm@0.21.5':
+ resolution: {integrity: sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==}
+ engines: {node: '>=12'}
+ cpu: [arm]
+ os: [linux]
+
+ '@esbuild/linux-arm@0.28.1':
+ resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
+ engines: {node: '>=18'}
+ cpu: [arm]
+ os: [linux]
+
+ '@esbuild/linux-ia32@0.21.5':
+ resolution: {integrity: sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==}
+ engines: {node: '>=12'}
+ cpu: [ia32]
+ os: [linux]
+
+ '@esbuild/linux-ia32@0.28.1':
+ resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [linux]
+
+ '@esbuild/linux-loong64@0.21.5':
+ resolution: {integrity: sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==}
+ engines: {node: '>=12'}
+ cpu: [loong64]
+ os: [linux]
+
+ '@esbuild/linux-loong64@0.28.1':
+ resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
+ engines: {node: '>=18'}
+ cpu: [loong64]
+ os: [linux]
+
+ '@esbuild/linux-mips64el@0.21.5':
+ resolution: {integrity: sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==}
+ engines: {node: '>=12'}
+ cpu: [mips64el]
+ os: [linux]
+
+ '@esbuild/linux-mips64el@0.28.1':
+ resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
+ engines: {node: '>=18'}
+ cpu: [mips64el]
+ os: [linux]
+
+ '@esbuild/linux-ppc64@0.21.5':
+ resolution: {integrity: sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==}
+ engines: {node: '>=12'}
+ cpu: [ppc64]
+ os: [linux]
+
+ '@esbuild/linux-ppc64@0.28.1':
+ resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
+ engines: {node: '>=18'}
+ cpu: [ppc64]
+ os: [linux]
+
+ '@esbuild/linux-riscv64@0.21.5':
+ resolution: {integrity: sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==}
+ engines: {node: '>=12'}
+ cpu: [riscv64]
+ os: [linux]
+
+ '@esbuild/linux-riscv64@0.28.1':
+ resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
+ engines: {node: '>=18'}
+ cpu: [riscv64]
+ os: [linux]
+
+ '@esbuild/linux-s390x@0.21.5':
+ resolution: {integrity: sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==}
+ engines: {node: '>=12'}
+ cpu: [s390x]
+ os: [linux]
+
+ '@esbuild/linux-s390x@0.28.1':
+ resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
+ engines: {node: '>=18'}
+ cpu: [s390x]
+ os: [linux]
+
+ '@esbuild/linux-x64@0.21.5':
+ resolution: {integrity: sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [linux]
+
+ '@esbuild/linux-x64@0.28.1':
+ resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [linux]
+
+ '@esbuild/netbsd-arm64@0.28.1':
+ resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [netbsd]
+
+ '@esbuild/netbsd-x64@0.21.5':
+ resolution: {integrity: sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [netbsd]
+
+ '@esbuild/netbsd-x64@0.28.1':
+ resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [netbsd]
+
+ '@esbuild/openbsd-arm64@0.28.1':
+ resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openbsd]
+
+ '@esbuild/openbsd-x64@0.21.5':
+ resolution: {integrity: sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [openbsd]
+
+ '@esbuild/openbsd-x64@0.28.1':
+ resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [openbsd]
+
+ '@esbuild/openharmony-arm64@0.28.1':
+ resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [openharmony]
+
+ '@esbuild/sunos-x64@0.21.5':
+ resolution: {integrity: sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [sunos]
+
+ '@esbuild/sunos-x64@0.28.1':
+ resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [sunos]
+
+ '@esbuild/win32-arm64@0.21.5':
+ resolution: {integrity: sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==}
+ engines: {node: '>=12'}
+ cpu: [arm64]
+ os: [win32]
+
+ '@esbuild/win32-arm64@0.28.1':
+ resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
+ engines: {node: '>=18'}
+ cpu: [arm64]
+ os: [win32]
+
+ '@esbuild/win32-ia32@0.21.5':
+ resolution: {integrity: sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==}
+ engines: {node: '>=12'}
+ cpu: [ia32]
+ os: [win32]
+
+ '@esbuild/win32-ia32@0.28.1':
+ resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
+ engines: {node: '>=18'}
+ cpu: [ia32]
+ os: [win32]
+
+ '@esbuild/win32-x64@0.21.5':
+ resolution: {integrity: sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==}
+ engines: {node: '>=12'}
+ cpu: [x64]
+ os: [win32]
+
+ '@esbuild/win32-x64@0.28.1':
+ resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
+ engines: {node: '>=18'}
+ cpu: [x64]
+ os: [win32]
+
+ '@img/colour@1.1.0':
+ resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+ engines: {node: '>=18'}
+
+ '@img/sharp-darwin-arm64@0.34.5':
+ resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@img/sharp-darwin-x64@0.34.5':
+ resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [x64]
+ os: [darwin]
+
+ '@img/sharp-libvips-darwin-arm64@1.2.4':
+ resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@img/sharp-libvips-darwin-x64@1.2.4':
+ resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
+ cpu: [x64]
+ os: [darwin]
+
+ '@img/sharp-libvips-linux-arm64@1.2.4':
+ resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linux-arm@1.2.4':
+ resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
+ cpu: [arm]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linux-ppc64@1.2.4':
+ resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linux-riscv64@1.2.4':
+ resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linux-s390x@1.2.4':
+ resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linux-x64@1.2.4':
+ resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+ resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+ resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@img/sharp-linux-arm64@0.34.5':
+ resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-arm@0.34.5':
+ resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [arm]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-ppc64@0.34.5':
+ resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-riscv64@0.34.5':
+ resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-s390x@0.34.5':
+ resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linux-x64@0.34.5':
+ resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@img/sharp-linuxmusl-arm64@0.34.5':
+ resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@img/sharp-linuxmusl-x64@0.34.5':
+ resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@img/sharp-wasm32@0.34.5':
+ resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [wasm32]
+
+ '@img/sharp-win32-arm64@0.34.5':
+ resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [arm64]
+ os: [win32]
+
+ '@img/sharp-win32-ia32@0.34.5':
+ resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [ia32]
+ os: [win32]
+
+ '@img/sharp-win32-x64@0.34.5':
+ resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+ cpu: [x64]
+ os: [win32]
+
+ '@jridgewell/resolve-uri@3.1.2':
+ resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+ engines: {node: '>=6.0.0'}
+
+ '@jridgewell/sourcemap-codec@1.5.5':
+ resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+ '@jridgewell/trace-mapping@0.3.9':
+ resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
+
+ '@noble/curves@1.9.7':
+ resolution: {integrity: sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==}
+ engines: {node: ^14.21.3 || >=16}
+
+ '@noble/hashes@1.8.0':
+ resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+ engines: {node: ^14.21.3 || >=16}
+
+ '@openzeppelin/relayer-plugin-channels@0.20.0':
+ resolution: {integrity: sha512-buZ0Xcir1mPcevMBU3vzbq4v77YUsikWX+E1k31YxdE6p97GEn40RnxNzow/eLNVnS3WNwYZ1SuEZgsQE7KHAg==}
+ engines: {node: '>=22.18.0', npm: use pnpm, pnpm: '>=9', yarn: use pnpm}
+
+ '@openzeppelin/relayer-sdk@1.10.0':
+ resolution: {integrity: sha512-C7v4C63VnFR4keISicpcDf4Ix646sa1OdokzddFeSPEGlJIY2b/XJ9sIWiXOBVJVGzbB+RdX3/fbkygAPhcVNw==}
+ engines: {node: '>=22.14.0', npm: use pnpm, pnpm: '>=9', yarn: use pnpm}
+
+ '@poppinss/colors@4.1.6':
+ resolution: {integrity: sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==}
+
+ '@poppinss/dumper@0.6.5':
+ resolution: {integrity: sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==}
+
+ '@poppinss/exception@1.2.3':
+ resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
+
+ '@rollup/rollup-android-arm-eabi@4.62.2':
+ resolution: {integrity: sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==}
+ cpu: [arm]
+ os: [android]
+
+ '@rollup/rollup-android-arm64@4.62.2':
+ resolution: {integrity: sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==}
+ cpu: [arm64]
+ os: [android]
+
+ '@rollup/rollup-darwin-arm64@4.62.2':
+ resolution: {integrity: sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==}
+ cpu: [arm64]
+ os: [darwin]
+
+ '@rollup/rollup-darwin-x64@4.62.2':
+ resolution: {integrity: sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==}
+ cpu: [x64]
+ os: [darwin]
+
+ '@rollup/rollup-freebsd-arm64@4.62.2':
+ resolution: {integrity: sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==}
+ cpu: [arm64]
+ os: [freebsd]
+
+ '@rollup/rollup-freebsd-x64@4.62.2':
+ resolution: {integrity: sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==}
+ cpu: [x64]
+ os: [freebsd]
+
+ '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+ resolution: {integrity: sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==}
+ cpu: [arm]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+ resolution: {integrity: sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==}
+ cpu: [arm]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-arm64-gnu@4.62.2':
+ resolution: {integrity: sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-arm64-musl@4.62.2':
+ resolution: {integrity: sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==}
+ cpu: [arm64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-loong64-gnu@4.62.2':
+ resolution: {integrity: sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==}
+ cpu: [loong64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-loong64-musl@4.62.2':
+ resolution: {integrity: sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==}
+ cpu: [loong64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+ resolution: {integrity: sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-ppc64-musl@4.62.2':
+ resolution: {integrity: sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==}
+ cpu: [ppc64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+ resolution: {integrity: sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-riscv64-musl@4.62.2':
+ resolution: {integrity: sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==}
+ cpu: [riscv64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-linux-s390x-gnu@4.62.2':
+ resolution: {integrity: sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==}
+ cpu: [s390x]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-x64-gnu@4.62.2':
+ resolution: {integrity: sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==}
+ cpu: [x64]
+ os: [linux]
+ libc: [glibc]
+
+ '@rollup/rollup-linux-x64-musl@4.62.2':
+ resolution: {integrity: sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==}
+ cpu: [x64]
+ os: [linux]
+ libc: [musl]
+
+ '@rollup/rollup-openbsd-x64@4.62.2':
+ resolution: {integrity: sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==}
+ cpu: [x64]
+ os: [openbsd]
+
+ '@rollup/rollup-openharmony-arm64@4.62.2':
+ resolution: {integrity: sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==}
+ cpu: [arm64]
+ os: [openharmony]
+
+ '@rollup/rollup-win32-arm64-msvc@4.62.2':
+ resolution: {integrity: sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==}
+ cpu: [arm64]
+ os: [win32]
+
+ '@rollup/rollup-win32-ia32-msvc@4.62.2':
+ resolution: {integrity: sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==}
+ cpu: [ia32]
+ os: [win32]
+
+ '@rollup/rollup-win32-x64-gnu@4.62.2':
+ resolution: {integrity: sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==}
+ cpu: [x64]
+ os: [win32]
+
+ '@rollup/rollup-win32-x64-msvc@4.62.2':
+ resolution: {integrity: sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==}
+ cpu: [x64]
+ os: [win32]
+
+ '@sindresorhus/is@7.2.0':
+ resolution: {integrity: sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==}
+ engines: {node: '>=18'}
+
+ '@speed-highlight/core@1.2.17':
+ resolution: {integrity: sha512-Z92FwKpCtfaW1V0jTU/fh3QzYEZN8wDwrzRIBoADCJfn4mJCNcJN/XegifX7BDrQ8/h9Xh/JnbyMchL0FqXrkg==}
+
+ '@stellar/js-xdr@3.1.2':
+ resolution: {integrity: sha512-VVolPL5goVEIsvuGqDc5uiKxV03lzfWdvYg1KikvwheDmTBO68CKDji3bAZ/kppZrx5iTA8z3Ld5yuytcvhvOQ==}
+
+ '@stellar/stellar-base@14.1.0':
+ resolution: {integrity: sha512-A8kFli6QGy22SRF45IjgPAJfUNGjnI+R7g4DF5NZYVsD1kGf7B4ITyc4OPclLV9tqNI4/lXxafGEw0JEUbHixw==}
+ engines: {node: '>=20.0.0'}
+ deprecated: This package is now rolled into @stellar/stellar-sdk. Please use @stellar/stellar-sdk to continue receiving updates and support.
+
+ '@stellar/stellar-sdk@14.6.1':
+ resolution: {integrity: sha512-A1rQWDLdUasXkMXnYSuhgep+3ZZzyuXJKdt5/KAIc0gkmSp906HTvUpbT4pu+bVr41tu0+J4Ugz9J4BQAGGytg==}
+ engines: {node: '>=20.0.0'}
+ hasBin: true
+
+ '@types/estree@1.0.9':
+ resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+ '@vitest/expect@2.1.9':
+ resolution: {integrity: sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==}
+
+ '@vitest/mocker@2.1.9':
+ resolution: {integrity: sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==}
+ peerDependencies:
+ msw: ^2.4.9
+ vite: ^5.0.0
+ peerDependenciesMeta:
+ msw:
+ optional: true
+ vite:
+ optional: true
+
+ '@vitest/pretty-format@2.1.9':
+ resolution: {integrity: sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==}
+
+ '@vitest/runner@2.1.9':
+ resolution: {integrity: sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==}
+
+ '@vitest/snapshot@2.1.9':
+ resolution: {integrity: sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==}
+
+ '@vitest/spy@2.1.9':
+ resolution: {integrity: sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==}
+
+ '@vitest/utils@2.1.9':
+ resolution: {integrity: sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==}
+
+ agent-base@6.0.2:
+ resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+ engines: {node: '>= 6.0.0'}
+
+ assertion-error@2.0.1:
+ resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+ engines: {node: '>=12'}
+
+ asynckit@0.4.0:
+ resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+ available-typed-arrays@1.0.7:
+ resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+ engines: {node: '>= 0.4'}
+
+ axios@1.18.1:
+ resolution: {integrity: sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==}
+
+ base32.js@0.1.0:
+ resolution: {integrity: sha512-n3TkB02ixgBOhTvANakDb4xaMXnYUVkNoRFJjQflcqMQhyEKxEHdj3E6N8t8sUQ0mjH/3/JxzlXuz3ul/J90pQ==}
+ engines: {node: '>=0.12.0'}
+
+ base64-js@1.5.1:
+ resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+
+ bignumber.js@9.3.1:
+ resolution: {integrity: sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==}
+
+ blake3-wasm@2.1.5:
+ resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
+
+ buffer@6.0.3:
+ resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+ cac@6.7.14:
+ resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
+ engines: {node: '>=8'}
+
+ call-bind-apply-helpers@1.0.2:
+ resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+ engines: {node: '>= 0.4'}
+
+ call-bind@1.0.9:
+ resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+ engines: {node: '>= 0.4'}
+
+ call-bound@1.0.4:
+ resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+ engines: {node: '>= 0.4'}
+
+ chai@5.3.3:
+ resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+ engines: {node: '>=18'}
+
+ check-error@2.1.3:
+ resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
+ engines: {node: '>= 16'}
+
+ combined-stream@1.0.8:
+ resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+ engines: {node: '>= 0.8'}
+
+ commander@14.0.3:
+ resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+ engines: {node: '>=20'}
+
+ cookie@1.1.1:
+ resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+ engines: {node: '>=18'}
+
+ debug@4.4.3:
+ resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+ engines: {node: '>=6.0'}
+ peerDependencies:
+ supports-color: '*'
+ peerDependenciesMeta:
+ supports-color:
+ optional: true
+
+ deep-eql@5.0.2:
+ resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+ engines: {node: '>=6'}
+
+ define-data-property@1.1.4:
+ resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+ engines: {node: '>= 0.4'}
+
+ delayed-stream@1.0.0:
+ resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+ engines: {node: '>=0.4.0'}
+
+ detect-libc@2.1.2:
+ resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+ engines: {node: '>=8'}
+
+ dunder-proto@1.0.1:
+ resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+ engines: {node: '>= 0.4'}
+
+ error-stack-parser-es@1.0.5:
+ resolution: {integrity: sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==}
+
+ es-define-property@1.0.1:
+ resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+ engines: {node: '>= 0.4'}
+
+ es-errors@1.3.0:
+ resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+ engines: {node: '>= 0.4'}
+
+ es-module-lexer@1.7.0:
+ resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
+ es-object-atoms@1.1.2:
+ resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+ engines: {node: '>= 0.4'}
+
+ es-set-tostringtag@2.1.0:
+ resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+ engines: {node: '>= 0.4'}
+
+ esbuild@0.21.5:
+ resolution: {integrity: sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==}
+ engines: {node: '>=12'}
+ hasBin: true
+
+ esbuild@0.28.1:
+ resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
+ engines: {node: '>=18'}
+ hasBin: true
+
+ estree-walker@3.0.3:
+ resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
+ eventsource@2.0.2:
+ resolution: {integrity: sha512-IzUmBGPR3+oUG9dUeXynyNmf91/3zUSJg1lCktzKw47OXuhco54U3r9B7O4XX+Rb1Itm9OZ2b0RkTs10bICOxA==}
+ engines: {node: '>=12.0.0'}
+
+ expect-type@1.4.0:
+ resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
+ engines: {node: '>=12.0.0'}
+
+ feaxios@0.0.23:
+ resolution: {integrity: sha512-eghR0A21fvbkcQBgZuMfQhrXxJzC0GNUGC9fXhBge33D+mFDTwl0aJ35zoQQn575BhyjQitRc5N4f+L4cP708g==}
+
+ follow-redirects@1.16.0:
+ resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
+ engines: {node: '>=4.0'}
+ peerDependencies:
+ debug: '*'
+ peerDependenciesMeta:
+ debug:
+ optional: true
+
+ for-each@0.3.5:
+ resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+ engines: {node: '>= 0.4'}
+
+ form-data@4.0.6:
+ resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
+ engines: {node: '>= 6'}
+
+ fsevents@2.3.3:
+ resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+ engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+ os: [darwin]
+
+ function-bind@1.1.2:
+ resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+ get-intrinsic@1.3.0:
+ resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+ engines: {node: '>= 0.4'}
+
+ get-proto@1.0.1:
+ resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+ engines: {node: '>= 0.4'}
+
+ gopd@1.2.0:
+ resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+ engines: {node: '>= 0.4'}
+
+ has-property-descriptors@1.0.2:
+ resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+ has-symbols@1.1.0:
+ resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+ engines: {node: '>= 0.4'}
+
+ has-tostringtag@1.0.2:
+ resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+ engines: {node: '>= 0.4'}
+
+ hasown@2.0.4:
+ resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+ engines: {node: '>= 0.4'}
+
+ hono@4.12.29:
+ resolution: {integrity: sha512-1hNiRjawYrLq/4m3DQQjPGFg0VZkk4RjQJDff/excI6Dm9BiL75qxGrd7/c6YOxPdq6AscP3LiXhQ6fKFC1Waw==}
+ engines: {node: '>=16.9.0'}
+
+ https-proxy-agent@5.0.1:
+ resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+ engines: {node: '>= 6'}
+
+ ieee754@1.2.1:
+ resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
+ inherits@2.0.4:
+ resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+ is-callable@1.2.7:
+ resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+ engines: {node: '>= 0.4'}
+
+ is-retry-allowed@3.0.0:
+ resolution: {integrity: sha512-9xH0xvoggby+u0uGF7cZXdrutWiBiaFG8ZT4YFPXL8NzkyAwX3AKGLeFQLvzDpM430+nDFBZ1LHkie/8ocL06A==}
+ engines: {node: '>=12'}
+
+ is-typed-array@1.1.15:
+ resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+ engines: {node: '>= 0.4'}
+
+ isarray@2.0.5:
+ resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
+ kleur@4.1.5:
+ resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
+ engines: {node: '>=6'}
+
+ loupe@3.2.1:
+ resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
+
+ magic-string@0.30.21:
+ resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+ math-intrinsics@1.1.0:
+ resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+ engines: {node: '>= 0.4'}
+
+ mime-db@1.52.0:
+ resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+ engines: {node: '>= 0.6'}
+
+ mime-types@2.1.35:
+ resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+ engines: {node: '>= 0.6'}
+
+ miniflare@4.20260708.1:
+ resolution: {integrity: sha512-c94O9zRDISdqO18EHt6l0iF/fWgWt8p18PJvRsA/L/NJZ9Cfke3s/F5Blg1XXF7WDutVRzWVWy8Vy4LaT5ifsA==}
+ engines: {node: '>=22.0.0'}
+ hasBin: true
+
+ ms@2.1.3:
+ resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+ nanoid@3.3.15:
+ resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
+ engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+ hasBin: true
+
+ path-to-regexp@6.3.0:
+ resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
+ pathe@1.1.2:
+ resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
+
+ pathe@2.0.3:
+ resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+ pathval@2.0.1:
+ resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
+ engines: {node: '>= 14.16'}
+
+ picocolors@1.1.1:
+ resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+ possible-typed-array-names@1.1.0:
+ resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+ engines: {node: '>= 0.4'}
+
+ postcss@8.5.17:
+ resolution: {integrity: sha512-J7EF+8X+CzRPaJPOv9Ck2wNWJvGnnl3PcNPAdGg6GTLjyVpyQ0yATMSXRFRV01BviT/9Gwuc3rjEyJbDJG9a4w==}
+ engines: {node: ^10 || ^12 || >=14}
+
+ proxy-from-env@2.1.0:
+ resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
+ engines: {node: '>=10'}
+
+ randombytes@2.1.0:
+ resolution: {integrity: sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==}
+
+ rollup@4.62.2:
+ resolution: {integrity: sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==}
+ engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+ hasBin: true
+
+ safe-buffer@5.2.1:
+ resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+ semver@7.8.5:
+ resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+ engines: {node: '>=10'}
+ hasBin: true
+
+ set-function-length@1.2.2:
+ resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+ engines: {node: '>= 0.4'}
+
+ sha.js@2.4.12:
+ resolution: {integrity: sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==}
+ engines: {node: '>= 0.10'}
+ hasBin: true
+
+ sharp@0.34.5:
+ resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
+ engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+
+ siginfo@2.0.0:
+ resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
+ source-map-js@1.2.1:
+ resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+ engines: {node: '>=0.10.0'}
+
+ stackback@0.0.2:
+ resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
+ std-env@3.10.0:
+ resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+
+ supports-color@10.2.2:
+ resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+ engines: {node: '>=18'}
+
+ tinybench@2.9.0:
+ resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+ tinyexec@0.3.2:
+ resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
+ tinypool@1.1.1:
+ resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
+ engines: {node: ^18.0.0 || >=20.0.0}
+
+ tinyrainbow@1.2.0:
+ resolution: {integrity: sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==}
+ engines: {node: '>=14.0.0'}
+
+ tinyspy@3.0.2:
+ resolution: {integrity: sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==}
