createPasskey

The @soropass/core/create subpath: register an ES256-only passkey, extract its SEC-1 public key, deploy a smart account through your factory, and persist the credential id. ES256 is enforced at the source — anything else hard-fails.

Overview

Import only what you need from the /create subpath. createPasskey is the one call most apps need; the rest are the building blocks it composes, exported for advanced flows and testing.

import {
  createPasskey,
  assertES256,
  buildCreateOptions,
  browserWebAuthnClient,
  defaultCredentialStorage,
  coseKeyToSec1,
} from '@soropass/core/create';

Highlights

• ES256 at the source — buildCreateOptions emits pubKeyCredParams [{ type: 'public-key', alg: -7 }] only; assertES256 throws unless alg === -7.
• SEC-1 extraction — the CBOR COSE EC2 key is decoded to a 65-byte SEC-1 0x04‖X‖Y point; non-P-256 keys (RS256) hard-fail.
• Safari gesture rule — assertUserActivation enforces the WebKit active-user-gesture requirement; the create-button click is the gesture.
• Factory deploy — your AccountDeployer deploys the smart account for the new passkey and returns its contractId.
• Pluggable clients — browserWebAuthnClient and defaultCredentialStorage are defaults; pass your own WebAuthnClient / CredentialStorage.
• Credential persisted — the credential id is stored so connect() can find the account later, with an in-memory fallback for Node / SSR.

createPasskey()

Register an ES256-only passkey, extract its SEC-1 public key (RS256 hard-fails), deploy a smart account via the factory, persist the credential id, and return the account.

createPasskey(options: CreatePasskeyOptions): Promise<PasskeyCredential>

CreatePasskeyOptions

Returns — PasskeyCredential

Returns Promise<PasskeyCredential> — the deployed account and its passkey.

import { createPasskey } from '@soropass/core/create';

const account = await createPasskey({
  rpId: 'app.example.com',
  rpName: 'Example',
  userName: 'alice@example.com',
  deployer,                         // your AccountDeployer
  residentKey: 'required',
  userVerification: 'preferred',
  userActivation: navigator.userActivation, // Safari gesture rule
});

console.log(account.contractId);    // C... smart-account address
console.log(account.credentialId);  // persisted for connect()
console.log(account.publicKey.length); // 65 (SEC-1)

AccountDeployer

The contract-specific seam. createPasskey hands your deployer the extracted SEC-1 public key and credential id, and expects the deployed smart-account address back. Keeps the SDK free of any contract coupling.

interface AccountDeployer {
  deploy(input: {
    publicKey: Uint8Array;
    credentialId: string;
  }): Promise<{ contractId: string; txHash?: string }>;
}

Assertions & options

The guards and option-builder that enforce the invariants. createPasskey calls these internally; they're exported so you can assert at your own boundaries.

assertES256()

Throws ES256_NOT_SUPPORTED unless alg === -7.

assertES256(alg: number): void

assertUserActivation()

Throws USER_CANCELLED if not an active user gesture (Safari / WebKit rule).

assertUserActivation(activation?: { isActive: boolean }): void

import { assertES256, assertUserActivation } from '@soropass/core/create';

button.addEventListener('click', () => {
  assertUserActivation(navigator.userActivation); // throws USER_CANCELLED otherwise
  assertES256(-7);                                // ok; -257 (RS256) throws
});

buildCreateOptions()

Builds a PublicKeyCredentialCreationOptions with pubKeyCredParams [{ type: 'public-key', alg: -7 }] only.

buildCreateOptions(/* ... */): PublicKeyCredentialCreationOptions

Clients & storage

Default, swappable adapters for the WebAuthn ceremony and credential persistence. Override either via CreatePasskeyOptions.webauthn / .storage.

browserWebAuthnClient(): WebAuthnClient
defaultCredentialStorage(): CredentialStorage

Public-key extraction

The path from a WebAuthn attestation to the 65-byte SEC-1 point the contract verifies. Each step is exported so you can extract from whichever shape you hold.

coseKeyToSec1(coseKey: Uint8Array): Uint8Array
extractPublicKeyFromAuthData(authData: Uint8Array): Uint8Array
extractPublicKeyFromAttestationObject(attestationObject: Uint8Array): Uint8Array

import {
  extractPublicKeyFromAttestationObject,
} from '@soropass/core/create';

// 65-byte SEC-1 point: 0x04 ‖ X ‖ Y — non-P-256 keys throw ES256_NOT_SUPPORTED
const publicKey = extractPublicKeyFromAttestationObject(attestationObject);