+ engines: {node: '>=14.0.0'}
+
+ to-buffer@1.2.2:
+ resolution: {integrity: sha512-db0E3UJjcFhpDhAF4tLo03oli3pwl3dbnzXOUIlRKrp+ldk/VUxzpWYZENsw2SZiuBjHAk7DfB0VU7NKdpb6sw==}
+ engines: {node: '>= 0.4'}
+
+ toml@3.0.0:
+ resolution: {integrity: sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==}
+
+ tslib@2.8.1:
+ resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+ typed-array-buffer@1.0.3:
+ resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+ engines: {node: '>= 0.4'}
+
+ typescript@5.9.3:
+ resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+ engines: {node: '>=14.17'}
+ hasBin: true
+
+ undici@7.28.0:
+ resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+ engines: {node: '>=20.18.1'}
+
+ unenv@2.0.0-rc.24:
+ resolution: {integrity: sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==}
+
+ urijs@1.19.11:
+ resolution: {integrity: sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==}
+
+ vite-node@2.1.9:
+ resolution: {integrity: sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==}
+ engines: {node: ^18.0.0 || >=20.0.0}
+ hasBin: true
+
+ vite@5.4.21:
+ resolution: {integrity: sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==}
+ engines: {node: ^18.0.0 || >=20.0.0}
+ hasBin: true
+ peerDependencies:
+ '@types/node': ^18.0.0 || >=20.0.0
+ less: '*'
+ lightningcss: ^1.21.0
+ sass: '*'
+ sass-embedded: '*'
+ stylus: '*'
+ sugarss: '*'
+ terser: ^5.4.0
+ peerDependenciesMeta:
+ '@types/node':
+ optional: true
+ less:
+ optional: true
+ lightningcss:
+ optional: true
+ sass:
+ optional: true
+ sass-embedded:
+ optional: true
+ stylus:
+ optional: true
+ sugarss:
+ optional: true
+ terser:
+ optional: true
+
+ vitest@2.1.9:
+ resolution: {integrity: sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==}
+ engines: {node: ^18.0.0 || >=20.0.0}
+ hasBin: true
+ peerDependencies:
+ '@edge-runtime/vm': '*'
+ '@types/node': ^18.0.0 || >=20.0.0
+ '@vitest/browser': 2.1.9
+ '@vitest/ui': 2.1.9
+ happy-dom: '*'
+ jsdom: '*'
+ peerDependenciesMeta:
+ '@edge-runtime/vm':
+ optional: true
+ '@types/node':
+ optional: true
+ '@vitest/browser':
+ optional: true
+ '@vitest/ui':
+ optional: true
+ happy-dom:
+ optional: true
+ jsdom:
+ optional: true
+
+ which-typed-array@1.1.22:
+ resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
+ engines: {node: '>= 0.4'}
+
+ why-is-node-running@2.3.0:
+ resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+ engines: {node: '>=8'}
+ hasBin: true
+
+ workerd@1.20260708.1:
+ resolution: {integrity: sha512-WAK+Kt/VVCSldH2qSr8lx46XCJ4Q+bdlHNaFqUtOHthBEIB8C1N8HVW+VOLrxDoTCk0NGNv0zajnBeQK4JOB9w==}
+ engines: {node: '>=16'}
+ hasBin: true
+
+ wrangler@4.110.0:
+ resolution: {integrity: sha512-xZeXKYi7hxQRF5anL+v77RkufJNpF9f3Eqeyqq2QBsETpLZgh0Agj0jJ6JPtkbgn6ukZdh8OK5egsGPWIditgg==}
+ engines: {node: '>=22.0.0'}
+ hasBin: true
+ peerDependencies:
+ '@cloudflare/workers-types': ^5.20260708.1
+ peerDependenciesMeta:
+ '@cloudflare/workers-types':
+ optional: true
+
+ ws@8.21.0:
+ resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
+ engines: {node: '>=10.0.0'}
+ peerDependencies:
+ bufferutil: ^4.0.1
+ utf-8-validate: '>=5.0.2'
+ peerDependenciesMeta:
+ bufferutil:
+ optional: true
+ utf-8-validate:
+ optional: true
+
+ youch-core@0.3.3:
+ resolution: {integrity: sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==}
+
+ youch@4.1.0-beta.10:
+ resolution: {integrity: sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==}
+
+snapshots:
+
+ '@actions/exec@1.1.1':
+ dependencies:
+ '@actions/io': 1.1.3
+
+ '@actions/io@1.1.3': {}
+
+ '@cloudflare/kv-asset-handler@0.5.0': {}
+
+ '@cloudflare/unenv-preset@2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260708.1)':
+ dependencies:
+ unenv: 2.0.0-rc.24
+ optionalDependencies:
+ workerd: 1.20260708.1
+
+ '@cloudflare/workerd-darwin-64@1.20260708.1':
+ optional: true
+
+ '@cloudflare/workerd-darwin-arm64@1.20260708.1':
+ optional: true
+
+ '@cloudflare/workerd-linux-64@1.20260708.1':
+ optional: true
+
+ '@cloudflare/workerd-linux-arm64@1.20260708.1':
+ optional: true
+
+ '@cloudflare/workerd-windows-64@1.20260708.1':
+ optional: true
+
+ '@cloudflare/workers-types@4.20260702.1': {}
+
+ '@cspotcode/source-map-support@0.8.1':
+ dependencies:
+ '@jridgewell/trace-mapping': 0.3.9
+
+ '@emnapi/runtime@1.11.2':
+ dependencies:
+ tslib: 2.8.1
+ optional: true
+
+ '@esbuild/aix-ppc64@0.21.5':
+ optional: true
+
+ '@esbuild/aix-ppc64@0.28.1':
+ optional: true
+
+ '@esbuild/android-arm64@0.21.5':
+ optional: true
+
+ '@esbuild/android-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/android-arm@0.21.5':
+ optional: true
+
+ '@esbuild/android-arm@0.28.1':
+ optional: true
+
+ '@esbuild/android-x64@0.21.5':
+ optional: true
+
+ '@esbuild/android-x64@0.28.1':
+ optional: true
+
+ '@esbuild/darwin-arm64@0.21.5':
+ optional: true
+
+ '@esbuild/darwin-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/darwin-x64@0.21.5':
+ optional: true
+
+ '@esbuild/darwin-x64@0.28.1':
+ optional: true
+
+ '@esbuild/freebsd-arm64@0.21.5':
+ optional: true
+
+ '@esbuild/freebsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/freebsd-x64@0.21.5':
+ optional: true
+
+ '@esbuild/freebsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-arm64@0.21.5':
+ optional: true
+
+ '@esbuild/linux-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-arm@0.21.5':
+ optional: true
+
+ '@esbuild/linux-arm@0.28.1':
+ optional: true
+
+ '@esbuild/linux-ia32@0.21.5':
+ optional: true
+
+ '@esbuild/linux-ia32@0.28.1':
+ optional: true
+
+ '@esbuild/linux-loong64@0.21.5':
+ optional: true
+
+ '@esbuild/linux-loong64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-mips64el@0.21.5':
+ optional: true
+
+ '@esbuild/linux-mips64el@0.28.1':
+ optional: true
+
+ '@esbuild/linux-ppc64@0.21.5':
+ optional: true
+
+ '@esbuild/linux-ppc64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-riscv64@0.21.5':
+ optional: true
+
+ '@esbuild/linux-riscv64@0.28.1':
+ optional: true
+
+ '@esbuild/linux-s390x@0.21.5':
+ optional: true
+
+ '@esbuild/linux-s390x@0.28.1':
+ optional: true
+
+ '@esbuild/linux-x64@0.21.5':
+ optional: true
+
+ '@esbuild/linux-x64@0.28.1':
+ optional: true
+
+ '@esbuild/netbsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/netbsd-x64@0.21.5':
+ optional: true
+
+ '@esbuild/netbsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/openbsd-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/openbsd-x64@0.21.5':
+ optional: true
+
+ '@esbuild/openbsd-x64@0.28.1':
+ optional: true
+
+ '@esbuild/openharmony-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/sunos-x64@0.21.5':
+ optional: true
+
+ '@esbuild/sunos-x64@0.28.1':
+ optional: true
+
+ '@esbuild/win32-arm64@0.21.5':
+ optional: true
+
+ '@esbuild/win32-arm64@0.28.1':
+ optional: true
+
+ '@esbuild/win32-ia32@0.21.5':
+ optional: true
+
+ '@esbuild/win32-ia32@0.28.1':
+ optional: true
+
+ '@esbuild/win32-x64@0.21.5':
+ optional: true
+
+ '@esbuild/win32-x64@0.28.1':
+ optional: true
+
+ '@img/colour@1.1.0': {}
+
+ '@img/sharp-darwin-arm64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-darwin-arm64': 1.2.4
+ optional: true
+
+ '@img/sharp-darwin-x64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-darwin-x64': 1.2.4
+ optional: true
+
+ '@img/sharp-libvips-darwin-arm64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-darwin-x64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-arm64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-arm@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-ppc64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-riscv64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-s390x@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linux-x64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+ optional: true
+
+ '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+ optional: true
+
+ '@img/sharp-linux-arm64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-arm64': 1.2.4
+ optional: true
+
+ '@img/sharp-linux-arm@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-arm': 1.2.4
+ optional: true
+
+ '@img/sharp-linux-ppc64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-ppc64': 1.2.4
+ optional: true
+
+ '@img/sharp-linux-riscv64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-riscv64': 1.2.4
+ optional: true
+
+ '@img/sharp-linux-s390x@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-s390x': 1.2.4
+ optional: true
+
+ '@img/sharp-linux-x64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linux-x64': 1.2.4
+ optional: true
+
+ '@img/sharp-linuxmusl-arm64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+ optional: true
+
+ '@img/sharp-linuxmusl-x64@0.34.5':
+ optionalDependencies:
+ '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+ optional: true
+
+ '@img/sharp-wasm32@0.34.5':
+ dependencies:
+ '@emnapi/runtime': 1.11.2
+ optional: true
+
+ '@img/sharp-win32-arm64@0.34.5':
+ optional: true
+
+ '@img/sharp-win32-ia32@0.34.5':
+ optional: true
+
+ '@img/sharp-win32-x64@0.34.5':
+ optional: true
+
+ '@jridgewell/resolve-uri@3.1.2': {}
+
+ '@jridgewell/sourcemap-codec@1.5.5': {}
+
+ '@jridgewell/trace-mapping@0.3.9':
+ dependencies:
+ '@jridgewell/resolve-uri': 3.1.2
+ '@jridgewell/sourcemap-codec': 1.5.5
+
+ '@noble/curves@1.9.7':
+ dependencies:
+ '@noble/hashes': 1.8.0
+
+ '@noble/hashes@1.8.0': {}
+
+ '@openzeppelin/relayer-plugin-channels@0.20.0':
+ dependencies:
+ '@actions/exec': 1.1.1
+ '@openzeppelin/relayer-sdk': 1.10.0
+ '@stellar/stellar-sdk': 14.6.1
+ axios: 1.18.1
+ transitivePeerDependencies:
+ - debug
+ - supports-color
+
+ '@openzeppelin/relayer-sdk@1.10.0':
+ dependencies:
+ axios: 1.18.1
+ transitivePeerDependencies:
+ - debug
+ - supports-color
+
+ '@poppinss/colors@4.1.6':
+ dependencies:
+ kleur: 4.1.5
+
+ '@poppinss/dumper@0.6.5':
+ dependencies:
+ '@poppinss/colors': 4.1.6
+ '@sindresorhus/is': 7.2.0
+ supports-color: 10.2.2
+
+ '@poppinss/exception@1.2.3': {}
+
+ '@rollup/rollup-android-arm-eabi@4.62.2':
+ optional: true
+
+ '@rollup/rollup-android-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-darwin-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-darwin-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-freebsd-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-freebsd-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-arm64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-loong64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-loong64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-ppc64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-riscv64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-s390x-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-x64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-linux-x64-musl@4.62.2':
+ optional: true
+
+ '@rollup/rollup-openbsd-x64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-openharmony-arm64@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-arm64-msvc@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-ia32-msvc@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-x64-gnu@4.62.2':
+ optional: true
+
+ '@rollup/rollup-win32-x64-msvc@4.62.2':
+ optional: true
+
+ '@sindresorhus/is@7.2.0': {}
+
+ '@speed-highlight/core@1.2.17': {}
+
+ '@stellar/js-xdr@3.1.2': {}
+
+ '@stellar/stellar-base@14.1.0':
+ dependencies:
+ '@noble/curves': 1.9.7
+ '@stellar/js-xdr': 3.1.2
+ base32.js: 0.1.0
+ bignumber.js: 9.3.1
+ buffer: 6.0.3
+ sha.js: 2.4.12
+
+ '@stellar/stellar-sdk@14.6.1':
+ dependencies:
+ '@stellar/stellar-base': 14.1.0
+ axios: 1.18.1
+ bignumber.js: 9.3.1
+ commander: 14.0.3
+ eventsource: 2.0.2
+ feaxios: 0.0.23
+ randombytes: 2.1.0
+ toml: 3.0.0
+ urijs: 1.19.11
+ transitivePeerDependencies:
+ - debug
+ - supports-color
+
+ '@types/estree@1.0.9': {}
+
+ '@vitest/expect@2.1.9':
+ dependencies:
+ '@vitest/spy': 2.1.9
+ '@vitest/utils': 2.1.9
+ chai: 5.3.3
+ tinyrainbow: 1.2.0
+
+ '@vitest/mocker@2.1.9(vite@5.4.21)':
+ dependencies:
+ '@vitest/spy': 2.1.9
+ estree-walker: 3.0.3
+ magic-string: 0.30.21
+ optionalDependencies:
+ vite: 5.4.21
+
+ '@vitest/pretty-format@2.1.9':
+ dependencies:
+ tinyrainbow: 1.2.0
+
+ '@vitest/runner@2.1.9':
+ dependencies:
+ '@vitest/utils': 2.1.9
+ pathe: 1.1.2
+
+ '@vitest/snapshot@2.1.9':
+ dependencies:
+ '@vitest/pretty-format': 2.1.9
+ magic-string: 0.30.21
+ pathe: 1.1.2
+
+ '@vitest/spy@2.1.9':
+ dependencies:
+ tinyspy: 3.0.2
+
+ '@vitest/utils@2.1.9':
+ dependencies:
+ '@vitest/pretty-format': 2.1.9
+ loupe: 3.2.1
+ tinyrainbow: 1.2.0
+
+ agent-base@6.0.2:
+ dependencies:
+ debug: 4.4.3
+ transitivePeerDependencies:
+ - supports-color
+
+ assertion-error@2.0.1: {}
+
+ asynckit@0.4.0: {}
+
+ available-typed-arrays@1.0.7:
+ dependencies:
+ possible-typed-array-names: 1.1.0
+
+ axios@1.18.1:
+ dependencies:
+ follow-redirects: 1.16.0
+ form-data: 4.0.6
+ https-proxy-agent: 5.0.1
+ proxy-from-env: 2.1.0
+ transitivePeerDependencies:
+ - debug
+ - supports-color
+
+ base32.js@0.1.0: {}
+
+ base64-js@1.5.1: {}
+
+ bignumber.js@9.3.1: {}
+
+ blake3-wasm@2.1.5: {}
+
+ buffer@6.0.3:
+ dependencies:
+ base64-js: 1.5.1
+ ieee754: 1.2.1
+
+ cac@6.7.14: {}
+
+ call-bind-apply-helpers@1.0.2:
+ dependencies:
+ es-errors: 1.3.0
+ function-bind: 1.1.2
+
+ call-bind@1.0.9:
+ dependencies:
+ call-bind-apply-helpers: 1.0.2
+ es-define-property: 1.0.1
+ get-intrinsic: 1.3.0
+ set-function-length: 1.2.2
+
+ call-bound@1.0.4:
+ dependencies:
+ call-bind-apply-helpers: 1.0.2
+ get-intrinsic: 1.3.0
+
+ chai@5.3.3:
+ dependencies:
+ assertion-error: 2.0.1
+ check-error: 2.1.3
+ deep-eql: 5.0.2
+ loupe: 3.2.1
+ pathval: 2.0.1
+
+ check-error@2.1.3: {}
+
+ combined-stream@1.0.8:
+ dependencies:
+ delayed-stream: 1.0.0
+
+ commander@14.0.3: {}
+
+ cookie@1.1.1: {}
+
+ debug@4.4.3:
+ dependencies:
+ ms: 2.1.3
+
+ deep-eql@5.0.2: {}
+
+ define-data-property@1.1.4:
+ dependencies:
+ es-define-property: 1.0.1
+ es-errors: 1.3.0
+ gopd: 1.2.0
+
+ delayed-stream@1.0.0: {}
+
+ detect-libc@2.1.2: {}
+
+ dunder-proto@1.0.1:
+ dependencies:
+ call-bind-apply-helpers: 1.0.2
+ es-errors: 1.3.0
+ gopd: 1.2.0
+
+ error-stack-parser-es@1.0.5: {}
+
+ es-define-property@1.0.1: {}
+
+ es-errors@1.3.0: {}
+
+ es-module-lexer@1.7.0: {}
+
+ es-object-atoms@1.1.2:
+ dependencies:
+ es-errors: 1.3.0
+
+ es-set-tostringtag@2.1.0:
+ dependencies:
+ es-errors: 1.3.0
+ get-intrinsic: 1.3.0
+ has-tostringtag: 1.0.2
+ hasown: 2.0.4
+
+ esbuild@0.21.5:
+ optionalDependencies:
+ '@esbuild/aix-ppc64': 0.21.5
+ '@esbuild/android-arm': 0.21.5
+ '@esbuild/android-arm64': 0.21.5
+ '@esbuild/android-x64': 0.21.5
+ '@esbuild/darwin-arm64': 0.21.5
+ '@esbuild/darwin-x64': 0.21.5
+ '@esbuild/freebsd-arm64': 0.21.5
+ '@esbuild/freebsd-x64': 0.21.5
+ '@esbuild/linux-arm': 0.21.5
+ '@esbuild/linux-arm64': 0.21.5
+ '@esbuild/linux-ia32': 0.21.5
+ '@esbuild/linux-loong64': 0.21.5
+ '@esbuild/linux-mips64el': 0.21.5
+ '@esbuild/linux-ppc64': 0.21.5
+ '@esbuild/linux-riscv64': 0.21.5
+ '@esbuild/linux-s390x': 0.21.5
+ '@esbuild/linux-x64': 0.21.5
+ '@esbuild/netbsd-x64': 0.21.5
+ '@esbuild/openbsd-x64': 0.21.5
+ '@esbuild/sunos-x64': 0.21.5
+ '@esbuild/win32-arm64': 0.21.5
+ '@esbuild/win32-ia32': 0.21.5
+ '@esbuild/win32-x64': 0.21.5
+
+ esbuild@0.28.1:
+ optionalDependencies:
+ '@esbuild/aix-ppc64': 0.28.1
+ '@esbuild/android-arm': 0.28.1
+ '@esbuild/android-arm64': 0.28.1
+ '@esbuild/android-x64': 0.28.1
+ '@esbuild/darwin-arm64': 0.28.1
+ '@esbuild/darwin-x64': 0.28.1
+ '@esbuild/freebsd-arm64': 0.28.1
+ '@esbuild/freebsd-x64': 0.28.1
+ '@esbuild/linux-arm': 0.28.1
+ '@esbuild/linux-arm64': 0.28.1
+ '@esbuild/linux-ia32': 0.28.1
+ '@esbuild/linux-loong64': 0.28.1
+ '@esbuild/linux-mips64el': 0.28.1
+ '@esbuild/linux-ppc64': 0.28.1
+ '@esbuild/linux-riscv64': 0.28.1
+ '@esbuild/linux-s390x': 0.28.1
+ '@esbuild/linux-x64': 0.28.1
+ '@esbuild/netbsd-arm64': 0.28.1
+ '@esbuild/netbsd-x64': 0.28.1
+ '@esbuild/openbsd-arm64': 0.28.1
+ '@esbuild/openbsd-x64': 0.28.1
+ '@esbuild/openharmony-arm64': 0.28.1
+ '@esbuild/sunos-x64': 0.28.1
+ '@esbuild/win32-arm64': 0.28.1
+ '@esbuild/win32-ia32': 0.28.1
+ '@esbuild/win32-x64': 0.28.1
+
+ estree-walker@3.0.3:
+ dependencies:
+ '@types/estree': 1.0.9
+
+ eventsource@2.0.2: {}
+
+ expect-type@1.4.0: {}
+
+ feaxios@0.0.23:
+ dependencies:
+ is-retry-allowed: 3.0.0
+
+ follow-redirects@1.16.0: {}
+
+ for-each@0.3.5:
+ dependencies:
+ is-callable: 1.2.7
+
+ form-data@4.0.6:
+ dependencies:
+ asynckit: 0.4.0
+ combined-stream: 1.0.8
+ es-set-tostringtag: 2.1.0
+ hasown: 2.0.4
+ mime-types: 2.1.35
+
+ fsevents@2.3.3:
+ optional: true
+
+ function-bind@1.1.2: {}
+
+ get-intrinsic@1.3.0:
+ dependencies:
+ call-bind-apply-helpers: 1.0.2
+ es-define-property: 1.0.1
+ es-errors: 1.3.0
+ es-object-atoms: 1.1.2
+ function-bind: 1.1.2
+ get-proto: 1.0.1
+ gopd: 1.2.0
+ has-symbols: 1.1.0
+ hasown: 2.0.4
+ math-intrinsics: 1.1.0
+
+ get-proto@1.0.1:
+ dependencies:
+ dunder-proto: 1.0.1
+ es-object-atoms: 1.1.2
+
+ gopd@1.2.0: {}
+
+ has-property-descriptors@1.0.2:
+ dependencies:
+ es-define-property: 1.0.1
+
+ has-symbols@1.1.0: {}
+
+ has-tostringtag@1.0.2:
+ dependencies:
+ has-symbols: 1.1.0
+
+ hasown@2.0.4:
+ dependencies:
+ function-bind: 1.1.2
+
+ hono@4.12.29: {}
+
+ https-proxy-agent@5.0.1:
+ dependencies:
+ agent-base: 6.0.2
+ debug: 4.4.3
+ transitivePeerDependencies:
+ - supports-color
+
+ ieee754@1.2.1: {}
+
+ inherits@2.0.4: {}
+
+ is-callable@1.2.7: {}
+
+ is-retry-allowed@3.0.0: {}
+
+ is-typed-array@1.1.15:
+ dependencies:
+ which-typed-array: 1.1.22
+
+ isarray@2.0.5: {}
+
+ kleur@4.1.5: {}
+
+ loupe@3.2.1: {}
+
+ magic-string@0.30.21:
+ dependencies:
+ '@jridgewell/sourcemap-codec': 1.5.5
+
+ math-intrinsics@1.1.0: {}
+
+ mime-db@1.52.0: {}
+
+ mime-types@2.1.35:
+ dependencies:
+ mime-db: 1.52.0
+
+ miniflare@4.20260708.1:
+ dependencies:
+ '@cspotcode/source-map-support': 0.8.1
+ sharp: 0.34.5
+ undici: 7.28.0
+ workerd: 1.20260708.1
+ ws: 8.21.0
+ youch: 4.1.0-beta.10
+ transitivePeerDependencies:
+ - bufferutil
+ - utf-8-validate
+
+ ms@2.1.3: {}
+
+ nanoid@3.3.15: {}
+
+ path-to-regexp@6.3.0: {}
+
+ pathe@1.1.2: {}
+
+ pathe@2.0.3: {}
+
+ pathval@2.0.1: {}
+
+ picocolors@1.1.1: {}
+
+ possible-typed-array-names@1.1.0: {}
+
+ postcss@8.5.17:
+ dependencies:
+ nanoid: 3.3.15
+ picocolors: 1.1.1
+ source-map-js: 1.2.1
+
+ proxy-from-env@2.1.0: {}
+
+ randombytes@2.1.0:
+ dependencies:
+ safe-buffer: 5.2.1
+
+ rollup@4.62.2:
+ dependencies:
+ '@types/estree': 1.0.9
+ optionalDependencies:
+ '@rollup/rollup-android-arm-eabi': 4.62.2
+ '@rollup/rollup-android-arm64': 4.62.2
+ '@rollup/rollup-darwin-arm64': 4.62.2
+ '@rollup/rollup-darwin-x64': 4.62.2
+ '@rollup/rollup-freebsd-arm64': 4.62.2
+ '@rollup/rollup-freebsd-x64': 4.62.2
+ '@rollup/rollup-linux-arm-gnueabihf': 4.62.2
+ '@rollup/rollup-linux-arm-musleabihf': 4.62.2
+ '@rollup/rollup-linux-arm64-gnu': 4.62.2
+ '@rollup/rollup-linux-arm64-musl': 4.62.2
+ '@rollup/rollup-linux-loong64-gnu': 4.62.2
+ '@rollup/rollup-linux-loong64-musl': 4.62.2
+ '@rollup/rollup-linux-ppc64-gnu': 4.62.2
+ '@rollup/rollup-linux-ppc64-musl': 4.62.2
+ '@rollup/rollup-linux-riscv64-gnu': 4.62.2
+ '@rollup/rollup-linux-riscv64-musl': 4.62.2
+ '@rollup/rollup-linux-s390x-gnu': 4.62.2
+ '@rollup/rollup-linux-x64-gnu': 4.62.2
+ '@rollup/rollup-linux-x64-musl': 4.62.2
+ '@rollup/rollup-openbsd-x64': 4.62.2
+ '@rollup/rollup-openharmony-arm64': 4.62.2
+ '@rollup/rollup-win32-arm64-msvc': 4.62.2
+ '@rollup/rollup-win32-ia32-msvc': 4.62.2
+ '@rollup/rollup-win32-x64-gnu': 4.62.2
+ '@rollup/rollup-win32-x64-msvc': 4.62.2
+ fsevents: 2.3.3
+
+ safe-buffer@5.2.1: {}
+
+ semver@7.8.5: {}
+
+ set-function-length@1.2.2:
+ dependencies:
+ define-data-property: 1.1.4
+ es-errors: 1.3.0
+ function-bind: 1.1.2
+ get-intrinsic: 1.3.0
+ gopd: 1.2.0
+ has-property-descriptors: 1.0.2
+
+ sha.js@2.4.12:
+ dependencies:
+ inherits: 2.0.4
+ safe-buffer: 5.2.1
+ to-buffer: 1.2.2
+
+ sharp@0.34.5:
+ dependencies:
+ '@img/colour': 1.1.0
+ detect-libc: 2.1.2
+ semver: 7.8.5
+ optionalDependencies:
+ '@img/sharp-darwin-arm64': 0.34.5
+ '@img/sharp-darwin-x64': 0.34.5
+ '@img/sharp-libvips-darwin-arm64': 1.2.4
+ '@img/sharp-libvips-darwin-x64': 1.2.4
+ '@img/sharp-libvips-linux-arm': 1.2.4
+ '@img/sharp-libvips-linux-arm64': 1.2.4
+ '@img/sharp-libvips-linux-ppc64': 1.2.4
+ '@img/sharp-libvips-linux-riscv64': 1.2.4
+ '@img/sharp-libvips-linux-s390x': 1.2.4
+ '@img/sharp-libvips-linux-x64': 1.2.4
+ '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+ '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+ '@img/sharp-linux-arm': 0.34.5
+ '@img/sharp-linux-arm64': 0.34.5
+ '@img/sharp-linux-ppc64': 0.34.5
+ '@img/sharp-linux-riscv64': 0.34.5
+ '@img/sharp-linux-s390x': 0.34.5
+ '@img/sharp-linux-x64': 0.34.5
+ '@img/sharp-linuxmusl-arm64': 0.34.5
+ '@img/sharp-linuxmusl-x64': 0.34.5
+ '@img/sharp-wasm32': 0.34.5
+ '@img/sharp-win32-arm64': 0.34.5
+ '@img/sharp-win32-ia32': 0.34.5
+ '@img/sharp-win32-x64': 0.34.5
+
+ siginfo@2.0.0: {}
+
+ source-map-js@1.2.1: {}
+
+ stackback@0.0.2: {}
+
+ std-env@3.10.0: {}
+
+ supports-color@10.2.2: {}
+
+ tinybench@2.9.0: {}
+
+ tinyexec@0.3.2: {}
+
+ tinypool@1.1.1: {}
+
+ tinyrainbow@1.2.0: {}
+
+ tinyspy@3.0.2: {}
+
+ to-buffer@1.2.2:
+ dependencies:
+ isarray: 2.0.5
+ safe-buffer: 5.2.1
+ typed-array-buffer: 1.0.3
+
+ toml@3.0.0: {}
+
+ tslib@2.8.1:
+ optional: true
+
+ typed-array-buffer@1.0.3:
+ dependencies:
+ call-bound: 1.0.4
+ es-errors: 1.3.0
+ is-typed-array: 1.1.15
+
+ typescript@5.9.3: {}
+
+ undici@7.28.0: {}
+
+ unenv@2.0.0-rc.24:
+ dependencies:
+ pathe: 2.0.3
+
+ urijs@1.19.11: {}
+
+ vite-node@2.1.9:
+ dependencies:
+ cac: 6.7.14
+ debug: 4.4.3
+ es-module-lexer: 1.7.0
+ pathe: 1.1.2
+ vite: 5.4.21
+ transitivePeerDependencies:
+ - '@types/node'
+ - less
+ - lightningcss
+ - sass
+ - sass-embedded
+ - stylus
+ - sugarss
+ - supports-color
+ - terser
+
+ vite@5.4.21:
+ dependencies:
+ esbuild: 0.21.5
+ postcss: 8.5.17
+ rollup: 4.62.2
+ optionalDependencies:
+ fsevents: 2.3.3
+
+ vitest@2.1.9:
+ dependencies:
+ '@vitest/expect': 2.1.9
+ '@vitest/mocker': 2.1.9(vite@5.4.21)
+ '@vitest/pretty-format': 2.1.9
+ '@vitest/runner': 2.1.9
+ '@vitest/snapshot': 2.1.9
+ '@vitest/spy': 2.1.9
+ '@vitest/utils': 2.1.9
+ chai: 5.3.3
+ debug: 4.4.3
+ expect-type: 1.4.0
+ magic-string: 0.30.21
+ pathe: 1.1.2
+ std-env: 3.10.0
+ tinybench: 2.9.0
+ tinyexec: 0.3.2
+ tinypool: 1.1.1
+ tinyrainbow: 1.2.0
+ vite: 5.4.21
+ vite-node: 2.1.9
+ why-is-node-running: 2.3.0
+ transitivePeerDependencies:
+ - less
+ - lightningcss
+ - msw
+ - sass
+ - sass-embedded
+ - stylus
+ - sugarss
+ - supports-color
+ - terser
+
+ which-typed-array@1.1.22:
+ dependencies:
+ available-typed-arrays: 1.0.7
+ call-bind: 1.0.9
+ call-bound: 1.0.4
+ for-each: 0.3.5
+ get-proto: 1.0.1
+ gopd: 1.2.0
+ has-tostringtag: 1.0.2
+
+ why-is-node-running@2.3.0:
+ dependencies:
+ siginfo: 2.0.0
+ stackback: 0.0.2
+
+ workerd@1.20260708.1:
+ optionalDependencies:
+ '@cloudflare/workerd-darwin-64': 1.20260708.1
+ '@cloudflare/workerd-darwin-arm64': 1.20260708.1
+ '@cloudflare/workerd-linux-64': 1.20260708.1
+ '@cloudflare/workerd-linux-arm64': 1.20260708.1
+ '@cloudflare/workerd-windows-64': 1.20260708.1
+
+ wrangler@4.110.0(@cloudflare/workers-types@4.20260702.1):
+ dependencies:
+ '@cloudflare/kv-asset-handler': 0.5.0
+ '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260708.1)
+ blake3-wasm: 2.1.5
+ esbuild: 0.28.1
+ miniflare: 4.20260708.1
+ path-to-regexp: 6.3.0
+ unenv: 2.0.0-rc.24
+ workerd: 1.20260708.1
+ optionalDependencies:
+ '@cloudflare/workers-types': 4.20260702.1
+ fsevents: 2.3.3
+ transitivePeerDependencies:
+ - bufferutil
+ - utf-8-validate
+
+ ws@8.21.0: {}
+
+ youch-core@0.3.3:
+ dependencies:
+ '@poppinss/exception': 1.2.3
+ error-stack-parser-es: 1.0.5
+
+ youch@4.1.0-beta.10:
+ dependencies:
+ '@poppinss/colors': 4.1.6
+ '@poppinss/dumper': 0.6.5
+ '@speed-highlight/core': 1.2.17
+ cookie: 1.1.1
+ youch-core: 0.3.3
diff --git a/relayer-proxy/src/constants.ts b/relayer-proxy/src/constants.ts
new file mode 100644
index 0000000..9f7a6c9
--- /dev/null
+++ b/relayer-proxy/src/constants.ts
@@ -0,0 +1,61 @@
+/**
+ * Constants for the passkey-kit Relayer Proxy.
+ */
+
+// ============================================================================
+// Service Metadata
+// ============================================================================
+
+/** Service name for health checks */
+export const SERVICE_NAME = "passkey-kit-relayer-proxy";
+
+// ============================================================================
+// Network URLs
+// ============================================================================
+
+/** Stellar Friendbot URL for testnet funding */
+export const FRIENDBOT_URL = "https://friendbot.stellar.org";
+
+// ============================================================================
+// API Key Configuration
+// ============================================================================
+
+/** Possible field names for the API key in the /gen response */
+export const API_KEY_FIELD_NAMES = ["apiKey", "api_key", "key", "token"] as const;
+
+/** Minimum length for a valid API key response */
+export const API_KEY_MIN_LENGTH = 10;
+
+/** Maximum length for a valid API key response */
+export const API_KEY_MAX_LENGTH = 200;
+
+// ============================================================================
+// Stellar Address Validation
+// ============================================================================
+
+/** Length of a Stellar account address (G-address), excluding the leading G */
+export const STELLAR_ADDRESS_LENGTH = 55;
+
+/** Regex pattern for extracting a missing account from a Relayer error */
+export const MISSING_ACCOUNT_PATTERN = /Account not found:\s*(G[A-Z0-9]{55})/;
+
+// ============================================================================
+// Retry Configuration
+// ============================================================================
+
+/** How long to retry on testnet when channel accounts need funding (5 minutes) */
+export const TESTNET_RETRY_DURATION_MS = 5 * 60 * 1000;
+
+// ============================================================================
+// HTTP Headers
+// ============================================================================
+
+// Only CF-Connecting-IP is trusted: Cloudflare always sets it at the edge and
+// the client cannot spoof it. X-Forwarded-For / X-Real-IP are client-controlled
+// and deliberately NOT used for per-IP key custody (review LOW).
+export const IP_HEADERS = {
+ CF_CONNECTING_IP: "CF-Connecting-IP",
+} as const;
+
+/** Default IP value when none can be determined */
+export const UNKNOWN_IP = "unknown";
diff --git a/relayer-proxy/src/index.test.ts b/relayer-proxy/src/index.test.ts
new file mode 100644
index 0000000..4c21375
--- /dev/null
+++ b/relayer-proxy/src/index.test.ts
@@ -0,0 +1,507 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+ PluginExecutionError,
+ PluginTransportError,
+} from "@openzeppelin/relayer-plugin-channels";
+import worker, { ApiKeyStore, extractMissingAccount, getClientIP } from "./index";
+import { SERVICE_NAME } from "./constants";
+
+// ---------------------------------------------------------------------------
+// Mock the Channels plugin: a stub ChannelsClient whose two submit methods are
+// controllable vi.fns, plus the two error classes the handler maps by instance.
+// ---------------------------------------------------------------------------
+const { submitSorobanTransaction, submitTransaction } = vi.hoisted(() => ({
+ submitSorobanTransaction: vi.fn(),
+ submitTransaction: vi.fn(),
+}));
+
+vi.mock("@openzeppelin/relayer-plugin-channels", () => {
+ class PluginExecutionError extends Error {
+ errorDetails?: { code?: unknown; details?: unknown };
+ constructor(
+ message: string,
+ errorDetails?: { code?: unknown; details?: unknown }
+ ) {
+ super(message);
+ this.name = "PluginExecutionError";
+ this.errorDetails = errorDetails;
+ }
+ }
+ class PluginTransportError extends Error {
+ statusCode?: number;
+ constructor(message: string, statusCode?: number) {
+ super(message);
+ this.name = "PluginTransportError";
+ this.statusCode = statusCode;
+ }
+ }
+ class ChannelsClient {
+ constructor(_opts: unknown) {}
+ submitSorobanTransaction = submitSorobanTransaction;
+ submitTransaction = submitTransaction;
+ }
+ return { ChannelsClient, PluginExecutionError, PluginTransportError };
+});
+
+// ---------------------------------------------------------------------------
+// Test doubles
+// ---------------------------------------------------------------------------
+const DO_KEY = "sk_do_relay_key_1234567";
+const CLIENT_IP = "203.0.113.7";
+
+// Fake per-IP DurableObjectNamespace. The stub's fetch answers /get (returns a
+// key, or 502 when `key` is null) and /peek (presence). This exercises the
+// worker's DO integration; the ApiKeyStore's own get-or-create logic is tested
+// directly below.
+function makeApiKeyDO(opts: { key?: string | null } = {}) {
+ const key = opts.key === undefined ? DO_KEY : opts.key;
+ const stub = {
+ fetch: vi.fn(async (input: unknown) => {
+ const url =
+ typeof input === "string" ? input : (input as Request).url ?? "";
+ if (url.includes("/peek")) {
+ return new Response(JSON.stringify({ hasKey: key !== null }), {
+ status: 200,
+ headers: { "Content-Type": "application/json" },
+ });
+ }
+ if (key === null) return new Response("mint failed", { status: 502 });
+ return new Response(key, { status: 200 });
+ }),
+ };
+ return {
+ idFromName: vi.fn((_ip: string) => "do-id"),
+ get: vi.fn((_id: unknown) => stub),
+ _stub: stub,
+ };
+}
+
+function makeEnv(
+ opts: { network?: "testnet" | "mainnet"; do?: ReturnType } = {}
+) {
+ const network = opts.network ?? "testnet";
+ return {
+ API_KEY_DO: opts.do ?? makeApiKeyDO(),
+ NETWORK: network,
+ RELAYER_BASE_URL:
+ network === "mainnet"
+ ? "https://channels.openzeppelin.com"
+ : "https://channels.openzeppelin.com/testnet",
+ } as any;
+}
+
+const ctx = () =>
+ ({ waitUntil: vi.fn(), passThroughOnException: vi.fn() }) as any;
+
+function makeRequest(
+ path: string,
+ opts: { method?: string; body?: unknown; ip?: string } = {}
+) {
+ const headers: Record = {
+ "CF-Connecting-IP": opts.ip ?? CLIENT_IP,
+ };
+ const init: RequestInit = { method: opts.method ?? "GET", headers };
+ if (opts.body !== undefined) {
+ headers["Content-Type"] = "application/json";
+ init.body =
+ typeof opts.body === "string" ? opts.body : JSON.stringify(opts.body);
+ }
+ return new Request(`http://localhost${path}`, init);
+}
+
+function okJson(obj: unknown) {
+ return { ok: true, status: 200, text: async () => JSON.stringify(obj) };
+}
+function okText(text: string) {
+ return { ok: true, status: 200, text: async () => text };
+}
+function notOk(status = 500, text = "error") {
+ return { ok: false, status, text: async () => text };
+}
+
+// Stub the GLOBAL fetch (used by generateApiKey's /gen call and friendbot).
+function stubFetch(handlers: { gen?: () => unknown; friendbot?: () => unknown }) {
+ const fetchMock = vi.fn(async (input: unknown) => {
+ const url = typeof input === "string" ? input : (input as Request).url;
+ if (url.includes("/gen")) return handlers.gen?.() ?? okJson({});
+ if (url.includes("friendbot")) return handlers.friendbot?.() ?? okText("ok");
+ throw new Error(`Unexpected fetch: ${url}`);
+ });
+ vi.stubGlobal("fetch", fetchMock);
+ return fetchMock;
+}
+
+// Fake DurableObjectState for direct ApiKeyStore tests.
+function fakeState(initial?: string) {
+ const store = new Map();
+ if (initial !== undefined) store.set("apiKey", initial);
+ return {
+ storage: {
+ get: vi.fn(async (k: string) => store.get(k)),
+ put: vi.fn(async (k: string, v: unknown) => {
+ store.set(k, v);
+ }),
+ },
+ blockConcurrencyWhile: vi.fn(async (fn: () => Promise) => fn()),
+ _store: store,
+ } as any;
+}
+
+const G_ADDRESS = `G${"A".repeat(55)}`;
+
+afterEach(() => {
+ vi.clearAllMocks();
+ vi.unstubAllGlobals();
+});
+
+// ---------------------------------------------------------------------------
+// Pure helpers
+// ---------------------------------------------------------------------------
+describe("getClientIP", () => {
+ it("uses CF-Connecting-IP", () => {
+ expect(
+ getClientIP(
+ new Request("http://x", { headers: { "CF-Connecting-IP": "1.1.1.1" } })
+ )
+ ).toBe("1.1.1.1");
+ });
+
+ it("ignores spoofable X-Forwarded-For / X-Real-IP, falling back to 'unknown'", () => {
+ expect(
+ getClientIP(
+ new Request("http://x", {
+ headers: { "X-Forwarded-For": "2.2.2.2, 3.3.3.3" },
+ })
+ )
+ ).toBe("unknown");
+ expect(
+ getClientIP(
+ new Request("http://x", { headers: { "X-Real-IP": "4.4.4.4" } })
+ )
+ ).toBe("unknown");
+ expect(getClientIP(new Request("http://x"))).toBe("unknown");
+ });
+});
+
+describe("extractMissingAccount", () => {
+ it("pulls the G-address out of a not-found error", () => {
+ expect(extractMissingAccount(`Account not found: ${G_ADDRESS}`)).toBe(
+ G_ADDRESS
+ );
+ });
+
+ it("returns null when the message has no account", () => {
+ expect(extractMissingAccount("some other failure")).toBeNull();
+ });
+});
+
+// ---------------------------------------------------------------------------
+// Health
+// ---------------------------------------------------------------------------
+describe("GET /", () => {
+ it("reports service and network", async () => {
+ const res = await worker.fetch(makeRequest("/"), makeEnv(), ctx());
+ expect(res.status).toBe(200);
+ await expect(res.json()).resolves.toEqual({
+ status: "ok",
+ service: SERVICE_NAME,
+ network: "testnet",
+ });
+ });
+});
+
+// ---------------------------------------------------------------------------
+// POST / — mode validation
+// ---------------------------------------------------------------------------
+describe("POST / validation", () => {
+ it("rejects a request with neither xdr nor func+auth (400)", async () => {
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: {} }),
+ makeEnv(),
+ ctx()
+ );
+ expect(res.status).toBe(400);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "Request must include 'xdr' OR ('func' and 'auth')",
+ });
+ expect(submitSorobanTransaction).not.toHaveBeenCalled();
+ expect(submitTransaction).not.toHaveBeenCalled();
+ });
+
+ it("rejects a request with both xdr and func+auth (400)", async () => {
+ const res = await worker.fetch(
+ makeRequest("/", {
+ method: "POST",
+ body: { xdr: "AAA", func: "BBB", auth: ["CCC"] },
+ }),
+ makeEnv(),
+ ctx()
+ );
+ expect(res.status).toBe(400);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "Request must include 'xdr' OR ('func' and 'auth'), not both",
+ });
+ });
+
+ it("rejects malformed JSON (400)", async () => {
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: "{not json" }),
+ makeEnv(),
+ ctx()
+ );
+ expect(res.status).toBe(400);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "Invalid JSON body",
+ });
+ });
+});
+
+// ---------------------------------------------------------------------------
+// POST / — submission paths
+// ---------------------------------------------------------------------------
+describe("POST / submission", () => {
+ it("submits a Soroban transaction (func+auth) and returns the result", async () => {
+ submitSorobanTransaction.mockResolvedValueOnce({
+ transactionId: "tx1",
+ hash: "h1",
+ status: "pending",
+ });
+
+ const res = await worker.fetch(
+ makeRequest("/", {
+ method: "POST",
+ body: { func: "FUNC", auth: ["A1", "A2"] },
+ }),
+ makeEnv(),
+ ctx()
+ );
+
+ expect(res.status).toBe(200);
+ await expect(res.json()).resolves.toEqual({
+ success: true,
+ data: { transactionId: "tx1", hash: "h1", status: "pending" },
+ });
+ expect(submitSorobanTransaction).toHaveBeenCalledWith({
+ func: "FUNC",
+ auth: ["A1", "A2"],
+ });
+ expect(submitTransaction).not.toHaveBeenCalled();
+ });
+
+ it("fee-bumps a signed transaction (xdr) and returns the result", async () => {
+ submitTransaction.mockResolvedValueOnce({
+ transactionId: "tx2",
+ hash: "h2",
+ status: "submitted",
+ });
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { xdr: "XDR" } }),
+ makeEnv(),
+ ctx()
+ );
+
+ expect(res.status).toBe(200);
+ await expect(res.json()).resolves.toEqual({
+ success: true,
+ data: { transactionId: "tx2", hash: "h2", status: "submitted" },
+ });
+ expect(submitTransaction).toHaveBeenCalledWith({ xdr: "XDR" });
+ expect(submitSorobanTransaction).not.toHaveBeenCalled();
+ });
+
+ it("maps PluginExecutionError to 400 with code/details", async () => {
+ submitSorobanTransaction.mockRejectedValueOnce(
+ new PluginExecutionError("exec failed", { code: "E123", details: "nope" })
+ );
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv(),
+ ctx()
+ );
+
+ expect(res.status).toBe(400);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "exec failed",
+ data: { code: "E123", details: "nope" },
+ });
+ });
+
+ it("maps PluginTransportError to its status code", async () => {
+ submitSorobanTransaction.mockRejectedValueOnce(
+ new PluginTransportError("upstream unavailable", 502)
+ );
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv(),
+ ctx()
+ );
+
+ expect(res.status).toBe(502);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "upstream unavailable",
+ });
+ });
+
+ it("maps an unknown error to 500", async () => {
+ submitSorobanTransaction.mockRejectedValueOnce(new Error("boom"));
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv(),
+ ctx()
+ );
+
+ expect(res.status).toBe(500);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "boom",
+ });
+ });
+
+ it("returns 500 when the API key cannot be obtained", async () => {
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv({ do: makeApiKeyDO({ key: null }) }),
+ ctx()
+ );
+
+ expect(res.status).toBe(500);
+ await expect(res.json()).resolves.toEqual({
+ success: false,
+ error: "Could not obtain API key. Service may be misconfigured.",
+ });
+ expect(submitSorobanTransaction).not.toHaveBeenCalled();
+ });
+});
+
+// ---------------------------------------------------------------------------
+// POST / — testnet friendbot retry
+// ---------------------------------------------------------------------------
+describe("POST / testnet retry", () => {
+ it("funds a missing channel account via friendbot then retries", async () => {
+ const fetchMock = stubFetch({ friendbot: () => okText("funded") });
+ submitSorobanTransaction
+ .mockRejectedValueOnce(new Error(`Account not found: ${G_ADDRESS}`))
+ .mockResolvedValueOnce({ transactionId: "tx3", hash: "h3", status: "ok" });
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv({ network: "testnet" }),
+ ctx()
+ );
+
+ expect(res.status).toBe(200);
+ await expect(res.json()).resolves.toEqual({
+ success: true,
+ data: { transactionId: "tx3", hash: "h3", status: "ok" },
+ });
+ expect(submitSorobanTransaction).toHaveBeenCalledTimes(2);
+ const friendbotCalls = fetchMock.mock.calls.filter(([u]) =>
+ String(u).includes("friendbot")
+ );
+ expect(friendbotCalls).toHaveLength(1);
+ expect(String(friendbotCalls[0][0])).toContain(G_ADDRESS);
+ });
+
+ it("does NOT retry a missing account on mainnet (no friendbot)", async () => {
+ const fetchMock = stubFetch({});
+ submitSorobanTransaction.mockRejectedValueOnce(
+ new Error(`Account not found: ${G_ADDRESS}`)
+ );
+
+ const res = await worker.fetch(
+ makeRequest("/", { method: "POST", body: { func: "F", auth: ["A"] } }),
+ makeEnv({ network: "mainnet" }),
+ ctx()
+ );
+
+ expect(res.status).toBe(500);
+ expect(submitSorobanTransaction).toHaveBeenCalledTimes(1);
+ expect(
+ fetchMock.mock.calls.some(([u]) => String(u).includes("friendbot"))
+ ).toBe(false);
+ });
+});
+
+// ---------------------------------------------------------------------------
+// ApiKeyStore Durable Object — serialized get-or-create
+// ---------------------------------------------------------------------------
+describe("ApiKeyStore (Durable Object)", () => {
+ it("returns the stored key without minting", async () => {
+ const state = fakeState("sk_stored_key_1234567");
+ const fetchMock = stubFetch({ gen: () => okJson({ apiKey: "sk_unused" }) });
+ const store = new ApiKeyStore(state, makeEnv());
+
+ const res = await store.fetch(new Request("https://do/get"));
+ expect(res.status).toBe(200);
+ expect((await res.text()).trim()).toBe("sk_stored_key_1234567");
+ expect(fetchMock.mock.calls.some(([u]) => String(u).includes("/gen"))).toBe(
+ false
+ );
+ });
+
+ it("mints from /gen and stores when absent", async () => {
+ const state = fakeState();
+ stubFetch({ gen: () => okJson({ apiKey: "sk_minted_key_1234567" }) });
+ const store = new ApiKeyStore(state, makeEnv());
+
+ const res = await store.fetch(new Request("https://do/get"));
+ expect(res.status).toBe(200);
+ expect((await res.text()).trim()).toBe("sk_minted_key_1234567");
+ expect(state._store.get("apiKey")).toBe("sk_minted_key_1234567");
+ });
+
+ it("returns 502 when minting fails", async () => {
+ const state = fakeState();
+ stubFetch({ gen: () => notOk(500, "denied") });
+ const store = new ApiKeyStore(state, makeEnv());
+
+ const res = await store.fetch(new Request("https://do/get"));
+ expect(res.status).toBe(502);
+ expect(state._store.get("apiKey")).toBeUndefined();
+ });
+
+ it("/peek reports presence without minting", async () => {
+ const present = new ApiKeyStore(
+ fakeState("sk_present_key_123456"),
+ makeEnv()
+ );
+ const fetchMock = stubFetch({ gen: () => okJson({ apiKey: "sk_unused" }) });
+ const res = await present.fetch(new Request("https://do/peek"));
+ await expect(res.json()).resolves.toEqual({ hasKey: true });
+
+ const absent = new ApiKeyStore(fakeState(), makeEnv());
+ const res2 = await absent.fetch(new Request("https://do/peek"));
+ await expect(res2.json()).resolves.toEqual({ hasKey: false });
+
+ expect(fetchMock.mock.calls.some(([u]) => String(u).includes("/gen"))).toBe(
+ false
+ );
+ });
+});
+
+// ---------------------------------------------------------------------------
+// GET /status
+// ---------------------------------------------------------------------------
+describe("GET /status", () => {
+ it("returns client IP, network, and key presence", async () => {
+ const res = await worker.fetch(makeRequest("/status"), makeEnv(), ctx());
+ expect(res.status).toBe(200);
+ await expect(res.json()).resolves.toEqual({
+ success: true,
+ data: {
+ clientIP: CLIENT_IP,
+ network: "testnet",
+ hasKey: true,
+ },
+ });
+ });
+});
diff --git a/relayer-proxy/src/index.ts b/relayer-proxy/src/index.ts
new file mode 100644
index 0000000..c947c9a
--- /dev/null
+++ b/relayer-proxy/src/index.ts
@@ -0,0 +1,459 @@
+/**
+ * passkey-kit Relayer Proxy — Cloudflare Worker
+ *
+ * A keyless proxy in front of the OpenZeppelin Relayer Channels service. It
+ * mints and caches one Relayer API key per client IP so the browser can submit
+ * fee-sponsored transactions with ZERO secrets in the bundle (this replaces
+ * passkey-kit's old defect of inlining VITE_relayerApiKey into client JS).
+ *
+ * Uses the official `@openzeppelin/relayer-plugin-channels` SDK.
+ *
+ * Features:
+ * - Automatic API-key generation per IP, custody in a per-IP Durable Object so
+ * concurrent first-requests mint at most ONE key (KV has no CAS — review M5).
+ * - One API key per IP; the Relayer's usage limits reset every 24h on its side.
+ * - Two submission modes: `{ func, auth }` (Address credentials) and `{ xdr }`
+ * (source-account auth, e.g. deploys).
+ * - Testnet: funds missing channel accounts via Friendbot and retries.
+ * - Separate testnet (default) and mainnet (`--env production`) deployments.
+ */
+
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import {
+ ChannelsClient,
+ PluginExecutionError,
+ PluginTransportError,
+} from "@openzeppelin/relayer-plugin-channels";
+import {
+ SERVICE_NAME,
+ FRIENDBOT_URL,
+ API_KEY_FIELD_NAMES,
+ API_KEY_MIN_LENGTH,
+ API_KEY_MAX_LENGTH,
+ MISSING_ACCOUNT_PATTERN,
+ TESTNET_RETRY_DURATION_MS,
+ IP_HEADERS,
+ UNKNOWN_IP,
+} from "./constants";
+
+/** Durable Object storage key holding the IP's Relayer API key. */
+const DO_KEY = "apiKey";
+
+// Hono app
+const app = new Hono<{ Bindings: Env }>();
+
+// CORS is intentionally open: the browser calls this cross-origin and the
+// endpoint holds no secret the caller could exfiltrate (it mints its own keys).
+// SECURITY DECISION (endgame, before any MAINNET deploy): decide whether an
+// open, keyless, fee-sponsoring `POST /` is acceptable on mainnet, or whether
+// it needs an origin allowlist / auth / stricter rate limiting. On testnet the
+// open policy is fine.
+app.use("*", cors());
+
+app.onError((error, c) => {
+ console.error("Unhandled worker error:", error);
+ return c.json(
+ {
+ success: false,
+ error: "Internal server error",
+ },
+ 500
+ );
+});
+
+// ============================================================================
+// Helper Functions
+// ============================================================================
+
+/**
+ * Get the client IP from the request. Uses ONLY `CF-Connecting-IP`, which
+ * Cloudflare always sets at the edge and the client cannot spoof. The
+ * `X-Forwarded-For` / `X-Real-IP` headers are client-controlled and must NOT be
+ * trusted for per-IP key custody (review LOW).
+ */
+export function getClientIP(request: Request): string {
+ return request.headers.get(IP_HEADERS.CF_CONNECTING_IP) || UNKNOWN_IP;
+}
+
+/**
+ * Validate API key format before use.
+ */
+function isValidApiKey(apiKey: string): boolean {
+ const trimmed = apiKey.trim();
+ return (
+ trimmed.length >= API_KEY_MIN_LENGTH && trimmed.length <= API_KEY_MAX_LENGTH
+ );
+}
+
+/**
+ * Generate a new API key from the Relayer service. The /gen endpoint requires
+ * no authentication (GET).
+ * @see https://docs.openzeppelin.com/relayer/1.5.x/guides/stellar-channels-guide
+ */
+async function generateApiKey(env: Env): Promise {
+ try {
+ const response = await fetch(`${env.RELAYER_BASE_URL}/gen`, {
+ method: "GET",
+ });
+
+ const text = await response.text();
+
+ if (response.ok) {
+ try {
+ const data = JSON.parse(text) as Record;
+ const apiKey = API_KEY_FIELD_NAMES.map((name) => data[name]).find(
+ (v) => v
+ );
+ if (typeof apiKey === "string") {
+ return apiKey;
+ }
+ // Do NOT log the body: it may contain the key under an unexpected
+ // field. Log only that extraction failed (review LOW: no secret logs).
+ console.error("API key field not found in /gen response");
+ return null;
+ } catch {
+ // Response might be a plain-text API key — never log the raw text.
+ if (
+ text &&
+ text.length > API_KEY_MIN_LENGTH &&
+ text.length < API_KEY_MAX_LENGTH
+ ) {
+ return text.trim();
+ }
+ console.error(
+ `Could not parse /gen response (length ${text.length})`
+ );
+ return null;
+ }
+ }
+
+ console.error(
+ `Failed to generate API key: status ${response.status} (body length ${text.length})`
+ );
+ return null;
+ } catch (error) {
+ console.error("Error generating API key:", error);
+ return null;
+ }
+}
+
+/**
+ * Per-IP Relayer API key custody.
+ *
+ * One Durable Object instance per client IP (`idFromName(ip)`). All access to a
+ * given IP's key is serialized by the DO input gate + `blockConcurrencyWhile`,
+ * so N concurrent first-requests from one IP mint at most ONE `/gen` key. This
+ * is the atomic get-or-create KV cannot provide (KV has no CAS — review M5).
+ *
+ * Routes:
+ * - default (`/get`): get-or-create → 200 with the key, or 502 if minting fails.
+ * - `/peek`: report presence WITHOUT minting → `{ hasKey }` (for GET /status).
+ */
+export class ApiKeyStore implements DurableObject {
+ constructor(
+ private readonly state: DurableObjectState,
+ private readonly env: Env
+ ) {}
+
+ async fetch(request: Request): Promise {
+ const url = new URL(request.url);
+
+ if (url.pathname === "/peek") {
+ const existing = await this.state.storage.get(DO_KEY);
+ return Response.json({
+ hasKey: !!existing && isValidApiKey(existing),
+ });
+ }
+
+ // Get-or-create, serialized per instance.
+ const apiKey = await this.state.blockConcurrencyWhile(async () => {
+ const existing = await this.state.storage.get(DO_KEY);
+ if (existing && isValidApiKey(existing)) {
+ return existing;
+ }
+ const minted = await generateApiKey(this.env);
+ if (!minted) {
+ return null;
+ }
+ await this.state.storage.put(DO_KEY, minted);
+ return minted;
+ });
+
+ if (!apiKey) {
+ return new Response("Could not mint API key", { status: 502 });
+ }
+ return new Response(apiKey, { status: 200 });
+ }
+}
+
+/**
+ * Get (or lazily mint) the Relayer API key for an IP via its Durable Object.
+ */
+async function getApiKeyForIp(env: Env, ip: string): Promise {
+ const id = env.API_KEY_DO.idFromName(ip);
+ const stub = env.API_KEY_DO.get(id);
+ const res = await stub.fetch("https://api-key-store/get");
+ if (!res.ok) {
+ return null;
+ }
+ const apiKey = (await res.text()).trim();
+ return isValidApiKey(apiKey) ? apiKey : null;
+}
+
+/**
+ * Create a ChannelsClient for the configured network.
+ */
+function createClient(env: Env, apiKey: string): ChannelsClient {
+ return new ChannelsClient({
+ baseUrl: env.RELAYER_BASE_URL,
+ apiKey,
+ });
+}
+
+/**
+ * Extract the account address from an "Account not found" error message.
+ */
+export function extractMissingAccount(errorMessage: string): string | null {
+ const match = errorMessage.match(MISSING_ACCOUNT_PATTERN);
+ return match ? match[1] : null;
+}
+
+/**
+ * Fund an account via Friendbot (testnet only).
+ */
+async function fundWithFriendbot(account: string): Promise {
+ try {
+ const response = await fetch(
+ `${FRIENDBOT_URL}?addr=${encodeURIComponent(account)}`
+ );
+ return response.ok;
+ } catch (error) {
+ console.error("Friendbot funding failed:", error);
+ return false;
+ }
+}
+
+// ============================================================================
+// API Endpoints
+// ============================================================================
+
+// Health check
+app.get("/", (c) => {
+ return c.json({
+ status: "ok",
+ service: SERVICE_NAME,
+ network: c.env.NETWORK,
+ });
+});
+
+/**
+ * Submit a transaction via the Relayer.
+ * POST /
+ *
+ * Two modes:
+ * 1. { func: string, auth: string[] } — Relayer builds the tx with channel
+ * accounts (Address credentials: transfers, wallet operations).
+ * 2. { xdr: string } — Relayer fee-bumps an already-signed transaction
+ * (source-account auth: deploys).
+ *
+ * On testnet, if channel accounts are missing (after a testnet reset), fund
+ * them via Friendbot and retry for up to 5 minutes.
+ */
+app.post("/", async (c) => {
+ try {
+ const ip = getClientIP(c.req.raw);
+ const apiKey = await getApiKeyForIp(c.env, ip);
+
+ if (!apiKey) {
+ return c.json(
+ {
+ success: false,
+ error: "Could not obtain API key. Service may be misconfigured.",
+ },
+ 500
+ );
+ }
+
+ const body = await c.req.json<{
+ func?: string;
+ auth?: string[];
+ xdr?: string;
+ }>();
+
+ // Validate: must have either xdr OR (func AND auth).
+ const hasXdr = !!body.xdr;
+ const hasFuncAuth = !!body.func && !!body.auth;
+
+ if (!hasXdr && !hasFuncAuth) {
+ return c.json(
+ {
+ success: false,
+ error: "Request must include 'xdr' OR ('func' and 'auth')",
+ },
+ 400
+ );
+ }
+
+ if (hasXdr && hasFuncAuth) {
+ return c.json(
+ {
+ success: false,
+ error: "Request must include 'xdr' OR ('func' and 'auth'), not both",
+ },
+ 400
+ );
+ }
+
+ const client = createClient(c.env, apiKey);
+ const isTestnet = c.env.NETWORK === "testnet";
+
+ // On testnet, retry for up to 5 minutes to handle channel accounts needing
+ // funding. On mainnet, only try once (no Friendbot). Network wait time does
+ // not count toward the worker CPU limit.
+ const deadline = isTestnet ? Date.now() + TESTNET_RETRY_DURATION_MS : 0;
+ const fundedAccounts = new Set();
+
+ while (true) {
+ try {
+ const result = hasXdr
+ ? await client.submitTransaction({ xdr: body.xdr! })
+ : await client.submitSorobanTransaction({
+ func: body.func!,
+ auth: body.auth!,
+ });
+
+ return c.json({
+ success: true,
+ data: {
+ transactionId: result.transactionId,
+ hash: result.hash,
+ status: result.status,
+ },
+ });
+ } catch (submitError) {
+ const errorMessage =
+ submitError instanceof Error
+ ? submitError.message
+ : String(submitError);
+
+ const missingAccount = extractMissingAccount(errorMessage);
+ const timeRemaining = deadline - Date.now();
+
+ if (missingAccount && isTestnet && timeRemaining > 0) {
+ if (!fundedAccounts.has(missingAccount)) {
+ console.log(
+ `Account ${missingAccount} not found. Funding via friendbot (${Math.round(
+ timeRemaining / 1000
+ )}s remaining)...`
+ );
+
+ const funded = await fundWithFriendbot(missingAccount);
+ if (funded) {
+ console.log(
+ `Successfully funded ${missingAccount}. Retrying submission...`
+ );
+ fundedAccounts.add(missingAccount);
+ } else {
+ console.error(`Failed to fund ${missingAccount}`);
+ }
+ } else {
+ console.log(`Account ${missingAccount} already funded, retrying...`);
+ }
+
+ continue; // Retry immediately.
+ }
+
+ // Not a recoverable error or deadline exceeded — throw to outer handler.
+ throw submitError;
+ }
+ }
+ } catch (error) {
+ console.error("Relayer submission error:", error);
+
+ if (error instanceof SyntaxError) {
+ return c.json(
+ {
+ success: false,
+ error: "Invalid JSON body",
+ },
+ 400
+ );
+ }
+
+ if (error instanceof PluginExecutionError) {
+ return c.json(
+ {
+ success: false,
+ error: error.message,
+ data: {
+ code: error.errorDetails?.code,
+ details: error.errorDetails?.details,
+ },
+ },
+ 400
+ );
+ }
+
+ if (error instanceof PluginTransportError) {
+ const status = error.statusCode || 500;
+ return c.json(
+ {
+ success: false,
+ error: error.message,
+ },
+ status as 400 | 401 | 403 | 404 | 500 | 502 | 503
+ );
+ }
+
+ return c.json(
+ {
+ success: false,
+ error: error instanceof Error ? error.message : "Relayer request failed",
+ },
+ 500
+ );
+ }
+});
+
+/**
+ * Get proxy status and client info.
+ * GET /status
+ */
+app.get("/status", async (c) => {
+ try {
+ const ip = getClientIP(c.req.raw);
+ const id = c.env.API_KEY_DO.idFromName(ip);
+ const stub = c.env.API_KEY_DO.get(id);
+ const res = await stub.fetch("https://api-key-store/peek");
+ const peek = (res.ok ? await res.json() : { hasKey: false }) as {
+ hasKey: boolean;
+ };
+
+ return c.json({
+ success: true,
+ data: {
+ clientIP: ip,
+ network: c.env.NETWORK,
+ hasKey: peek.hasKey,
+ },
+ });
+ } catch (error) {
+ console.error("Status endpoint failed:", error);
+ return c.json(
+ {
+ success: false,
+ error: "Could not read status",
+ },
+ 500
+ );
+ }
+});
+
+// ============================================================================
+// Worker Export
+// ============================================================================
+
+export default {
+ fetch: app.fetch,
+};
diff --git a/relayer-proxy/tsconfig.json b/relayer-proxy/tsconfig.json
new file mode 100644
index 0000000..3b3e4cd
--- /dev/null
+++ b/relayer-proxy/tsconfig.json
@@ -0,0 +1,13 @@
+{
+ "compilerOptions": {
+ "target": "ES2022",
+ "module": "ESNext",
+ "lib": ["ES2022"],
+ "moduleResolution": "Bundler",
+ "types": ["@cloudflare/workers-types", "vitest/globals"],
+ "strict": true,
+ "noEmit": true,
+ "skipLibCheck": true
+ },
+ "include": ["src/**/*", "worker-configuration.d.ts"]
+}
diff --git a/relayer-proxy/worker-configuration.d.ts b/relayer-proxy/worker-configuration.d.ts
new file mode 100644
index 0000000..bd6749f
--- /dev/null
+++ b/relayer-proxy/worker-configuration.d.ts
@@ -0,0 +1,13 @@
+///
+
+// Worker bindings. Regenerate the full Cloudflare runtime typings with
+// `wrangler types` if you need them; this hand-written subset is all the worker
+// code references.
+interface Env {
+ /** Per-IP Relayer API key custody (serialized get-or-create). */
+ API_KEY_DO: DurableObjectNamespace;
+ /** Which network this instance serves. */
+ NETWORK: "testnet" | "mainnet";
+ /** OpenZeppelin Relayer Channels base URL for this network. */
+ RELAYER_BASE_URL: string;
+}
diff --git a/relayer-proxy/wrangler.toml b/relayer-proxy/wrangler.toml
new file mode 100644
index 0000000..73446aa
--- /dev/null
+++ b/relayer-proxy/wrangler.toml
@@ -0,0 +1,44 @@
+name = "passkey-kit-relayer-proxy"
+main = "src/index.ts"
+compatibility_date = "2024-12-01"
+compatibility_flags = ["nodejs_compat"]
+
+# Per-IP Relayer API key custody. A Durable Object (one instance per client IP)
+# serializes get-or-create so concurrent first-requests mint at most ONE key —
+# the atomic get-or-create KV cannot provide (no CAS). No namespace id to
+# provision; the class is bound directly.
+[[durable_objects.bindings]]
+name = "API_KEY_DO"
+class_name = "ApiKeyStore"
+
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["ApiKeyStore"]
+
+# Raise the CPU limit for testnet's Friendbot-funding retry loop (up to 5
+# minutes). Network wait time (fetch) does not count toward CPU time. Mainnet
+# never retries, so it uses the default limit.
+[limits]
+cpu_ms = 300_000
+
+[vars]
+NETWORK = "testnet"
+RELAYER_BASE_URL = "https://channels.openzeppelin.com/testnet"
+
+# ============================================================================
+# Production environment (mainnet). Deploy: wrangler deploy --env production
+# ============================================================================
+[env.production]
+name = "passkey-kit-relayer-proxy-mainnet"
+
+[env.production.vars]
+NETWORK = "mainnet"
+RELAYER_BASE_URL = "https://channels.openzeppelin.com"
+
+[[env.production.durable_objects.bindings]]
+name = "API_KEY_DO"
+class_name = "ApiKeyStore"
+
+[[env.production.migrations]]
+tag = "v1"
+new_sqlite_classes = ["ApiKeyStore"]
diff --git a/scripts/bindings/build.sh b/scripts/bindings/build.sh
new file mode 100755
index 0000000..ea1df9c
--- /dev/null
+++ b/scripts/bindings/build.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+#
+# Regenerate the passkey-kit-sdk bindings from the canonical smart-wallet WASM.
+#
+# The canonical hash is THE source of truth (docs/deployments-testnet-*.md). The
+# WASM is fetched by hash from testnet, bindings are generated to a temp dir with
+# the pinned Stellar CLI, and only the generated `src/index.ts` (+ README) are
+# copied into the package — the B1 packaging (package.json, tsconfig, dist build)
+# is preserved. NEVER hand-edit the generated bindings; add post-gen steps here.
+#
+# Usage: bash scripts/bindings/build.sh
+set -euo pipefail
+
+# Canonical smart-wallet WASM hash — keep in sync with the deployments manifest
+# (docs/deployments-testnet-2026-07-11.md). Pinned Stellar CLI: 27.0.0.
+CANONICAL_HASH="84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319"
+NETWORK="testnet"
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+PKG_SRC="$ROOT/packages/passkey-kit-sdk/src/index.ts"
+PKG_README="$ROOT/packages/passkey-kit-sdk/README.md"
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "Fetching canonical WASM ${CANONICAL_HASH} from ${NETWORK}…"
+stellar contract fetch --wasm-hash "$CANONICAL_HASH" --network "$NETWORK" \
+ --out-file "$TMP/smart-wallet.wasm"
+
+ACTUAL="$(shasum -a 256 "$TMP/smart-wallet.wasm" | awk '{print $1}')"
+if [ "$ACTUAL" != "$CANONICAL_HASH" ]; then
+ echo "✗ Fetched WASM hash ($ACTUAL) != canonical ($CANONICAL_HASH)" >&2
+ exit 1
+fi
+
+echo "Generating TypeScript bindings…"
+# The CLI derives the generated README's package name from the output-dir
+# basename; keep it "pks-gen" so the released README name stays stable across
+# regens (verify.sh compares only the name-independent spec base64).
+stellar contract bindings typescript --wasm "$TMP/smart-wallet.wasm" \
+ --overwrite --output-dir "$TMP/pks-gen" >/dev/null
+
+echo "Applying post-gen patches (copy generated spec, preserve packaging)…"
+cp "$TMP/pks-gen/src/index.ts" "$PKG_SRC"
+cp "$TMP/pks-gen/README.md" "$PKG_README"
+
+echo "✓ Regenerated passkey-kit-sdk from canonical WASM ${CANONICAL_HASH}"
+echo " Run 'pnpm --filter passkey-kit-sdk run build' to rebuild dist."
diff --git a/scripts/bindings/verify.sh b/scripts/bindings/verify.sh
new file mode 100755
index 0000000..1095183
--- /dev/null
+++ b/scripts/bindings/verify.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+#
+# Bindings drift guard.
+#
+# Proves the committed passkey-kit-sdk bindings match the canonical smart-wallet
+# WASM: fetch the WASM by its pinned hash, regenerate to a temp dir, and diff the
+# ContractSpec base64 array (the semantic content — CLI formatting/comments are
+# ignored) against the committed bindings. Fails the build/release on drift.
+#
+# Usage: bash scripts/bindings/verify.sh
+set -euo pipefail
+
+CANONICAL_HASH="84924c53a413318df2ce753e30de53ec651404c916d30e861718ad155c94b319"
+NETWORK="testnet"
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+PKG_SRC="$ROOT/packages/passkey-kit-sdk/src/index.ts"
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "verify:bindings — canonical WASM ${CANONICAL_HASH} (${NETWORK})"
+
+stellar contract fetch --wasm-hash "$CANONICAL_HASH" --network "$NETWORK" \
+ --out-file "$TMP/smart-wallet.wasm"
+
+ACTUAL="$(shasum -a 256 "$TMP/smart-wallet.wasm" | awk '{print $1}')"
+if [ "$ACTUAL" != "$CANONICAL_HASH" ]; then
+ echo "✗ Fetched WASM hash ($ACTUAL) != canonical ($CANONICAL_HASH)" >&2
+ exit 1
+fi
+
+stellar contract bindings typescript --wasm "$TMP/smart-wallet.wasm" \
+ --overwrite --output-dir "$TMP/pks-gen" >/dev/null
+
+# Extract the ContractSpec base64 string literals (>= 16 chars, base64 charset),
+# in order. This is the wasm-determined spec, independent of CLI TS formatting.
+extract_spec() {
+ grep -oE '"[A-Za-z0-9+/]{16,}={0,2}"' "$1"
+}
+
+if diff -u \
+ <(extract_spec "$PKG_SRC") \
+ <(extract_spec "$TMP/pks-gen/src/index.ts"); then
+ echo "✓ Committed bindings match canonical WASM ${CANONICAL_HASH}"
+else
+ echo "" >&2
+ echo "✗ Bindings DRIFT from the canonical WASM." >&2
+ echo " Regenerate with: bash scripts/bindings/build.sh" >&2
+ echo " (then rebuild + review the diff before committing)" >&2
+ exit 1
+fi
diff --git a/scripts/e2e/agent-browser-webauthn-helper.mjs b/scripts/e2e/agent-browser-webauthn-helper.mjs
new file mode 100755
index 0000000..00a926c
--- /dev/null
+++ b/scripts/e2e/agent-browser-webauthn-helper.mjs
@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+
+/**
+ * Attach a virtual WebAuthn authenticator (CDP `WebAuthn.addVirtualAuthenticator`)
+ * to a live agent-browser session, keep the CDP attachment open while a child
+ * command runs, and tear the authenticator down in a `finally` — so passkey
+ * ceremonies resolve headlessly and nothing leaks between runs.
+ *
+ * Ported from smart-account-kit (project 34); generic — no passkey-kit specifics.
+ *
+ * Usage:
+ * node scripts/e2e/agent-browser-webauthn-helper.mjs run --session -- [args...]
+ */
+
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_AUTHENTICATOR_OPTIONS = {
+ protocol: "ctap2",
+ transport: "internal",
+ hasResidentKey: true,
+ hasUserVerification: true,
+ isUserVerified: true,
+ automaticPresenceSimulation: true,
+};
+
+function printUsage() {
+ console.error(`
+Usage:
+ node scripts/e2e/agent-browser-webauthn-helper.mjs run [options] -- [args...]
+
+Description:
+ Attaches a virtual WebAuthn authenticator to a live agent-browser session, keeps
+ the CDP attachment open while your command runs, and cleans it up afterward.
+
+Options:
+ --session Existing agent-browser session name
+ --cdp-url Explicit CDP WebSocket URL (overrides --session lookup)
+ --url Page URL to bind within the browser session
+ --transport internal | usb | nfc | ble | cable
+ --protocol ctap2 | u2f
+ --resident-key true | false
+ --user-verification true | false
+ --verified true | false
+ --presence true | false
+
+Example:
+ agent-browser --session demo open http://127.0.0.1:5173
+ node scripts/e2e/agent-browser-webauthn-helper.mjs run --session demo -- \\
+ bash scripts/e2e/browser-full-e2e-audit.sh
+`);
+}
+
+function parseArgs(argv) {
+ const normalized = argv[0] === "--" ? argv.slice(1) : argv;
+ const command = normalized[0];
+ if (!command) {
+ printUsage();
+ process.exit(1);
+ }
+
+ const separator = normalized.indexOf("--");
+ const optionTokens =
+ separator === -1 ? normalized.slice(1) : normalized.slice(1, separator);
+ const childCommand = separator === -1 ? [] : normalized.slice(separator + 1);
+
+ const args = { _: [] };
+ for (let i = 0; i < optionTokens.length; i += 1) {
+ const token = optionTokens[i];
+ if (!token.startsWith("--")) {
+ args._.push(token);
+ continue;
+ }
+
+ const key = token.slice(2);
+ const next = optionTokens[i + 1];
+ if (!next || next.startsWith("--")) {
+ args[key] = true;
+ continue;
+ }
+
+ args[key] = next;
+ i += 1;
+ }
+
+ return { command, args, childCommand };
+}
+
+function parseBoolean(value, fallback) {
+ if (value === undefined) return fallback;
+ if (typeof value === "boolean") return value;
+
+ const normalized = String(value).toLowerCase();
+ if (["true", "1", "yes", "on"].includes(normalized)) return true;
+ if (["false", "0", "no", "off"].includes(normalized)) return false;
+ throw new Error(`Expected a boolean value, received "${value}"`);
+}
+
+async function runAgentBrowser(args) {
+ const { stdout } = await execFileAsync("agent-browser", args, {
+ encoding: "utf8",
+ });
+ return stdout.trim();
+}
+
+function getLastNonEmptyLine(output) {
+ return output
+ .split("\n")
+ .map((line) => line.trim())
+ .filter(Boolean)
+ .at(-1);
+}
+
+async function resolveCDPUrl(args) {
+ if (args["cdp-url"] && args["cdp-url"] !== true) return args["cdp-url"];
+
+ const session = args.session;
+ if (!session || session === true) {
+ throw new Error("Provide --session or --cdp-url");
+ }
+
+ const output = await runAgentBrowser(["--session", session, "get", "cdp-url"]);
+ const cdpUrl = getLastNonEmptyLine(output);
+ if (!cdpUrl) {
+ throw new Error(`Unable to resolve CDP URL for session "${session}"`);
+ }
+ return cdpUrl;
+}
+
+async function resolveCurrentUrl(args) {
+ if (args.url && args.url !== true) return args.url;
+
+ const session = args.session;
+ if (!session || session === true) return null;
+
+ const output = await runAgentBrowser(["--session", session, "get", "url"]);
+ return getLastNonEmptyLine(output) ?? null;
+}
+
+function createCDPConnection(browserWsUrl) {
+ const socket = new WebSocket(browserWsUrl);
+ let nextId = 0;
+ const pending = new Map();
+
+ socket.onmessage = (event) => {
+ const message = JSON.parse(event.data);
+ if (message.id && pending.has(message.id)) {
+ const { resolve, reject } = pending.get(message.id);
+ pending.delete(message.id);
+ if (message.error) reject(new Error(JSON.stringify(message.error)));
+ else resolve(message.result);
+ }
+ };
+
+ const ready = new Promise((resolve, reject) => {
+ socket.onopen = () => resolve();
+ socket.onerror = (event) =>
+ reject(new Error(`WebSocket error: ${event.type}`));
+ });
+
+ const send = (method, params = {}, sessionId) =>
+ new Promise((resolve, reject) => {
+ const id = ++nextId;
+ pending.set(id, { resolve, reject });
+ const payload = { id, method, params };
+ if (sessionId) payload.sessionId = sessionId;
+ socket.send(JSON.stringify(payload));
+ });
+
+ const close = () => {
+ if (
+ socket.readyState === WebSocket.OPEN ||
+ socket.readyState === WebSocket.CONNECTING
+ ) {
+ socket.close();
+ }
+ };
+
+ return { ready, send, close };
+}
+
+async function attachToPage(send, preferredUrl) {
+ const { targetInfos } = await send("Target.getTargets");
+ const pages = targetInfos.filter((target) => target.type === "page");
+
+ const pageTarget =
+ (preferredUrl
+ ? pages.find((target) => target.url === preferredUrl)
+ : null) ??
+ pages.find((target) => target.url && target.url !== "about:blank") ??
+ pages.at(-1);
+
+ if (!pageTarget) {
+ throw new Error("Unable to find a page target in the remote browser");
+ }
+
+ const { sessionId } = await send("Target.attachToTarget", {
+ targetId: pageTarget.targetId,
+ flatten: true,
+ });
+
+ return { sessionId, pageUrl: pageTarget.url, targetId: pageTarget.targetId };
+}
+
+async function runChildCommand(command, args) {
+ return new Promise((resolve, reject) => {
+ const child = spawn(command, args, { stdio: "inherit", env: process.env });
+ child.on("error", reject);
+ child.on("exit", (code, signal) => {
+ if (signal) {
+ reject(new Error(`Child command exited via signal ${signal}`));
+ return;
+ }
+ resolve(code ?? 0);
+ });
+ });
+}
+
+async function commandRun(args, childCommand) {
+ if (childCommand.length === 0) {
+ throw new Error("run requires a child command after --");
+ }
+
+ const cdpUrl = await resolveCDPUrl(args);
+ const preferredUrl = await resolveCurrentUrl(args);
+ const connection = createCDPConnection(cdpUrl);
+ await connection.ready;
+
+ const { sessionId, pageUrl } = await attachToPage(
+ connection.send,
+ preferredUrl,
+ );
+ const authenticatorOptions = {
+ protocol: args.protocol || DEFAULT_AUTHENTICATOR_OPTIONS.protocol,
+ transport: args.transport || DEFAULT_AUTHENTICATOR_OPTIONS.transport,
+ hasResidentKey: parseBoolean(
+ args["resident-key"],
+ DEFAULT_AUTHENTICATOR_OPTIONS.hasResidentKey,
+ ),
+ hasUserVerification: parseBoolean(
+ args["user-verification"],
+ DEFAULT_AUTHENTICATOR_OPTIONS.hasUserVerification,
+ ),
+ isUserVerified: parseBoolean(
+ args.verified,
+ DEFAULT_AUTHENTICATOR_OPTIONS.isUserVerified,
+ ),
+ automaticPresenceSimulation: parseBoolean(
+ args.presence,
+ DEFAULT_AUTHENTICATOR_OPTIONS.automaticPresenceSimulation,
+ ),
+ };
+
+ await connection.send("WebAuthn.enable", {}, sessionId);
+ const { authenticatorId } = await connection.send(
+ "WebAuthn.addVirtualAuthenticator",
+ { options: authenticatorOptions },
+ sessionId,
+ );
+
+ console.error(
+ JSON.stringify(
+ {
+ session: typeof args.session === "string" ? args.session : null,
+ cdpUrl,
+ pageUrl,
+ authenticatorId,
+ options: authenticatorOptions,
+ },
+ null,
+ 2,
+ ),
+ );
+
+ let exitCode = 0;
+ try {
+ exitCode = await runChildCommand(childCommand[0], childCommand.slice(1));
+ } finally {
+ try {
+ await connection.send(
+ "WebAuthn.removeVirtualAuthenticator",
+ { authenticatorId },
+ sessionId,
+ );
+ } catch (error) {
+ console.error(
+ `Cleanup warning: ${error instanceof Error ? error.message : String(error)}`,
+ );
+ }
+
+ try {
+ await connection.send("WebAuthn.disable", {}, sessionId);
+ } catch (error) {
+ console.error(
+ `Cleanup warning: ${error instanceof Error ? error.message : String(error)}`,
+ );
+ }
+
+ connection.close();
+ }
+
+ process.exitCode = exitCode;
+}
+
+const { command, args, childCommand } = parseArgs(process.argv.slice(2));
+
+try {
+ switch (command) {
+ case "run":
+ await commandRun(args, childCommand);
+ break;
+ case "help":
+ case "--help":
+ case "-h":
+ printUsage();
+ break;
+ default:
+ throw new Error(`Unknown command "${command}"`);
+ }
+} catch (error) {
+ console.error(error instanceof Error ? error.message : String(error));
+ process.exit(1);
+}
diff --git a/scripts/e2e/browser-full-e2e-audit.sh b/scripts/e2e/browser-full-e2e-audit.sh
new file mode 100755
index 0000000..2a5543e
--- /dev/null
+++ b/scripts/e2e/browser-full-e2e-audit.sh
@@ -0,0 +1,333 @@
+#!/usr/bin/env bash
+
+# Full browser e2e audit for the passkey-kit demo.
+#
+# Drives the real Svelte demo through the passkey-kit flow and asserts REAL
+# outputs (a C… contract id, 64-hex tx hashes, explicit failure patterns on every
+# wait). Uses Svelte `data-testid` selectors — no React native-setter shims.
+#
+# Runs inside testnet-passkey-smoke.sh (a live agent-browser session with a
+# virtual WebAuthn authenticator). Layers gate automatically: if the demo header
+# shows "no relayer proxy" the on-chain layers are skipped (explicitly, never a
+# silent pass); discovery is skipped when "no indexer proxy" is shown.
+#
+# Distinct exit code per layer:
+# 10 setup 20 create 21 reconnect 30 fund 31 transfer
+# 40 add-secp 41 add-ed25519 42 add-policy 43 update 44 per-signer-transfer 45 remove
+# 50 discover-mercury 51 discover-stellar-indexer 52 reverse-lookup
+
+set -euo pipefail
+
+SESSION_NAME="${SESSION_NAME:?SESSION_NAME is required}"
+DEMO_URL="${DEMO_URL:-http://127.0.0.1:5173}"
+SKIP_ONCHAIN="${SKIP_ONCHAIN:-auto}"
+# Destination for the primary transfer; falls back to the demo's own funding
+# address (always exists) via the "use fund addr" control when unset.
+RECIPIENT_ADDRESS="${RECIPIENT_ADDRESS:-}"
+
+ab() { agent-browser --session "$SESSION_NAME" "$@"; }
+
+CURRENT_LAYER="setup"
+CURRENT_CODE=10
+layer() {
+ CURRENT_LAYER="$1"
+ CURRENT_CODE="$2"
+ echo "── [$CURRENT_CODE] $CURRENT_LAYER ────────────────────────────────"
+}
+fail() {
+ echo "FAIL [$CURRENT_CODE] $CURRENT_LAYER: $1" >&2
+ echo "---- log-box ----" >&2
+ log_box >&2 || true
+ exit "$CURRENT_CODE"
+}
+
+log_box() { ab get text '[data-testid="log-box"]' 2>/dev/null || true; }
+header_text() { ab get text '[data-testid="header"]' 2>/dev/null || true; }
+body_text() { ab get text body 2>/dev/null || true; }
+contract_id() { ab get text '[data-testid="wallet-contract-id"]' 2>/dev/null | tr -d '[:space:]'; }
+# querySelector returns the FIRST (newest, list is prepended) tx-hash → deterministic.
+latest_hash() {
+ ab eval 'document.querySelector("[data-testid=\"tx-hash\"]")?.dataset.hash ?? ""' 2>/dev/null | tr -d '[:space:]"'
+}
+log_line_count() { printf '%s\n' "$(log_box)" | wc -l | tr -d ' '; }
+
+# Wait for a NEW log entry (newest-first) matching success/failure since a prior
+# line count. Returns 0 success, 2 failure-pattern, 1 timeout.
+wait_new_log() {
+ local previous_count="$1" success="$2" failure="$3" attempts="${4:-60}"
+ for _ in $(seq 1 "$attempts"); do
+ local all total new_count slice
+ all="$(log_box)"
+ total="$(printf '%s\n' "$all" | wc -l | tr -d ' ')"
+ new_count=$(( total - previous_count ))
+ if (( new_count > 0 )); then
+ slice="$(printf '%s\n' "$all" | head -n "$new_count")"
+ else
+ slice=""
+ fi
+ if [[ -n "$failure" ]] && printf '%s\n' "$slice" | grep -Eq "$failure"; then
+ return 2
+ fi
+ if printf '%s\n' "$slice" | grep -Eq "$success"; then
+ return 0
+ fi
+ sleep 2
+ done
+ return 1
+}
+
+# Click a testid; fail the layer if the element is missing.
+click_tid() {
+ ab click "[data-testid=\"$1\"]" >/dev/null 2>&1 || fail "missing/again unclickable: $1"
+}
+fill_tid() {
+ ab fill "[data-testid=\"$1\"]" "$2" >/dev/null 2>&1 || fail "missing input: $1"
+}
+has_tid() { [[ "$(ab get count "[data-testid=\"$1\"]" 2>/dev/null | tr -d '[:space:]')" != "0" ]]; }
+
+# Wait until a control is present AND enabled. Flows set `app.busy` for their
+# whole duration (disabling action buttons), and `createWallet` keeps busy set
+# through its trailing auto-fund AFTER the "Wallet created" log — so a layer that
+# acts on the "created" log alone can click a still-disabled button (a no-op).
+wait_enabled() {
+ local tid="$1" attempts="${2:-90}"
+ for _ in $(seq 1 "$attempts"); do
+ if [[ "$(ab eval "document.querySelector('[data-testid=\"$tid\"]')?.disabled === false" 2>/dev/null | tr -d '[:space:]"')" == "true" ]]; then
+ return 0
+ fi
+ sleep 1
+ done
+ return 1
+}
+
+# Best-effort "let the previous flow settle" gate. Every action button is
+# `disabled={app.busy}`, and a flow can keep busy set for a moment AFTER its
+# success log (e.g. a trailing balance refresh) — so the next layer, clicking
+# immediately, would hit a still-disabled button (a silent no-op → timeout).
+# Gates on the always-present `disconnect` button; a no-op while disconnected
+# (button absent, e.g. the create layer). Never hard-fails — the action's own
+# wait catches a genuine stall.
+wait_idle() {
+ for _ in $(seq 1 "${1:-90}"); do
+ local s
+ s="$(ab eval '(()=>{const b=document.querySelector("[data-testid=\"disconnect\"]");return b?(b.disabled?"busy":"idle"):"absent";})()' 2>/dev/null | tr -d '[:space:]"')"
+ [[ "$s" == "idle" || "$s" == "absent" ]] && return 0
+ sleep 1
+ done
+ return 0
+}
+
+# Run one write layer: capture the log count, run the click closure, wait.
+expect_after() {
+ local success="$1" failure="$2" attempts="${3:-90}"; shift 3
+ wait_idle
+ local before; before="$(log_line_count)"
+ "$@"
+ case "$(wait_new_log "$before" "$success" "$failure" "$attempts"; echo $?)" in
+ 0) echo " ✓ $success" ;;
+ 2) fail "hit failure pattern ($failure)" ;;
+ *) fail "timed out waiting for: $success" ;;
+ esac
+}
+
+########################################################################
+layer "setup" 10
+echo "Opening $DEMO_URL"
+ab open "$DEMO_URL" >/dev/null || fail "could not open demo"
+sleep 2
+# The demo must have mounted (header rendered). A blank body means the module
+# crashed — usually a missing demo/.env.local (copy demo/.env.example).
+if ! printf '%s\n' "$(body_text)" | grep -q "Passkey Kit"; then
+ fail "demo did not render — configure demo/.env.local (copy demo/.env.example)"
+fi
+HEADER="$(header_text)"
+echo " header: $HEADER"
+
+ONCHAIN=1
+case "$SKIP_ONCHAIN" in
+ 1|true|yes) ONCHAIN=0 ;;
+ 0|false|no) ONCHAIN=1 ;;
+ *) printf '%s\n' "$HEADER" | grep -q "no relayer proxy" && ONCHAIN=0 ;;
+esac
+INDEXER=1
+printf '%s\n' "$HEADER" | grep -q "no indexer proxy" && INDEXER=0
+
+if (( ONCHAIN == 0 )); then
+ echo
+ echo "on-chain layers SKIPPED: relayer proxy not configured."
+ echo "Set VITE_relayerProxyUrl in demo/.env.local (and start the relayer-proxy"
+ echo "worker) to run create → transfer → signer → discovery live (F2)."
+ # Still assert the disconnected UI is wired.
+ has_tid "register" || fail "register control missing on disconnected UI"
+ echo "Disconnected UI wired (register control present). Static UI audit passed."
+ exit 0
+fi
+
+########################################################################
+layer "create" 20
+USER_NAME="audit$(date +%s)"
+echo "Creating wallet for $USER_NAME"
+fill_tid "register-name" "$USER_NAME"
+expect_after "Wallet created" "Create wallet failed|Deploy wallet failed" 150 click_tid "register"
+CONTRACT_ID="$(contract_id)"
+printf '%s\n' "$CONTRACT_ID" | grep -Eq '^C[A-Z2-7]{55}$' || fail "no valid contract id (got: '$CONTRACT_ID')"
+echo " contract: $CONTRACT_ID"
+CREATE_HASH="$(latest_hash)"
+printf '%s\n' "$CREATE_HASH" | grep -Eq '^[0-9a-f]{64}$' || fail "no valid deploy tx hash (got: '$CREATE_HASH')"
+echo " deploy tx: $CREATE_HASH"
+
+########################################################################
+layer "reconnect" 21
+echo "Disconnect + reconnect via discoverable passkey"
+# createWallet stays busy through its auto-fund; wait for that to settle so the
+# disconnect button is actually enabled before we click it.
+wait_enabled "disconnect" 90 || fail "disconnect never became enabled (create auto-fund still running?)"
+click_tid "disconnect"
+sleep 1
+has_tid "signin" || fail "signin control missing after disconnect"
+expect_after "Connected — ownership verified" "Connect wallet failed" 120 click_tid "signin"
+RECONNECT_ID="$(contract_id)"
+[[ "$RECONNECT_ID" == "$CONTRACT_ID" ]] || fail "reconnected to a different wallet ($RECONNECT_ID != $CONTRACT_ID)"
+echo " reconnected to $RECONNECT_ID (ownership verified)"
+
+########################################################################
+layer "fund" 30
+echo "Funding wallet"
+expect_after "Fund wallet ✓" "Fund wallet failed|Create wallet failed" 150 click_tid "fund-wallet"
+
+########################################################################
+layer "transfer" 31
+echo "Primary transfer (signed by passkey)"
+click_tid "use-fund-addr"
+sleep 1
+[[ -n "$RECIPIENT_ADDRESS" ]] && fill_tid "transfer-to" "$RECIPIENT_ADDRESS"
+fill_tid "transfer-amount" "1"
+expect_after "Transfer \(passkey\) ✓" "Transfer \(passkey\) failed" 150 click_tid "transfer-send"
+TRANSFER_HASH="$(latest_hash)"
+printf '%s\n' "$TRANSFER_HASH" | grep -Eq '^[0-9a-f]{64}$' || fail "no valid transfer tx hash"
+echo " transfer tx: $TRANSFER_HASH"
+
+########################################################################
+layer "add-secp" 40
+echo "Add secp256r1 passkey signer"
+click_tid "add-kind-Secp256r1"
+fill_tid "add-signer-name" "session-$(date +%s)"
+expect_after "Add passkey signer ✓" "Add passkey signer failed" 150 click_tid "add-signer-submit"
+
+########################################################################
+layer "add-ed25519" 41
+echo "Add Ed25519 signer"
+click_tid "add-kind-Ed25519"
+expect_after "Add Ed25519 signer ✓" "Add Ed25519 signer failed" 150 click_tid "add-signer-submit"
+
+########################################################################
+layer "add-policy" 42
+POLICY_ENABLED="$(ab eval 'document.querySelector("[data-testid=\"add-kind-Policy\"]")?.disabled === false' 2>/dev/null | tr -d '[:space:]')"
+if [[ "$POLICY_ENABLED" == "true" ]]; then
+ echo "Add policy signer"
+ click_tid "add-kind-Policy"
+ expect_after "Add policy signer ✓" "Add policy signer failed" 150 click_tid "add-signer-submit"
+else
+ echo " SKIP: no VITE_samplePolicyId configured (policy-signer controls disabled)"
+fi
+
+########################################################################
+layer "update" 43
+echo "Update the Ed25519 signer (limits/store)"
+ED_ROW='[data-testid="signer-row"][data-kind="Ed25519"]'
+if [[ "$(ab get count "$ED_ROW" 2>/dev/null | tr -d '[:space:]')" != "0" ]]; then
+ wait_idle
+ ab click "$ED_ROW [data-testid=\"signer-update\"]" >/dev/null 2>&1 || fail "update control missing"
+ sleep 1
+ before="$(log_line_count)"
+ ab click "$ED_ROW [data-testid=\"signer-update-save\"]" >/dev/null 2>&1 || fail "update-save missing"
+ case "$(wait_new_log "$before" "Update Ed25519 signer ✓" "Update Ed25519 signer failed" 150; echo $?)" in
+ 0) echo " ✓ Update Ed25519 signer ✓" ;;
+ 2) fail "update hit failure pattern" ;;
+ *) fail "update timed out" ;;
+ esac
+else
+ echo " SKIP: no Ed25519 row present"
+fi
+
+########################################################################
+layer "per-signer-transfer" 44
+echo "Per-signer transfer via the Ed25519 signer row"
+if [[ "$(ab get count "$ED_ROW" 2>/dev/null | tr -d '[:space:]')" != "0" ]]; then
+ wait_idle
+ before="$(log_line_count)"
+ ab click "$ED_ROW [data-testid=\"signer-transfer\"]" >/dev/null 2>&1 || fail "per-signer transfer control missing"
+ case "$(wait_new_log "$before" "Transfer via Ed25519 ✓" "Transfer via Ed25519 failed" 150; echo $?)" in
+ 0) echo " ✓ Transfer via Ed25519 ✓" ;;
+ 2) fail "per-signer transfer hit failure pattern" ;;
+ *) fail "per-signer transfer timed out" ;;
+ esac
+else
+ echo " SKIP: no Ed25519 row present"
+fi
+
+########################################################################
+layer "remove" 45
+echo "Remove the Ed25519 signer"
+if [[ "$(ab get count "$ED_ROW" 2>/dev/null | tr -d '[:space:]')" != "0" ]]; then
+ wait_idle
+ before="$(log_line_count)"
+ ab click "$ED_ROW [data-testid=\"signer-remove\"]" >/dev/null 2>&1 || fail "remove control missing"
+ case "$(wait_new_log "$before" "Remove Ed25519 signer ✓" "Remove Ed25519 signer failed" 150; echo $?)" in
+ 0) echo " ✓ Remove Ed25519 signer ✓" ;;
+ 2) fail "remove hit failure pattern" ;;
+ *) fail "remove timed out" ;;
+ esac
+else
+ echo " SKIP: no Ed25519 row present"
+fi
+
+########################################################################
+if (( INDEXER == 0 )); then
+ echo
+ echo "discovery layers SKIPPED: indexer proxy not configured."
+ echo "Set VITE_indexerProxyUrl in demo/.env.local to run Mercury + Stellar"
+ echo "Indexer discovery live (F2)."
+ echo
+ echo "On-chain audit passed for contract $CONTRACT_ID"
+ exit 0
+fi
+
+# lookupWithRetry: indexers lag the ledger, so poll until a signer is discovered.
+discover_backend() {
+ local backend="$1" code="$2"
+ layer "discover-$backend" "$code"
+ click_tid "backend-$backend"
+ local ok=""
+ for _ in $(seq 1 20); do
+ before="$(log_line_count)"
+ ab click '[data-testid="discover"]' >/dev/null 2>&1 || fail "discover control missing"
+ if wait_new_log "$before" "Discovered [1-9][0-9]* signer\(s\) via $backend" "Discover via $backend failed" 6; then
+ ok=1
+ break
+ fi
+ sleep 3
+ done
+ [[ -n "$ok" ]] || fail "no signers discovered via $backend after retries"
+ [[ "$(ab get count '[data-testid="discovered-list"] .signer' 2>/dev/null | tr -d '[:space:]')" != "0" ]] \
+ || fail "discovered list empty for $backend"
+ echo " ✓ discovery via $backend returned signers"
+}
+
+discover_backend "mercury" 50
+discover_backend "stellar-indexer" 51
+
+layer "reverse-lookup" 52
+echo "Reverse lookup keyId → wallet(s)"
+before="$(log_line_count)"
+click_tid "reverse-lookup"
+case "$(wait_new_log "$before" "matches connected ✓|keyId → [1-9][0-9]* wallet" "Reverse lookup .* failed" 60; echo $?)" in
+ 0) echo " ✓ reverse lookup resolved the wallet" ;;
+ 2) fail "reverse lookup hit failure pattern" ;;
+ *) fail "reverse lookup timed out" ;;
+esac
+
+echo
+echo "FULL e2e audit passed for contract $CONTRACT_ID"
+echo " deploy tx: $CREATE_HASH"
+echo " transfer tx: $TRANSFER_HASH"
diff --git a/scripts/e2e/testnet-passkey-smoke.sh b/scripts/e2e/testnet-passkey-smoke.sh
new file mode 100755
index 0000000..176b12b
--- /dev/null
+++ b/scripts/e2e/testnet-passkey-smoke.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+
+# Testnet smoke orchestration for the passkey-kit demo.
+#
+# - Starts the demo's Vite server (idempotently — an lsof guard skips the start
+# and the kill if something is already listening on the port).
+# - Opens a fresh agent-browser session and attaches a virtual WebAuthn
+# authenticator (via agent-browser-webauthn-helper.mjs) for the child run.
+# - EXIT trap kills ONLY the server this script started and closes ONLY this
+# script's agent-browser session — no orphaned Chrome-for-Testing.
+#
+# MODE selects the child: `audit` (default, full e2e) or `probe` (backend-free
+# WebAuthn sanity). Demo config comes from demo/.env.local (copy .env.example).
+# Ported from smart-account-kit (project 34); adapted to the single passkey-kit demo.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+DEMO_DIR="$ROOT_DIR/demo"
+
+DEV_HOST="${DEV_HOST:-127.0.0.1}"
+DEMO_PORT="${DEMO_PORT:-5173}"
+DEMO_URL="${DEMO_URL:-http://${DEV_HOST}:${DEMO_PORT}}"
+SESSION_NAME="${SESSION_NAME:-passkey-kit-smoke-$(date +%s)}"
+MODE="${MODE:-audit}"
+case "$MODE" in
+ probe) E2E_CHILD="${E2E_CHILD:-$ROOT_DIR/scripts/e2e/webauthn-browser-probe.sh}" ;;
+ audit) E2E_CHILD="${E2E_CHILD:-$ROOT_DIR/scripts/e2e/browser-full-e2e-audit.sh}" ;;
+ *) E2E_CHILD="${E2E_CHILD:?unknown MODE (use probe|audit) and no E2E_CHILD override}" ;;
+esac
+
+DEMO_SERVER_PID=""
+
+wait_for_url() {
+ local url="$1"
+ local attempts="${2:-60}"
+ for _ in $(seq 1 "$attempts"); do
+ if curl -fsS "$url" >/dev/null 2>&1; then
+ return 0
+ fi
+ sleep 1
+ done
+ echo "Timed out waiting for $url" >&2
+ return 1
+}
+
+start_demo_if_needed() {
+ local log_path="/tmp/passkey-kit-demo-smoke.log"
+
+ if lsof -nP -iTCP:"$DEMO_PORT" -sTCP:LISTEN >/dev/null 2>&1; then
+ echo "Demo already running on port $DEMO_PORT (leaving it running)"
+ return 0
+ fi
+
+ echo "Starting demo on ${DEV_HOST}:${DEMO_PORT}"
+ (
+ cd "$DEMO_DIR"
+ pnpm --ignore-workspace exec vite --host "$DEV_HOST" --port "$DEMO_PORT" --strictPort
+ ) >"$log_path" 2>&1 &
+ DEMO_SERVER_PID=$!
+ wait_for_url "$DEMO_URL" || {
+ echo "Demo did not come up; last log lines:" >&2
+ tail -n 20 "$log_path" >&2 || true
+ return 1
+ }
+}
+
+cleanup() {
+ local exit_code=$?
+ if [[ -n "$DEMO_SERVER_PID" ]]; then
+ kill "$DEMO_SERVER_PID" >/dev/null 2>&1 || true
+ fi
+ agent-browser --session "$SESSION_NAME" close >/dev/null 2>&1 || true
+ exit "$exit_code"
+}
+trap cleanup EXIT
+
+start_demo_if_needed
+
+# Fresh session + first navigation, so the helper can resolve the CDP url and
+# attach the authenticator to a live page.
+agent-browser --session "$SESSION_NAME" open "$DEMO_URL" >/dev/null
+
+echo "Running child under a virtual WebAuthn authenticator: $E2E_CHILD"
+node "$ROOT_DIR/scripts/e2e/agent-browser-webauthn-helper.mjs" run \
+ --session "$SESSION_NAME" --url "$DEMO_URL" -- \
+ env \
+ SESSION_NAME="$SESSION_NAME" \
+ DEMO_URL="$DEMO_URL" \
+ PROBE_URL="$DEMO_URL" \
+ RELAYER_PROXY_URL="${RELAYER_PROXY_URL:-}" \
+ INDEXER_PROXY_URL="${INDEXER_PROXY_URL:-}" \
+ RECIPIENT_ADDRESS="${RECIPIENT_ADDRESS:-}" \
+ SKIP_ONCHAIN="${SKIP_ONCHAIN:-auto}" \
+ bash "$E2E_CHILD"
diff --git a/scripts/e2e/webauthn-browser-probe.sh b/scripts/e2e/webauthn-browser-probe.sh
new file mode 100755
index 0000000..9ee68ff
--- /dev/null
+++ b/scripts/e2e/webauthn-browser-probe.sh
@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+
+# Isolated WebAuthn sanity probe: in a live agent-browser session (with a virtual
+# authenticator attached by agent-browser-webauthn-helper.mjs), run a full
+# navigator.credentials.create -> get -> crypto.subtle.verify round-trip and print
+# the credential id + raw P-256 public key + verification result as JSON.
+#
+# This proves the CDP virtual authenticator + secp256r1 WebAuthn stack works
+# before the full demo audit blames a real failure on the browser layer.
+#
+# Ported from smart-account-kit (project 34); generic.
+
+set -euo pipefail
+
+SESSION_NAME="${SESSION_NAME:?SESSION_NAME is required}"
+PROBE_URL="${PROBE_URL:-http://localhost:5173}"
+
+agent-browser --session "$SESSION_NAME" open "$PROBE_URL" >/dev/null
+
+PROBE_JS="$(cat <<'JS'
+(() => {
+ const toBase64Url = (bytes) => {
+ let binary = "";
+ bytes.forEach((byte) => {
+ binary += String.fromCharCode(byte);
+ });
+ return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+ };
+
+ const toHex = (bytes) =>
+ Array.from(bytes)
+ .map((byte) => byte.toString(16).padStart(2, "0"))
+ .join("");
+
+ document.body.innerHTML = '';
+ window.__probeResult = null;
+
+ document.getElementById("probe").onclick = async () => {
+ try {
+ const registrationChallenge = crypto.getRandomValues(new Uint8Array(32));
+ const userId = crypto.getRandomValues(new Uint8Array(16));
+ const credential = await navigator.credentials.create({
+ publicKey: {
+ challenge: registrationChallenge,
+ rp: { id: location.hostname, name: "Probe" },
+ user: {
+ id: userId,
+ name: `probe-${Date.now()}`,
+ displayName: "Probe User",
+ },
+ pubKeyCredParams: [{ alg: -7, type: "public-key" }],
+ authenticatorSelection: {
+ residentKey: "preferred",
+ userVerification: "preferred",
+ },
+ timeout: 60000,
+ },
+ });
+
+ const spki = credential.response.getPublicKey();
+ const publicKey = await crypto.subtle.importKey(
+ "spki",
+ spki,
+ { name: "ECDSA", namedCurve: "P-256" },
+ true,
+ ["verify"]
+ );
+ const rawPublicKey = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
+
+ const authChallenge = crypto.getRandomValues(new Uint8Array(32));
+ const assertion = await navigator.credentials.get({
+ publicKey: {
+ challenge: authChallenge,
+ rpId: location.hostname,
+ allowCredentials: [{ id: credential.rawId, type: "public-key" }],
+ userVerification: "preferred",
+ timeout: 60000,
+ },
+ });
+
+ const authenticatorData = new Uint8Array(assertion.response.authenticatorData);
+ const clientDataJSON = new Uint8Array(assertion.response.clientDataJSON);
+ const signature = new Uint8Array(assertion.response.signature);
+ const clientDataHash = new Uint8Array(await crypto.subtle.digest("SHA-256", clientDataJSON));
+ const signedMessage = new Uint8Array(authenticatorData.length + clientDataHash.length);
+ signedMessage.set(authenticatorData);
+ signedMessage.set(clientDataHash, authenticatorData.length);
+
+ const verified = await crypto.subtle.verify(
+ { name: "ECDSA", hash: "SHA-256" },
+ publicKey,
+ signature,
+ signedMessage
+ );
+
+ window.__probeResult = {
+ credentialId: toBase64Url(new Uint8Array(credential.rawId)),
+ rawPublicKeyHex: toHex(rawPublicKey),
+ verified,
+ };
+ document.getElementById("result").textContent = JSON.stringify(window.__probeResult, null, 2);
+ } catch (error) {
+ window.__probeResult = {
+ error: error instanceof Error ? error.message : String(error),
+ };
+ document.getElementById("result").textContent = JSON.stringify(window.__probeResult, null, 2);
+ }
+ };
+
+ return "ready";
+})()
+JS
+)"
+
+agent-browser --session "$SESSION_NAME" eval "$PROBE_JS" >/dev/null
+agent-browser --session "$SESSION_NAME" click "#probe" >/dev/null
+
+for _ in $(seq 1 60); do
+ RESULT="$(agent-browser --session "$SESSION_NAME" eval "JSON.stringify(window.__probeResult)" | tr -d '\r')"
+ if [[ "$RESULT" != "null" ]]; then
+ printf '%s\n' "$RESULT"
+ if printf '%s\n' "$RESULT" | grep -q '"verified":true'; then
+ exit 0
+ fi
+ echo "Probe completed but verification did not pass" >&2
+ exit 1
+ fi
+ sleep 1
+done
+
+echo "Probe timed out" >&2
+exit 1
diff --git a/scripts/sync-version.js b/scripts/sync-version.js
new file mode 100644
index 0000000..0b3f6d9
--- /dev/null
+++ b/scripts/sync-version.js
@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+/**
+ * Syncs the version + name from package.json into src/version.ts.
+ *
+ * Runs automatically before `build` (prebuild), so the compiled package always
+ * reports the version it was published as.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const rootDir = join(__dirname, "..");
+
+const pkg = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf-8"));
+
+const contents = `/**
+ * Package version — auto-generated from package.json.
+ * @packageDocumentation
+ */
+
+// This file is auto-generated. Do not edit manually.
+// Run \`pnpm run sync-version\` (or \`pnpm build\`) to update.
+
+export const VERSION = "${pkg.version}";
+export const NAME = "${pkg.name}";
+`;
+
+writeFileSync(join(rootDir, "src/version.ts"), contents);
+
+console.log(`✓ Synced version to ${pkg.version}`);
diff --git a/scripts/verify-esm.mjs b/scripts/verify-esm.mjs
new file mode 100644
index 0000000..3058bb1
--- /dev/null
+++ b/scripts/verify-esm.mjs
@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+/**
+ * Node native-ESM import smoke test.
+ *
+ * Regression gate for a real class of packaging bug: `tsc` under
+ * `moduleResolution: "bundler"` emits extensionless relative imports
+ * (`from "./kit"`) that Node's native ESM loader rejects
+ * (`ERR_MODULE_NOT_FOUND` / `ERR_UNSUPPORTED_DIR_IMPORT`). Such a package imports
+ * fine under a bundler (Vite/webpack) but crashes for any plain Node consumer —
+ * a gap a Vite-only demo e2e never exercises.
+ *
+ * This imports the built package the way a Node consumer would — by name, via
+ * package self-reference through `exports` — and asserts key exports resolve. It
+ * runs as part of `pnpm build`, so a regression fails the build (and release).
+ */
+const failures = [];
+
+async function check(specifier, expectedExports) {
+ try {
+ const mod = await import(specifier);
+ for (const name of expectedExports) {
+ if (!(name in mod)) {
+ failures.push(`${specifier}: missing export "${name}"`);
+ }
+ }
+ console.log(` ok ${specifier} (${expectedExports.join(", ")})`);
+ } catch (err) {
+ const detail = `${err.code ?? ""} ${String(err.message).split("\n")[0]}`;
+ failures.push(`${specifier}: ${detail}`);
+ console.log(` FAIL ${specifier}: ${detail}`);
+ }
+}
+
+console.log("Node ESM import smoke test:");
+await check("passkey-kit", [
+ "PasskeyKit",
+ "PasskeyKitError",
+ "PasskeyEventEmitter",
+ "deriveContractAddress",
+ "buildTokenTransferHostFunction",
+]);
+await check("passkey-kit/storage", [
+ "MemoryStorage",
+ "LocalStorageAdapter",
+ "IndexedDBStorage",
+]);
+await check("passkey-kit/server", ["PasskeyServer", "RelayerClient"]);
+
+if (failures.length) {
+ console.error("\nESM import smoke test FAILED:");
+ for (const f of failures) console.error(" - " + f);
+ console.error(
+ "\nThe built package cannot be imported by a Node ESM consumer. This usually\n" +
+ "means a relative import is missing its explicit .js extension (NodeNext)."
+ );
+ process.exit(1);
+}
+console.log("\nESM import smoke test passed.");
diff --git a/src/base.ts b/src/base.ts
deleted file mode 100644
index c1b0821..0000000
--- a/src/base.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { Server } from "@stellar/stellar-sdk/minimal/rpc"
-
-// TODO consider adding support for a signAuthEntry method that conforms to the ed25519 signature scheme of this passkey interface
-// once we do that we can clean the code a little with the `xdr.HashIdPreimage.envelopeTypeSorobanAuthorization` stuff
-// ... note I've re-read the above and I've currently got no clue what this is asking for. Maybe check git-blame for when it was added to try and find some context
-// actually this is just talking about adding support for signing transactions with an ed25519 key as well as a passkey. Simple enough
-
-export class PasskeyBase {
- public rpcUrl: string | undefined
- public rpc: Server | undefined
-
- constructor(rpcUrl?: string) {
- if (rpcUrl) {
- this.rpcUrl = rpcUrl
- this.rpc = new Server(rpcUrl)
- }
- }
-}
\ No newline at end of file
diff --git a/src/base64url.ts b/src/base64url.ts
new file mode 100644
index 0000000..c1c108a
--- /dev/null
+++ b/src/base64url.ts
@@ -0,0 +1,19 @@
+/**
+ * `base64url` interop shim.
+ *
+ * The `base64url` package ships ESM-style type declarations
+ * (`export default base64url`) over a CommonJS runtime. Under NodeNext module
+ * resolution the default import is typed as the module namespace object rather
+ * than the callable `Base64Url`, so both calling it (`base64url(...)`) and
+ * member access (`base64url.toBuffer(...)`) fail to type-check. At runtime
+ * `esModuleInterop` already yields the callable, so this is a type-only
+ * correction, centralized here rather than repeated at every call site.
+ *
+ * Every module in the kit imports base64url from here, never directly from the
+ * package, so the interop fix lives in exactly one place.
+ */
+import base64urlDefault, { type Base64Url } from "base64url";
+
+const base64url = base64urlDefault as unknown as Base64Url;
+
+export default base64url;
diff --git a/src/constants.ts b/src/constants.ts
new file mode 100644
index 0000000..8dcbf2e
--- /dev/null
+++ b/src/constants.ts
@@ -0,0 +1,128 @@
+/**
+ * Constants used throughout the Passkey Kit SDK.
+ *
+ * Cryptographic sizes mirror the smart-wallet contract; the deployer seed is
+ * load-bearing for deterministic contract-id derivation (see below).
+ *
+ * @packageDocumentation
+ */
+
+// ============================================================================
+// Cryptographic constants (mirror the smart-wallet contract)
+// ============================================================================
+
+/** Size of an uncompressed secp256r1 (P-256) public key, in bytes. */
+export const SECP256R1_PUBLIC_KEY_SIZE = 65;
+
+/** First byte of an uncompressed secp256r1 public key (0x04). */
+export const UNCOMPRESSED_PUBKEY_PREFIX = 0x04;
+
+/** Size of an Ed25519 public key, in bytes. */
+export const ED25519_PUBLIC_KEY_SIZE = 32;
+
+/** Size of an Ed25519 signature, in bytes. */
+export const ED25519_SIGNATURE_SIZE = 64;
+
+/**
+ * Order (n) of the secp256r1 (P-256) curve, used to enforce low-S signatures.
+ * @see https://github.com/stellar/stellar-protocol/discussions/1435
+ */
+export const SECP256R1_CURVE_ORDER = BigInt(
+ "0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"
+);
+
+// ============================================================================
+// WebAuthn configuration
+// ============================================================================
+
+/** Default timeout for WebAuthn ceremonies, in milliseconds. */
+export const WEBAUTHN_TIMEOUT_MS = 60_000;
+
+/** Length, in bytes, of a randomly generated WebAuthn challenge. */
+export const WEBAUTHN_CHALLENGE_SIZE = 32;
+
+// ============================================================================
+// Deployer
+// ============================================================================
+
+/**
+ * Seed for the default (deterministic) deployer keypair.
+ *
+ * The deployer keypair is derived as
+ * `Keypair.fromRawEd25519Seed(sha256(utf8(DEFAULT_DEPLOYER_SEED)))`. Deriving it
+ * from a fixed, well-known string makes smart-wallet contract IDs reproducible
+ * across clients from a passkey credential ID alone (`salt = sha256(keyId)`,
+ * `deployer = this keypair`), which is exactly what the indexer reverse-lookup
+ * (keyId → contract) depends on.
+ *
+ * This value MUST remain `"kalepail"`: every wallet ever deployed by passkey-kit
+ * used this deployer, and the derivation is load-bearing for discovery. The
+ * deployer only pays fees and salts the deploy — it never controls the wallet —
+ * but it IS a shared, publicly-derivable keypair. Provide your own
+ * `deploySource` secret for a dedicated fee payer (note: a different deployer
+ * changes the derived contract addresses and breaks keyId → contract discovery).
+ */
+export const DEFAULT_DEPLOYER_SEED = "kalepail";
+
+// ============================================================================
+// Transaction timeouts
+// ============================================================================
+
+/**
+ * Default transaction timeout, in seconds.
+ *
+ * The OpenZeppelin Relayer requires a time-bound of <= 30s on submitted
+ * transactions, so the kit defaults to that.
+ */
+export const DEFAULT_TIMEOUT_SECONDS = 30;
+
+// ============================================================================
+// Storage configuration
+// ============================================================================
+
+/** Default IndexedDB database name for passkey credential storage. */
+export const DB_NAME = "passkey-kit";
+
+/** Current IndexedDB schema version. */
+export const DB_VERSION = 1;
+
+/** IndexedDB object-store name for passkey credentials. */
+export const IDB_STORE_CREDENTIALS = "credentials";
+
+/** IndexedDB index name for contract-id lookups. */
+export const IDB_INDEX_CONTRACT_ID = "contractId";
+
+/** localStorage key under which passkey credentials are persisted. */
+export const LOCALSTORAGE_CREDENTIALS_KEY = "passkey-kit:credentials";
+
+// ============================================================================
+// Relayer
+// ============================================================================
+
+/**
+ * Default relayer request timeout, in milliseconds (6 minutes).
+ *
+ * Long enough to absorb testnet channel-account funding retries after a network
+ * reset. Mainnet requests return quickly; this only bounds the maximum wait.
+ */
+export const DEFAULT_RELAYER_TIMEOUT_MS = 360_000;
+
+/** OpenZeppelin managed Channels relayer endpoint (mainnet). */
+export const CHANNELS_MAINNET_URL = "https://channels.openzeppelin.com";
+
+/** OpenZeppelin managed Channels relayer endpoint (testnet). */
+export const CHANNELS_TESTNET_URL = "https://channels.openzeppelin.com/testnet";
+
+// ============================================================================
+// Indexer
+// ============================================================================
+
+/** Default indexer request timeout, in milliseconds. */
+export const DEFAULT_INDEXER_TIMEOUT_MS = 10_000;
+
+// ============================================================================
+// Networks
+// ============================================================================
+
+/** Stellar Friendbot URL for testnet funding. */
+export const FRIENDBOT_URL = "https://friendbot.stellar.org";
diff --git a/src/contract-errors.test.ts b/src/contract-errors.test.ts
new file mode 100644
index 0000000..f3edcbe
--- /dev/null
+++ b/src/contract-errors.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it } from "vitest";
+import { Errors as BindingsErrors } from "passkey-kit-sdk";
+import {
+ CONTRACT_ERROR_REGISTRY,
+ contractErrorFromCode,
+ decodeContractError,
+ failedTransaction,
+ simulationFailure,
+ submissionFailure,
+} from "./contract-errors.js";
+import {
+ ContractError,
+ SimulationError,
+ SubmissionError,
+ ValidationError,
+ PasskeyKitErrorCode,
+} from "./errors.js";
+
+describe("decodeContractError", () => {
+ it("decodes a v1 contract error from a diagnostic string", () => {
+ const error = decodeContractError(
+ "HostError: Error(Contract, #102) ... SignerExpired"
+ );
+ expect(error).toBeInstanceOf(ContractError);
+ expect(error?.contractCode).toBe(102);
+ expect(error?.contractErrorName).toBe("SignerExpired");
+ expect(error?.family).toBe("SmartWallet");
+ expect(error?.code).toBe(PasskeyKitErrorCode.CONTRACT_ERROR);
+ });
+
+ it.each([
+ [100, "SignerNotFound"],
+ [101, "SignerAlreadyExists"],
+ [110, "MissingContext"],
+ [122, "ClientDataJsonChallengeIncorrect"],
+ [123, "InvalidWebAuthnType"],
+ [125, "UserPresenceRequired"],
+ ])("decodes v1 #%i as %s", (code, name) => {
+ const error = decodeContractError(`Error(Contract, #${code})`);
+ expect(error?.contractCode).toBe(code);
+ expect(error?.contractErrorName).toBe(name);
+ expect(error?.family).toBe("SmartWallet");
+ });
+
+ it("still decodes legacy (< 100) codes as SmartWalletLegacy", () => {
+ const error = decodeContractError("Error(Contract, #4)");
+ expect(error?.contractErrorName).toBe("SignerExpired");
+ expect(error?.family).toBe("SmartWalletLegacy");
+ });
+
+ it("handles whitespace variations in the marker", () => {
+ expect(decodeContractError("Error(Contract,#101)")?.contractErrorName).toBe(
+ "SignerAlreadyExists"
+ );
+ expect(
+ decodeContractError("Error(Contract, #101)")?.contractErrorName
+ ).toBe("SignerAlreadyExists");
+ });
+
+ it("decodes from an Error object's message", () => {
+ const error = decodeContractError(new Error("Error(Contract, #111)"));
+ expect(error?.contractErrorName).toBe("SignatureKeyValueMismatch");
+ });
+
+ it("returns null when there is no contract marker", () => {
+ expect(decodeContractError("some unrelated error")).toBeNull();
+ expect(decodeContractError("")).toBeNull();
+ expect(decodeContractError(null)).toBeNull();
+ expect(decodeContractError(undefined)).toBeNull();
+ });
+
+ it("returns null for an unknown contract code", () => {
+ expect(decodeContractError("Error(Contract, #9999)")).toBeNull();
+ });
+});
+
+describe("contractErrorFromCode", () => {
+ it("builds a ContractError for a known code", () => {
+ const error = contractErrorFromCode(120);
+ expect(error).toBeInstanceOf(ContractError);
+ expect(error?.contractErrorName).toBe("ClientDataJsonTooLarge");
+ });
+
+ it("returns null for an unknown code", () => {
+ expect(contractErrorFromCode(1234)).toBeNull();
+ });
+});
+
+describe("CONTRACT_ERROR_REGISTRY", () => {
+ it("stays in sync with the generated bindings' Errors map", () => {
+ // The bindings' Errors map is the source of truth; a regen must not drift
+ // from this registry (this is the guard the B4 resync relies on).
+ const bindingsEntries = Object.entries(
+ BindingsErrors as Record
+ );
+ expect(bindingsEntries.length).toBeGreaterThan(0);
+
+ for (const [codeStr, { message: name }] of bindingsEntries) {
+ const code = Number(codeStr);
+ const info = CONTRACT_ERROR_REGISTRY[code];
+ expect(info, `registry missing SmartWallet code ${code}`).toBeDefined();
+ expect(info.name).toBe(name);
+ expect(info.family).toBe("SmartWallet");
+ }
+ });
+
+ it("keeps every entry's key aligned with its code field", () => {
+ for (const [key, info] of Object.entries(CONTRACT_ERROR_REGISTRY)) {
+ expect(info.code).toBe(Number(key));
+ }
+ });
+});
+
+describe("transaction failure helpers", () => {
+ it("failedTransaction exposes error.code and omits an empty hash", () => {
+ const failure = failedTransaction(new ValidationError("bad input"));
+ expect(failure.success).toBe(false);
+ expect(failure.error).toBeInstanceOf(ValidationError);
+ expect(failure.error.code).toBe(PasskeyKitErrorCode.INVALID_INPUT);
+ expect(failure.hash).toBeUndefined();
+ });
+
+ it("failedTransaction preserves a provided hash", () => {
+ const failure = failedTransaction(new SubmissionError("boom"), "abc123");
+ expect(failure.hash).toBe("abc123");
+ });
+
+ it("simulationFailure decodes a contract error when present", () => {
+ const failure = simulationFailure("Error(Contract, #102)");
+ expect(failure.error).toBeInstanceOf(ContractError);
+ expect(failure.error.code).toBe(PasskeyKitErrorCode.CONTRACT_ERROR);
+ });
+
+ it("simulationFailure falls back to SimulationError", () => {
+ const failure = simulationFailure("host is unreachable");
+ expect(failure.error).toBeInstanceOf(SimulationError);
+ expect(failure.error.message).toContain("host is unreachable");
+ });
+
+ it("submissionFailure falls back to SubmissionError and keeps the hash", () => {
+ const failure = submissionFailure("rejected", "tx-hash");
+ expect(failure.error).toBeInstanceOf(SubmissionError);
+ expect(failure.hash).toBe("tx-hash");
+ });
+});
diff --git a/src/contract-errors.ts b/src/contract-errors.ts
new file mode 100644
index 0000000..1ceb6de
--- /dev/null
+++ b/src/contract-errors.ts
@@ -0,0 +1,181 @@
+/**
+ * Contract error decoding.
+ *
+ * Maps on-chain smart-wallet failure codes (surfaced in simulation/submission
+ * diagnostics as `Error(Contract, #N)`) to typed {@link ContractError}s with the
+ * enum variant name and a human-readable message.
+ *
+ * The `SmartWallet` family is the source of truth in the generated bindings'
+ * `Errors` map; `contract-errors.test.ts` asserts this registry stays in sync
+ * with it, so a bindings regen surfaces any drift.
+ *
+ * The v1 contract deliberately renumbered its error space to 100-129 so it is
+ * disjoint from the legacy (pre-1.0) 1-9 range: a decoded code < 100 means the
+ * client is talking to a legacy wallet. Both ranges are kept here so errors
+ * from legacy deployed wallets still decode (family `SmartWalletLegacy`).
+ *
+ * @packageDocumentation
+ */
+
+import {
+ ContractError,
+ SimulationError,
+ SubmissionError,
+ PasskeyKitError,
+} from "./errors.js";
+import type { TransactionFailure } from "./types.js";
+
+/**
+ * Contract families that expose custom error codes.
+ */
+export type ContractErrorFamily = "SmartWallet" | "SmartWalletLegacy";
+
+/**
+ * A single contract error entry: code, enum variant name, family, and a
+ * human-readable message.
+ */
+export interface ContractErrorInfo {
+ code: number;
+ name: string;
+ family: ContractErrorFamily;
+ message: string;
+}
+
+function entry(
+ code: number,
+ name: string,
+ family: ContractErrorFamily,
+ message: string
+): [number, ContractErrorInfo] {
+ return [code, { code, name, family, message }];
+}
+
+/**
+ * Registry of every known contract error code, keyed by numeric code.
+ */
+export const CONTRACT_ERROR_REGISTRY: Readonly<
+ Record
+> = Object.freeze(
+ Object.fromEntries([
+ // --- v1 SmartWallet (100-129) — source of truth in the bindings Errors map ---
+ // 100-109: signer storage / management
+ entry(100, "SignerNotFound", "SmartWallet", "The requested signer does not exist on this smart wallet."),
+ entry(101, "SignerAlreadyExists", "SmartWallet", "add_signer was called with a signer key that already exists."),
+ entry(102, "SignerExpired", "SmartWallet", "The signer's expiration timestamp is in the past."),
+ // 110-119: auth (__check_auth)
+ entry(110, "MissingContext", "SmartWallet", "No signer in the signatures map is permitted to authorize one of the requested auth contexts."),
+ entry(111, "SignatureKeyValueMismatch", "SmartWallet", "A signature's variant does not match the stored signer it claims to be for."),
+ // 120-129: WebAuthn (secp256r1) verification
+ entry(120, "ClientDataJsonTooLarge", "SmartWallet", "clientDataJSON exceeds the 1024-byte parse buffer."),
+ entry(121, "ClientDataJsonParseError", "SmartWallet", "clientDataJSON is not parseable JSON (or is missing required fields)."),
+ entry(122, "ClientDataJsonChallengeIncorrect", "SmartWallet", "The clientDataJSON challenge does not match the signature payload; this binding MUST NOT be weakened."),
+ entry(123, "InvalidWebAuthnType", "SmartWallet", 'clientDataJSON `type` is not "webauthn.get".'),
+ entry(124, "InvalidAuthenticatorData", "SmartWallet", "authenticatorData is shorter than the WebAuthn minimum of 37 bytes."),
+ entry(125, "UserPresenceRequired", "SmartWallet", "The authenticator did not set the User Present (UP) flag."),
+
+ // --- Legacy (pre-1.0) 1-9 — kept so errors from legacy deployed wallets decode ---
+ entry(1, "NotFound", "SmartWalletLegacy", "[legacy] The specified signer was not found."),
+ entry(2, "AlreadyExists", "SmartWalletLegacy", "[legacy] The signer already exists on this wallet."),
+ entry(3, "MissingContext", "SmartWalletLegacy", "[legacy] The signature did not cover a required authorization context."),
+ entry(4, "SignerExpired", "SmartWalletLegacy", "[legacy] The signer has expired."),
+ entry(5, "FailedSignerLimits", "SmartWalletLegacy", "[legacy] The signer is not permitted to authorize this context by its limits."),
+ entry(6, "FailedPolicySignerLimits", "SmartWalletLegacy", "[legacy] A policy signer's limits rejected this context."),
+ entry(7, "SignatureKeyValueMismatch", "SmartWalletLegacy", "[legacy] A signature entry's key and value did not match."),
+ entry(8, "ClientDataJsonChallengeIncorrect", "SmartWalletLegacy", "[legacy] The WebAuthn clientDataJSON challenge did not match the signature payload."),
+ entry(9, "JsonParseError", "SmartWalletLegacy", "[legacy] The WebAuthn clientDataJSON could not be parsed."),
+ ])
+);
+
+/**
+ * Matches the host's rendering of a contract error, e.g. `Error(Contract, #4)`.
+ */
+const CONTRACT_ERROR_PATTERN = /Error\(Contract,\s*#(\d+)\)/;
+
+function diagnosticToString(diagnostic: unknown): string {
+ if (diagnostic == null) return "";
+ if (typeof diagnostic === "string") return diagnostic;
+ if (diagnostic instanceof Error) return diagnostic.message;
+ try {
+ return JSON.stringify(diagnostic);
+ } catch {
+ return String(diagnostic);
+ }
+}
+
+/**
+ * Build a {@link ContractError} for a known contract code, or `null` if the code
+ * is not in the registry.
+ */
+export function contractErrorFromCode(
+ code: number,
+ context?: Record
+): ContractError | null {
+ const info = CONTRACT_ERROR_REGISTRY[code];
+ if (!info) return null;
+ return new ContractError(info.code, info.name, info.family, info.message, {
+ context,
+ });
+}
+
+/**
+ * Decode a simulation/submission diagnostic into a typed {@link ContractError}.
+ *
+ * Scans the (stringified) diagnostic for an `Error(Contract, #N)` marker and
+ * looks the code up in {@link CONTRACT_ERROR_REGISTRY}. Returns `null` when no
+ * contract code is present or the code is unknown, letting callers fall back to
+ * a generic {@link SimulationError}/{@link SubmissionError}.
+ */
+export function decodeContractError(diagnostic: unknown): ContractError | null {
+ const text = diagnosticToString(diagnostic);
+ const match = text.match(CONTRACT_ERROR_PATTERN);
+ if (!match) return null;
+ const code = Number.parseInt(match[1]!, 10);
+ return contractErrorFromCode(code, { diagnostic: text });
+}
+
+/**
+ * Build a {@link TransactionFailure} from an already-typed error.
+ */
+export function failedTransaction(
+ error: PasskeyKitError,
+ hash?: string
+): TransactionFailure {
+ return {
+ success: false,
+ error,
+ ...(hash ? { hash } : {}),
+ };
+}
+
+/**
+ * Build a {@link TransactionFailure} from a simulation diagnostic, decoding a
+ * contract error when present and otherwise wrapping it in a
+ * {@link SimulationError}.
+ */
+export function simulationFailure(
+ diagnostic: unknown,
+ hash?: string
+): TransactionFailure {
+ const error =
+ decodeContractError(diagnostic) ??
+ new SimulationError(diagnosticToString(diagnostic) || "Simulation failed");
+ return failedTransaction(error, hash);
+}
+
+/**
+ * Build a {@link TransactionFailure} from a submission diagnostic, decoding a
+ * contract error when present and otherwise wrapping it in a
+ * {@link SubmissionError}.
+ */
+export function submissionFailure(
+ diagnostic: unknown,
+ hash?: string
+): TransactionFailure {
+ const error =
+ decodeContractError(diagnostic) ??
+ new SubmissionError(
+ diagnosticToString(diagnostic) || "Submission failed",
+ hash
+ );
+ return failedTransaction(error, hash);
+}
diff --git a/src/errors.test.ts b/src/errors.test.ts
new file mode 100644
index 0000000..9d5e340
--- /dev/null
+++ b/src/errors.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+import {
+ PasskeyKitError,
+ PasskeyKitErrorCode,
+ ContractError,
+ WalletNotConnectedError,
+ WebAuthnError,
+ ValidationError,
+ wrapError,
+} from "./errors.js";
+
+describe("PasskeyKitError", () => {
+ it("carries code, context, and cause", () => {
+ const cause = new Error("root cause");
+ const err = new PasskeyKitError("boom", PasskeyKitErrorCode.INVALID_CONFIG, {
+ context: { foo: "bar" },
+ cause,
+ });
+ expect(err.code).toBe(PasskeyKitErrorCode.INVALID_CONFIG);
+ expect(err.context).toEqual({ foo: "bar" });
+ expect(err.cause).toBe(cause);
+ expect(err).toBeInstanceOf(Error);
+ });
+
+ it("formats a detailed string with code, context, and cause", () => {
+ const err = new PasskeyKitError("boom", PasskeyKitErrorCode.INVALID_CONFIG, {
+ context: { foo: "bar" },
+ cause: new Error("underlying"),
+ });
+ const detailed = err.toDetailedString();
+ expect(detailed).toContain(`[${PasskeyKitErrorCode.INVALID_CONFIG}]`);
+ expect(detailed).toContain("boom");
+ expect(detailed).toContain("foo");
+ expect(detailed).toContain("Caused by: underlying");
+ });
+});
+
+describe("error subclasses", () => {
+ it("WalletNotConnectedError references the operation", () => {
+ const err = new WalletNotConnectedError("add a signer");
+ expect(err.code).toBe(PasskeyKitErrorCode.WALLET_NOT_CONNECTED);
+ expect(err.message).toContain("add a signer");
+ expect(err.name).toBe("WalletNotConnectedError");
+ });
+
+ it("WebAuthnError carries its cause", () => {
+ const cause = new Error("user cancelled");
+ const err = new WebAuthnError(
+ "registration failed",
+ PasskeyKitErrorCode.WEBAUTHN_REGISTRATION_FAILED,
+ cause
+ );
+ expect(err.cause).toBe(cause);
+ expect(err.code).toBe(PasskeyKitErrorCode.WEBAUTHN_REGISTRATION_FAILED);
+ });
+
+ it("ContractError exposes the raw contract code, name, and family", () => {
+ const err = new ContractError(4, "SignerExpired", "SmartWallet", "expired");
+ expect(err.code).toBe(PasskeyKitErrorCode.CONTRACT_ERROR);
+ expect(err.contractCode).toBe(4);
+ expect(err.contractErrorName).toBe("SignerExpired");
+ expect(err.family).toBe("SmartWallet");
+ expect(err.context).toMatchObject({
+ contractCode: 4,
+ contractErrorName: "SignerExpired",
+ });
+ });
+});
+
+describe("wrapError", () => {
+ it("passes through an existing PasskeyKitError", () => {
+ const original = new ValidationError("bad");
+ expect(wrapError(original)).toBe(original);
+ });
+
+ it("wraps a plain Error, preserving message and cause", () => {
+ const plain = new Error("kaboom");
+ const wrapped = wrapError(plain, PasskeyKitErrorCode.SIMULATION_FAILED);
+ expect(wrapped).toBeInstanceOf(PasskeyKitError);
+ expect(wrapped.message).toBe("kaboom");
+ expect(wrapped.code).toBe(PasskeyKitErrorCode.SIMULATION_FAILED);
+ expect(wrapped.cause).toBe(plain);
+ });
+
+ it("wraps a non-Error value with its string form", () => {
+ const wrapped = wrapError("just a string");
+ expect(wrapped.message).toBe("just a string");
+ expect(wrapped.code).toBe(PasskeyKitErrorCode.INVALID_INPUT);
+ expect(wrapped.cause).toBeUndefined();
+ });
+});
diff --git a/src/errors.ts b/src/errors.ts
new file mode 100644
index 0000000..de5c018
--- /dev/null
+++ b/src/errors.ts
@@ -0,0 +1,349 @@
+/**
+ * Typed error model for the Passkey Kit SDK.
+ *
+ * Every error the kit throws is a {@link PasskeyKitError} (or subclass) carrying
+ * a numeric {@link PasskeyKitErrorCode}, optional structured `context`, and an
+ * optional `cause`. Callers branch on `error.code` (or `instanceof`) instead of
+ * matching on message strings.
+ *
+ * Submission methods are the one exception to "throw on failure": they return a
+ * discriminated {@link import("./types.js").TransactionResult} whose failure arm
+ * carries one of these typed errors (see `contract-errors.ts`).
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Error codes for Passkey Kit operations, grouped by concern.
+ *
+ * Ranges (per SDK architecture spec #599 §5, extended with validation/storage):
+ * - 1xxx configuration
+ * - 2xxx wallet state
+ * - 3xxx WebAuthn
+ * - 4xxx signing
+ * - 5xxx transaction (simulation/submission)
+ * - 6xxx indexer
+ * - 7xxx relayer
+ * - 8xxx validation
+ * - 9xxx storage
+ * - 10000 contract-level failure decoded from on-chain diagnostics (the raw
+ * contract code 1-9 is carried separately on {@link ContractError}).
+ */
+export enum PasskeyKitErrorCode {
+ // Configuration (1xxx)
+ INVALID_CONFIG = 1001,
+ MISSING_CONFIG = 1002,
+
+ // Wallet state (2xxx)
+ WALLET_NOT_CONNECTED = 2001,
+ WALLET_ALREADY_EXISTS = 2002,
+ WALLET_NOT_FOUND = 2003,
+ WALLET_OWNERSHIP_MISMATCH = 2004,
+
+ // WebAuthn (3xxx)
+ WEBAUTHN_REGISTRATION_FAILED = 3001,
+ WEBAUTHN_AUTHENTICATION_FAILED = 3002,
+ WEBAUTHN_NOT_SUPPORTED = 3003,
+ WEBAUTHN_CANCELLED = 3004,
+ PUBLIC_KEY_EXTRACTION_FAILED = 3005,
+
+ // Signing (4xxx)
+ SIGNING_FAILED = 4001,
+ SIGNER_NOT_FOUND = 4002,
+ INVALID_SIGNER = 4003,
+ INVALID_SIGNATURE_EXPIRATION = 4004,
+ UNSUPPORTED_CREDENTIALS = 4005,
+
+ // Transaction (5xxx)
+ SIMULATION_FAILED = 5001,
+ SUBMISSION_FAILED = 5002,
+ TRANSACTION_TIMEOUT = 5003,
+ RESTORE_REQUIRED = 5004,
+
+ // Indexer (6xxx)
+ INDEXER_NOT_CONFIGURED = 6001,
+ INDEXER_REQUEST_FAILED = 6002,
+
+ // Relayer (7xxx)
+ RELAYER_NOT_CONFIGURED = 7001,
+ RELAYER_REQUEST_FAILED = 7002,
+ /** Submitted but not yet in a terminal state — keep polling getTransaction. */
+ RELAYER_PENDING = 7003,
+
+ // Validation (8xxx)
+ INVALID_ADDRESS = 8001,
+ INVALID_AMOUNT = 8002,
+ INVALID_INPUT = 8003,
+ INVALID_PUBLIC_KEY = 8004,
+
+ // Storage (9xxx)
+ STORAGE_READ_FAILED = 9001,
+ STORAGE_WRITE_FAILED = 9002,
+
+ // Contract-level failure decoded from on-chain diagnostics (10xxx).
+ // The raw contract code (1-9) is carried separately on ContractError so the
+ // SDK code space never collides with the contract's own small code range.
+ CONTRACT_ERROR = 10000,
+}
+
+/**
+ * Base error class for all Passkey Kit errors.
+ */
+export class PasskeyKitError extends Error {
+ /** Error code for programmatic handling. */
+ readonly code: PasskeyKitErrorCode;
+
+ /** Structured context about the error. */
+ readonly context?: Record;
+
+ /** The underlying error that caused this one, if any. */
+ readonly cause?: Error;
+
+ constructor(
+ message: string,
+ code: PasskeyKitErrorCode,
+ options?: {
+ context?: Record;
+ cause?: Error;
+ }
+ ) {
+ super(message);
+ this.name = "PasskeyKitError";
+ this.code = code;
+ this.context = options?.context;
+ this.cause = options?.cause;
+
+ // Maintain a proper stack trace in V8 environments.
+ if (Error.captureStackTrace) {
+ Error.captureStackTrace(this, PasskeyKitError);
+ }
+ }
+
+ /** Format the error with its code, context, and cause for logging. */
+ toDetailedString(): string {
+ let msg = `[${this.code}] ${this.message}`;
+ if (this.context) {
+ msg += `\nContext: ${JSON.stringify(this.context, null, 2)}`;
+ }
+ if (this.cause) {
+ msg += `\nCaused by: ${this.cause.message}`;
+ }
+ return msg;
+ }
+}
+
+/** Thrown when the client is misconfigured. */
+export class ConfigurationError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.INVALID_CONFIG
+ | PasskeyKitErrorCode.MISSING_CONFIG = PasskeyKitErrorCode.INVALID_CONFIG,
+ context?: Record
+ ) {
+ super(message, code, { context });
+ this.name = "ConfigurationError";
+ }
+}
+
+/** Thrown when an operation requires a connected wallet but none is connected. */
+export class WalletNotConnectedError extends PasskeyKitError {
+ constructor(operation?: string) {
+ super(
+ operation
+ ? `A connected wallet is required to ${operation}`
+ : "Wallet not connected",
+ PasskeyKitErrorCode.WALLET_NOT_CONNECTED,
+ { context: operation ? { operation } : undefined }
+ );
+ this.name = "WalletNotConnectedError";
+ }
+}
+
+/**
+ * Thrown when a connected wallet does not actually own the credential used to
+ * connect (connectWallet ownership verification, #601 F7).
+ */
+export class WalletOwnershipError extends PasskeyKitError {
+ constructor(message: string, context?: Record) {
+ super(message, PasskeyKitErrorCode.WALLET_OWNERSHIP_MISMATCH, { context });
+ this.name = "WalletOwnershipError";
+ }
+}
+
+/** Thrown when a WebAuthn ceremony fails. */
+export class WebAuthnError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.WEBAUTHN_REGISTRATION_FAILED
+ | PasskeyKitErrorCode.WEBAUTHN_AUTHENTICATION_FAILED
+ | PasskeyKitErrorCode.WEBAUTHN_NOT_SUPPORTED
+ | PasskeyKitErrorCode.WEBAUTHN_CANCELLED
+ | PasskeyKitErrorCode.PUBLIC_KEY_EXTRACTION_FAILED,
+ cause?: Error
+ ) {
+ super(message, code, { cause });
+ this.name = "WebAuthnError";
+ }
+}
+
+/** Thrown when signing an authorization entry fails. */
+export class SigningError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.SIGNING_FAILED
+ | PasskeyKitErrorCode.INVALID_SIGNER
+ | PasskeyKitErrorCode.INVALID_SIGNATURE_EXPIRATION
+ | PasskeyKitErrorCode.UNSUPPORTED_CREDENTIALS = PasskeyKitErrorCode.SIGNING_FAILED,
+ context?: Record
+ ) {
+ super(message, code, { context });
+ this.name = "SigningError";
+ }
+}
+
+/** Thrown when a requested signer cannot be found. */
+export class SignerNotFoundError extends PasskeyKitError {
+ constructor(identifier: string, hint?: string) {
+ super(
+ hint
+ ? `No signer found for: ${identifier}. ${hint}`
+ : `No signer found for: ${identifier}`,
+ PasskeyKitErrorCode.SIGNER_NOT_FOUND,
+ { context: { identifier } }
+ );
+ this.name = "SignerNotFoundError";
+ }
+}
+
+/** Thrown when transaction simulation fails. */
+export class SimulationError extends PasskeyKitError {
+ constructor(message: string, context?: Record) {
+ super(message, PasskeyKitErrorCode.SIMULATION_FAILED, { context });
+ this.name = "SimulationError";
+ }
+}
+
+/** Thrown when transaction submission fails. */
+export class SubmissionError extends PasskeyKitError {
+ constructor(message: string, hash?: string, context?: Record) {
+ super(message, PasskeyKitErrorCode.SUBMISSION_FAILED, {
+ context: { hash, ...context },
+ });
+ this.name = "SubmissionError";
+ }
+}
+
+/** Thrown when input validation fails. */
+export class ValidationError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.INVALID_ADDRESS
+ | PasskeyKitErrorCode.INVALID_AMOUNT
+ | PasskeyKitErrorCode.INVALID_INPUT
+ | PasskeyKitErrorCode.INVALID_PUBLIC_KEY = PasskeyKitErrorCode.INVALID_INPUT,
+ context?: Record
+ ) {
+ super(message, code, { context });
+ this.name = "ValidationError";
+ }
+}
+
+/** Thrown when an indexer request fails or the indexer is not configured. */
+export class IndexerError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.INDEXER_NOT_CONFIGURED
+ | PasskeyKitErrorCode.INDEXER_REQUEST_FAILED = PasskeyKitErrorCode.INDEXER_REQUEST_FAILED,
+ context?: Record,
+ cause?: Error
+ ) {
+ super(message, code, { context, cause });
+ this.name = "IndexerError";
+ }
+}
+
+/** Thrown when a relayer request fails or the relayer is not configured. */
+export class RelayerError extends PasskeyKitError {
+ constructor(
+ message: string,
+ code:
+ | PasskeyKitErrorCode.RELAYER_NOT_CONFIGURED
+ | PasskeyKitErrorCode.RELAYER_REQUEST_FAILED
+ | PasskeyKitErrorCode.RELAYER_PENDING = PasskeyKitErrorCode.RELAYER_REQUEST_FAILED,
+ context?: Record,
+ cause?: Error
+ ) {
+ super(message, code, { context, cause });
+ this.name = "RelayerError";
+ }
+}
+
+/**
+ * Error decoded from an on-chain smart-wallet failure code.
+ *
+ * Produced by `decodeContractError` when a simulation/submission diagnostic
+ * reports an `Error(Contract, #N)`. Carries the raw contract code and its enum
+ * variant name so callers can branch on the exact failure.
+ *
+ * @example
+ * ```typescript
+ * const result = await server.send(tx);
+ * if (!result.success && result.error instanceof ContractError) {
+ * if (result.error.contractErrorName === "SignerExpired") { ... }
+ * }
+ * ```
+ */
+export class ContractError extends PasskeyKitError {
+ /** Raw contract error code (e.g. 4). */
+ readonly contractCode: number;
+
+ /** Enum variant name from the contract (e.g. "SignerExpired"). */
+ readonly contractErrorName: string;
+
+ /** Contract family the code belongs to (e.g. "SmartWallet"). */
+ readonly family: string;
+
+ constructor(
+ contractCode: number,
+ contractErrorName: string,
+ family: string,
+ message: string,
+ options?: {
+ context?: Record;
+ cause?: Error;
+ }
+ ) {
+ super(message, PasskeyKitErrorCode.CONTRACT_ERROR, {
+ context: { contractCode, contractErrorName, family, ...options?.context },
+ cause: options?.cause,
+ });
+ this.name = "ContractError";
+ this.contractCode = contractCode;
+ this.contractErrorName = contractErrorName;
+ this.family = family;
+ }
+}
+
+/**
+ * Wrap an unknown thrown value in a {@link PasskeyKitError}.
+ *
+ * Passes through values that are already {@link PasskeyKitError}s.
+ */
+export function wrapError(
+ err: unknown,
+ defaultCode: PasskeyKitErrorCode = PasskeyKitErrorCode.INVALID_INPUT
+): PasskeyKitError {
+ if (err instanceof PasskeyKitError) {
+ return err;
+ }
+
+ const message = err instanceof Error ? err.message : String(err);
+ const cause = err instanceof Error ? err : undefined;
+
+ return new PasskeyKitError(message, defaultCode, { cause });
+}
diff --git a/src/events.test.ts b/src/events.test.ts
new file mode 100644
index 0000000..0e9a806
--- /dev/null
+++ b/src/events.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it, vi } from "vitest";
+import { PasskeyEventEmitter } from "./events.js";
+import { SignerStore } from "./types.js";
+
+describe("PasskeyEventEmitter", () => {
+ it("delivers events to subscribers and returns an unsubscribe function", () => {
+ const emitter = new PasskeyEventEmitter();
+ const listener = vi.fn();
+
+ const off = emitter.on("walletConnected", listener);
+ emitter.emit("walletConnected", { contractId: "C1", keyId: "k1" });
+ expect(listener).toHaveBeenCalledWith({ contractId: "C1", keyId: "k1" });
+
+ off();
+ emitter.emit("walletConnected", { contractId: "C2", keyId: "k2" });
+ expect(listener).toHaveBeenCalledTimes(1);
+ });
+
+ it("once() fires exactly once", () => {
+ const emitter = new PasskeyEventEmitter();
+ const listener = vi.fn();
+ emitter.once("walletDisconnected", listener);
+ emitter.emit("walletDisconnected", { contractId: "C1" });
+ emitter.emit("walletDisconnected", { contractId: "C1" });
+ expect(listener).toHaveBeenCalledTimes(1);
+ });
+
+ it("off() removes a specific listener", () => {
+ const emitter = new PasskeyEventEmitter();
+ const a = vi.fn();
+ const b = vi.fn();
+ emitter.on("signerAdded", a);
+ emitter.on("signerAdded", b);
+ emitter.off("signerAdded", a);
+ emitter.emit("signerAdded", {
+ contractId: "C1",
+ kind: "Ed25519",
+ storage: SignerStore.Persistent,
+ });
+ expect(a).not.toHaveBeenCalled();
+ expect(b).toHaveBeenCalledTimes(1);
+ });
+
+ it("isolates a throwing listener and routes its error to the handler", () => {
+ const emitter = new PasskeyEventEmitter();
+ const errorHandler = vi.fn();
+ emitter.setErrorHandler(errorHandler);
+
+ const good = vi.fn();
+ emitter.on("transactionSubmitted", () => {
+ throw new Error("bad listener");
+ });
+ emitter.on("transactionSubmitted", good);
+
+ emitter.emit("transactionSubmitted", { hash: "h1", success: true });
+ expect(good).toHaveBeenCalledTimes(1);
+ expect(errorHandler).toHaveBeenCalledTimes(1);
+ expect(errorHandler.mock.calls[0]![0]).toBe("transactionSubmitted");
+ });
+
+ it("tracks listener counts and clears all listeners", () => {
+ const emitter = new PasskeyEventEmitter();
+ emitter.on("walletCreated", vi.fn());
+ emitter.on("walletCreated", vi.fn());
+ expect(emitter.listenerCount("walletCreated")).toBe(2);
+ emitter.removeAllListeners("walletCreated");
+ expect(emitter.listenerCount("walletCreated")).toBe(0);
+ });
+});
diff --git a/src/events.ts b/src/events.ts
new file mode 100644
index 0000000..297d7ed
--- /dev/null
+++ b/src/events.ts
@@ -0,0 +1,169 @@
+/**
+ * Typed event emitter for passkey / wallet lifecycle events.
+ *
+ * `on()` returns an unsubscribe function; a listener that throws is isolated so
+ * it never prevents the other listeners from running.
+ *
+ * @packageDocumentation
+ */
+
+import type { SignerStore } from "./types.js";
+
+/**
+ * The events the kit can emit, mapped to their payload shapes.
+ */
+export type PasskeyEventMap = {
+ /** A new wallet was deployed. */
+ walletCreated: { contractId: string; keyId: string };
+
+ /** An existing wallet was connected. */
+ walletConnected: { contractId: string; keyId: string };
+
+ /** The connected wallet was disconnected. */
+ walletDisconnected: { contractId: string };
+
+ /** A signer was added to the connected wallet. */
+ signerAdded: {
+ contractId: string;
+ kind: "Policy" | "Ed25519" | "Secp256r1";
+ storage: SignerStore;
+ };
+
+ /** A signer was updated on the connected wallet. */
+ signerUpdated: {
+ contractId: string;
+ kind: "Policy" | "Ed25519" | "Secp256r1";
+ storage: SignerStore;
+ };
+
+ /** A signer was removed from the connected wallet. */
+ signerRemoved: {
+ contractId: string;
+ kind: "Policy" | "Ed25519" | "Secp256r1";
+ };
+
+ /** An authorization entry was signed. */
+ transactionSigned: { contractId: string; keyId?: string };
+
+ /** A transaction was submitted. */
+ transactionSubmitted: { hash: string; success: boolean };
+};
+
+/** The set of event names the kit emits. */
+export type PasskeyEvent = keyof PasskeyEventMap;
+
+/** An event listener. */
+export type EventListener = (data: T) => void;
+
+/**
+ * Default handler for errors thrown by listeners: log to the console so a
+ * misbehaving listener is visible rather than silently swallowed.
+ */
+function defaultListenerErrorHandler(
+ event: PasskeyEvent,
+ error: unknown
+): void {
+ console.error(`[PasskeyKit] Listener for "${event}" threw:`, error);
+}
+
+/**
+ * A small typed event emitter for passkey lifecycle events.
+ *
+ * @example
+ * ```typescript
+ * const events = new PasskeyEventEmitter();
+ * const off = events.on("walletConnected", ({ contractId }) => {
+ * console.log("connected", contractId);
+ * });
+ * events.emit("walletConnected", { contractId: "C…", keyId: "…" });
+ * off();
+ * ```
+ */
+export class PasskeyEventEmitter {
+ private listeners: Map<
+ PasskeyEvent,
+ Set>
+ > = new Map();
+
+ private errorHandler:
+ | ((event: PasskeyEvent, error: unknown) => void)
+ | undefined = defaultListenerErrorHandler;
+
+ /**
+ * Set the handler invoked when a listener throws. Pass `undefined` to silence
+ * listener errors entirely.
+ */
+ setErrorHandler(
+ handler: ((event: PasskeyEvent, error: unknown) => void) | undefined
+ ): void {
+ this.errorHandler = handler;
+ }
+
+ /** Subscribe to an event. Returns an unsubscribe function. */
+ on(
+ event: E,
+ listener: EventListener
+ ): () => void {
+ if (!this.listeners.has(event)) {
+ this.listeners.set(event, new Set());
+ }
+ const listeners = this.listeners.get(event)!;
+ listeners.add(
+ listener as EventListener
+ );
+ return () => {
+ listeners.delete(
+ listener as EventListener
+ );
+ };
+ }
+
+ /** Subscribe to an event, firing at most once. Returns an unsubscribe fn. */
+ once(
+ event: E,
+ listener: EventListener
+ ): () => void {
+ const unsubscribe = this.on(event, (data) => {
+ unsubscribe();
+ listener(data);
+ });
+ return unsubscribe;
+ }
+
+ /** Unsubscribe a specific listener from an event. */
+ off(
+ event: E,
+ listener: EventListener
+ ): void {
+ this.listeners
+ .get(event)
+ ?.delete(listener as EventListener);
+ }
+
+ /** Emit an event to all subscribers, isolating any that throw. */
+ emit(event: E, data: PasskeyEventMap[E]): void {
+ const listeners = this.listeners.get(event);
+ if (!listeners) return;
+ for (const listener of listeners) {
+ try {
+ listener(data);
+ } catch (err) {
+ this.errorHandler?.(event, err);
+ }
+ }
+ }
+
+ /** Remove all listeners for an event, or for every event when omitted. */
+ removeAllListeners(event?: PasskeyEvent): void {
+ if (event) {
+ this.listeners.delete(event);
+ } else {
+ this.listeners.clear();
+ }
+ }
+
+ /** Number of listeners registered for an event. */
+ listenerCount(event: PasskeyEvent): number {
+ return this.listeners.get(event)?.size ?? 0;
+ }
+}
diff --git a/src/index.ts b/src/index.ts
index 80383f6..189a507 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,117 @@
-export { SignerStore, SignerKey, type Signer, type SignerLimits } from './types'
-export { PasskeyKit } from "./kit"
-export { PasskeyServer } from "./server"
-export { SACClient } from "./sac"
-export { Client as PasskeyClient } from 'passkey-kit-sdk'
\ No newline at end of file
+/**
+ * Passkey Kit — create and use smart-wallet accounts on Stellar with WebAuthn
+ * passkeys.
+ *
+ * Storage adapters live under the `passkey-kit/storage` subpath; the server-only
+ * entrypoint lives under `passkey-kit/server`.
+ *
+ * @packageDocumentation
+ */
+
+// Core client. (The server-only `PasskeyServer` lives at `passkey-kit/server`
+// so it — and the relayer secret it holds — can never be bundled into browser
+// code.)
+export {
+ PasskeyKit,
+ type PasskeyKitConfig,
+ type CreateOptions,
+ type ConnectOptions,
+} from "./kit.js";
+export { SACClient, buildTokenTransferHostFunction } from "./sac.js";
+
+// Generated contract client
+export { Client as PasskeyClient } from "passkey-kit-sdk";
+
+// Signer abstraction
+export {
+ PasskeySigner,
+ Ed25519Signer,
+ PolicySigner,
+ type Signer,
+ type SignerContext,
+ type PreparedSignature,
+ type WebAuthnAuthenticator,
+} from "./signers.js";
+
+// Signer-key helpers, indexer row, storage + result types
+export {
+ SignerKey,
+ SignerStore,
+ type SignerKeyTag,
+ type SignerLimits,
+ type IndexedSigner,
+ type StoredPasskey,
+ type StorageAdapter,
+ type CreateWalletResult,
+ type ConnectWalletResult,
+ type TransactionResult,
+ type TransactionSuccess,
+ type TransactionFailure,
+ type SubmissionMethod,
+} from "./types.js";
+
+// Typed errors
+export {
+ PasskeyKitError,
+ PasskeyKitErrorCode,
+ ConfigurationError,
+ WalletNotConnectedError,
+ WalletOwnershipError,
+ WebAuthnError,
+ SigningError,
+ SignerNotFoundError,
+ SimulationError,
+ SubmissionError,
+ ValidationError,
+ IndexerError,
+ RelayerError,
+ ContractError,
+ wrapError,
+} from "./errors.js";
+
+// Contract-error decoding
+export {
+ CONTRACT_ERROR_REGISTRY,
+ contractErrorFromCode,
+ decodeContractError,
+ type ContractErrorFamily,
+ type ContractErrorInfo,
+} from "./contract-errors.js";
+
+// Indexer abstraction: browser-safe types + the pure retry helper. The concrete
+// token-holding backends are exported from `passkey-kit/server`.
+export {
+ lookupWithRetry,
+ type SignerIndexer,
+ type WalletSigner,
+ type IndexerHealth,
+ type SignerStatus,
+ type SignerStorageClass,
+} from "./indexer/index.js";
+
+// Events
+export {
+ PasskeyEventEmitter,
+ type PasskeyEvent,
+ type PasskeyEventMap,
+ type EventListener,
+} from "./events.js";
+
+// Crypto / derivation helpers
+export {
+ deriveContractAddress,
+ extractPublicKeyFromAttestation,
+ compactSignature,
+ generateChallenge,
+} from "./utils.js";
+
+// Client-side validation
+export {
+ validateAddress,
+ validateAmount,
+ validateExpiration,
+ validateSecp256r1PublicKey,
+} from "./validation.js";
+
+// Package metadata
+export { VERSION, NAME } from "./version.js";
diff --git a/src/indexer/codec.test.ts b/src/indexer/codec.test.ts
new file mode 100644
index 0000000..3c8c72e
--- /dev/null
+++ b/src/indexer/codec.test.ts
@@ -0,0 +1,126 @@
+import { describe, expect, it } from "vitest";
+import { Keypair, StrKey, xdr } from "@stellar/stellar-sdk";
+import base64url from "../base64url.js";
+import { SignerKey } from "../types.js";
+import { SIGNER_VAL_UDT } from "../kit/auth-payload.js";
+import {
+ decodeSignerVal,
+ deriveStatus,
+ scValToSignerKey,
+ signerKeyToContractScVal,
+ signerKeyToIndexerJson,
+ walletSpec,
+} from "./codec.js";
+import { toContractSignerKey } from "../kit/wallet-ops.js";
+
+/** Encode a native SignerVal to its ScVal via the contract spec. */
+function encodeSignerVal(native: unknown): xdr.ScVal {
+ return walletSpec().nativeToScVal(native, SIGNER_VAL_UDT);
+}
+
+describe("decodeSignerVal", () => {
+ it("decodes a Secp256r1 signer value (publicKey, expiration, unlimited)", () => {
+ const publicKey = Buffer.alloc(65, 4);
+ const scVal = encodeSignerVal({
+ tag: "Secp256r1",
+ values: [publicKey, [1000], [undefined]],
+ });
+
+ const decoded = decodeSignerVal(scVal);
+ expect(decoded.kind).toBe("Secp256r1");
+ expect(Buffer.from(decoded.publicKey!)).toEqual(publicKey);
+ expect(decoded.expiration).toBe(1000);
+ expect(decoded.limits).toBeUndefined();
+ });
+
+ it("decodes an Ed25519 signer value with no expiration", () => {
+ const scVal = encodeSignerVal({
+ tag: "Ed25519",
+ values: [[undefined], [undefined]],
+ });
+ const decoded = decodeSignerVal(scVal);
+ expect(decoded.kind).toBe("Ed25519");
+ expect(decoded.publicKey).toBeUndefined();
+ expect(decoded.expiration).toBeUndefined();
+ });
+});
+
+describe("decodeSignerVal — limits-nested keys (audit M1)", () => {
+ it("decodes a limits-nested Ed25519 key as a G-address that round-trips", () => {
+ const g = Keypair.fromRawEd25519Seed(Buffer.alloc(32, 4)).publicKey();
+ const rawPk = Keypair.fromPublicKey(g).rawPublicKey();
+ const contract = "CAXCIOHU357VIEDAWOU6YZUL3IU3CDFLCHA6O4PT2VDICDX4PNGSVZDL";
+ // SignerVal Ed25519 = [ SignerExpiration, SignerLimits ]; limits = Some({
+ // contract -> Some([ Ed25519 key ]) }).
+ const scVal = encodeSignerVal({
+ tag: "Ed25519",
+ values: [
+ [undefined],
+ [new Map([[contract, [{ tag: "Ed25519", values: [rawPk] }]]])],
+ ],
+ });
+
+ const nested = decodeSignerVal(scVal).limits!.get(contract)![0]!;
+ expect(nested.key).toBe("Ed25519");
+ expect(StrKey.isValidEd25519PublicKey(nested.value)).toBe(true);
+ expect(nested.value).toBe(g); // a G-address, NOT hex
+ // The old hex encoding threw here (Keypair.fromPublicKey(hex)).
+ expect(() => toContractSignerKey(nested)).not.toThrow();
+ });
+});
+
+describe("scValToSignerKey", () => {
+ it("round-trips a Secp256r1 key", () => {
+ const keyId = base64url.encode(Buffer.alloc(16, 0xab));
+ const scVal = signerKeyToContractScVal(SignerKey.Secp256r1(keyId));
+ const decoded = scValToSignerKey(scVal);
+ expect(decoded.key).toBe("Secp256r1");
+ expect(decoded.value).toBe(keyId);
+ });
+
+ it("round-trips an Ed25519 key (raw bytes <-> G-address)", () => {
+ const g = Keypair.fromRawEd25519Seed(Buffer.alloc(32, 2)).publicKey();
+ const scVal = signerKeyToContractScVal(SignerKey.Ed25519(g));
+ const decoded = scValToSignerKey(scVal);
+ expect(decoded.key).toBe("Ed25519");
+ expect(StrKey.isValidEd25519PublicKey(decoded.value)).toBe(true);
+ expect(decoded.value).toBe(g);
+ });
+
+ it("round-trips a Policy key", () => {
+ const c = "CAXCIOHU357VIEDAWOU6YZUL3IU3CDFLCHA6O4PT2VDICDX4PNGSVZDL";
+ const decoded = scValToSignerKey(
+ signerKeyToContractScVal(SignerKey.Policy(c))
+ );
+ expect(decoded.key).toBe("Policy");
+ expect(decoded.value).toBe(c);
+ });
+});
+
+describe("signerKeyToIndexerJson", () => {
+ it("encodes a Secp256r1 key as a symbol+bytes(hex) vector", () => {
+ const keyId = base64url.encode(Buffer.from([0xde, 0xad]));
+ expect(signerKeyToIndexerJson(SignerKey.Secp256r1(keyId))).toEqual({
+ vec: [{ symbol: "Secp256r1" }, { bytes: "dead" }],
+ });
+ });
+
+ it("encodes a Policy key as a symbol+address vector", () => {
+ const c = "CAXCIOHU357VIEDAWOU6YZUL3IU3CDFLCHA6O4PT2VDICDX4PNGSVZDL";
+ expect(signerKeyToIndexerJson(SignerKey.Policy(c))).toEqual({
+ vec: [{ symbol: "Policy" }, { address: c }],
+ });
+ });
+});
+
+describe("deriveStatus", () => {
+ it("derives live / expired / evicted / removed", () => {
+ expect(deriveStatus({ nowSeconds: 100 })).toBe("live");
+ expect(deriveStatus({ expiration: 100, nowSeconds: 100 })).toBe("live"); // inclusive
+ expect(deriveStatus({ expiration: 99, nowSeconds: 100 })).toBe("expired");
+ expect(deriveStatus({ evicted: true, nowSeconds: 100 })).toBe("evicted");
+ expect(deriveStatus({ tombstoned: true, evicted: true, nowSeconds: 100 })).toBe(
+ "removed"
+ );
+ });
+});
diff --git a/src/indexer/codec.ts b/src/indexer/codec.ts
new file mode 100644
index 0000000..7a26dca
--- /dev/null
+++ b/src/indexer/codec.ts
@@ -0,0 +1,200 @@
+/**
+ * Shared SignerKey/SignerVal codec used by both indexer backends.
+ *
+ * Centralizes the encoding both backends need: the contract `SignerKey` ScVal
+ * (for a Stellar Indexer key predicate), the JSON predicate shape, decoding a
+ * stored `SignerVal` into {@link WalletSigner} parts, and the status derivation.
+ *
+ * WIRE NOTE: the Stellar Indexer key/val predicate JSON shape (and whether bytes
+ * are hex- or base64-encoded) is confirmed live against the beta API in F2. The
+ * documented `{ vec: [{ symbol }, { bytes|address }] }` shape (with hex bytes)
+ * is implemented here; adjust in one place if F2 shows otherwise.
+ *
+ * @packageDocumentation
+ */
+
+import { Address, StrKey, xdr } from "@stellar/stellar-sdk";
+import type { Spec as ContractSpec } from "@stellar/stellar-sdk/contract";
+import { Client as PasskeyClient, type SignerVal } from "passkey-kit-sdk";
+import {
+ SignerKey,
+ type SignerKeyTag,
+ type SignerLimits,
+} from "../types.js";
+import { signerKeyToScVal, SIGNER_VAL_UDT } from "../kit/auth-payload.js";
+import { toContractSignerKey } from "../kit/wallet-ops.js";
+import type { SignerStatus, SignerStorageClass, WalletSigner } from "./types.js";
+
+// The contract Spec is network-independent, so memoize a single instance built
+// from a throwaway client (constructing a client does not touch the network).
+let cachedSpec: ContractSpec | undefined;
+export function walletSpec(): ContractSpec {
+ if (!cachedSpec) {
+ cachedSpec = (
+ new PasskeyClient({
+ contractId:
+ "CAXCIOHU357VIEDAWOU6YZUL3IU3CDFLCHA6O4PT2VDICDX4PNGSVZDL",
+ networkPassphrase: "Test SDF Network ; September 2015",
+ rpcUrl: "https://rpc.invalid",
+ }) as unknown as { spec: ContractSpec }
+ ).spec;
+ }
+ return cachedSpec;
+}
+
+/** Encode an SDK-side {@link SignerKey} into its contract `SignerKey` ScVal. */
+export function signerKeyToContractScVal(key: SignerKey): xdr.ScVal {
+ return signerKeyToScVal(walletSpec(), toContractSignerKey(key));
+}
+
+/**
+ * Build the JSON key predicate for the Stellar Indexer contract-data query.
+ *
+ * @see WIRE NOTE at the top of this module.
+ */
+export function signerKeyToIndexerJson(key: SignerKey): unknown {
+ const contractKey = toContractSignerKey(key);
+ if (contractKey.tag === "Policy") {
+ return {
+ vec: [{ symbol: "Policy" }, { address: contractKey.values[0] }],
+ };
+ }
+ const bytes = Buffer.from(contractKey.values[0]).toString("hex");
+ return { vec: [{ symbol: contractKey.tag }, { bytes }] };
+}
+
+/**
+ * Decode a contract `SignerKey` ScVal (`scvVec([symbol, bytes|address])`) back
+ * into an SDK-side {@link SignerKey}. Used by the Stellar Indexer backend, which
+ * returns the stored ledger-entry key.
+ */
+export function scValToSignerKey(scVal: xdr.ScVal): SignerKey {
+ const vec = scVal.vec();
+ if (!vec || vec.length < 2 || vec[0]!.switch().name !== "scvSymbol") {
+ throw new Error("SignerKey ScVal is not a tagged vector");
+ }
+ const tag = vec[0]!.sym().toString() as SignerKeyTag;
+ switch (tag) {
+ case "Secp256r1":
+ return SignerKey.Secp256r1(
+ Buffer.from(vec[1]!.bytes()).toString("base64url")
+ );
+ case "Ed25519":
+ return SignerKey.Ed25519(
+ StrKey.encodeEd25519PublicKey(Buffer.from(vec[1]!.bytes()))
+ );
+ case "Policy":
+ return SignerKey.Policy(
+ Address.fromScAddress(vec[1]!.address()).toString()
+ );
+ default:
+ throw new Error(`Unknown SignerKey tag: ${tag}`);
+ }
+}
+
+/** Decode a stored `SignerVal` ScVal into WalletSigner value parts. */
+export function decodeSignerVal(valScVal: xdr.ScVal): {
+ kind: SignerKeyTag;
+ publicKey?: Uint8Array;
+ expiration?: number;
+ limits?: SignerLimits;
+} {
+ const native = walletSpec().scValToNative(valScVal, SIGNER_VAL_UDT) as SignerVal;
+
+ // SignerExpiration = [Option]; SignerLimits = [Option
+