@rhinestone/sdk 2.0.0 → 2.2.0

package/dist/src/accounts/adapters/hca.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hca.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/hca.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAGnD,eAAO,MAAM,0BAA0B,EACrC,4CAAqD,CAAA;AAwFvD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAqChB"}
+{"version":3,"file":"hca.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/hca.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAGnD,eAAO,MAAM,0BAA0B,EACrC,4CAAqD,CAAA;AA2FvD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAqChB"}

package/dist/src/accounts/adapters/hca.js

@@ -38,8 +38,11 @@ function hcaMaterial(input) {
         throw new Error('Expected HCA account');
     if (input.eoa)
         return { address: input.eoa.address };
+    // HCA derives its address from the ENS owner alone and has no module
+    // installation, so recovery, sessions, and extra modules can never be
+    // installed. `recovery` resolves into `modules`, so it is rejected here too.
     if (input.sessions.enabled || input.modules.length > 0) {
-        throw new Error('HCA accounts cannot install sessions or additional modules');
+        throw new Error('HCA accounts cannot install recovery, sessions, or additional modules');
     }
     if (!input.owner || input.owner.kind !== 'ens') {
         throw new Error('HCA accounts require ENS owners');

package/dist/src/actions/ecdsa.d.ts

@@ -1,4 +1,4 @@
-import { type Address } from 'viem';
+import type { Address } from 'viem';
 import type { CalldataInput, LazyCallInput } from '../config/account.js';
 /**
  * Enable ECDSA authentication

package/dist/src/actions/ecdsa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa.d.ts","sourceRoot":"","sources":["../../../actions/ecdsa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAsB,MAAM,MAAM,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAUrE;;;;;GAKG;AACH,iBAAS,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,SAAI,GAAG,aAAa,CAO/D;AAED;;;GAGG;AACH,iBAAS,OAAO,IAAI,aAAa,CAOhC;AAED;;;;GAIG;AACH,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAkB/C;AAED;;;;;GAKG;AACH,iBAAS,WAAW,CAClB,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,OAAO,GACrB,aAAa,CAqBf;AAED;;;;GAIG;AACH,iBAAS,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAoB5D;AAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA"}
+{"version":3,"file":"ecdsa.d.ts","sourceRoot":"","sources":["../../../actions/ecdsa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAerE;;;;;GAKG;AACH,iBAAS,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,SAAI,GAAG,aAAa,CAO/D;AAED;;;GAGG;AACH,iBAAS,OAAO,IAAI,aAAa,CAOhC;AAED;;;;GAIG;AACH,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAE/C;AAED;;;;;GAKG;AACH,iBAAS,WAAW,CAClB,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,OAAO,GACrB,aAAa,CAEf;AAED;;;;GAIG;AACH,iBAAS,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAE5D;AAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA"}

package/dist/src/actions/ecdsa.js

@@ -1,5 +1,5 @@
-import { encodeFunctionData } from 'viem';
 import { OWNABLE_VALIDATOR_ADDRESS, resolveOwnableAddresses, } from '../modules/validators/ownable.js';
+import { addOwnableOwner, changeOwnableThreshold, removeOwnableOwner, } from './ownable.js';
 import { resolveModuleUninstallation, resolveValidatorInstallation, } from './runtime.js';
 /**
  * Enable ECDSA authentication
@@ -33,23 +33,7 @@ function disable() {
  * @returns Call to add the owner
  */
 function addOwner(owner) {
-    return {
-        to: OWNABLE_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [{ internalType: 'address', name: 'owner', type: 'address' }],
-                    name: 'addOwner',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'addOwner',
-            args: [owner],
-        }),
-    };
+    return addOwnableOwner(OWNABLE_VALIDATOR_ADDRESS, owner);
 }
 /**
  * Remove an ECDSA owner
@@ -58,26 +42,7 @@ function addOwner(owner) {
  * @returns Call to remove the owner
  */
 function removeOwner(prevOwner, ownerToRemove) {
-    return {
-        to: OWNABLE_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [
-                        { internalType: 'address', name: 'prevOwner', type: 'address' },
-                        { internalType: 'address', name: 'owner', type: 'address' },
-                    ],
-                    name: 'removeOwner',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'removeOwner',
-            args: [prevOwner, ownerToRemove],
-        }),
-    };
+    return removeOwnableOwner(OWNABLE_VALIDATOR_ADDRESS, prevOwner, ownerToRemove);
 }
 /**
  * Change an account's signer threshold (ECDSA)
@@ -85,24 +50,6 @@ function removeOwner(prevOwner, ownerToRemove) {
  * @returns Call to change the threshold
  */
 function changeThreshold(newThreshold) {
-    return {
-        to: OWNABLE_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [
-                        { internalType: 'uint256', name: '_threshold', type: 'uint256' },
-                    ],
-                    name: 'setThreshold',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'setThreshold',
-            args: [BigInt(newThreshold)],
-        }),
-    };
+    return changeOwnableThreshold(OWNABLE_VALIDATOR_ADDRESS, newThreshold);
 }
 export { addOwner, removeOwner, changeThreshold, disable, enable };

package/dist/src/actions/ownable.d.ts

@@ -0,0 +1,6 @@
+import { type Address } from 'viem';
+import type { CalldataInput } from '../config/account.js';
+export declare function addOwnableOwner(validator: Address, owner: Address): CalldataInput;
+export declare function removeOwnableOwner(validator: Address, prevOwner: Address, ownerToRemove: Address): CalldataInput;
+export declare function changeOwnableThreshold(validator: Address, newThreshold: number): CalldataInput;
+//# sourceMappingURL=ownable.d.ts.map

package/dist/src/actions/ownable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownable.d.ts","sourceRoot":"","sources":["../../../actions/ownable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAsB,MAAM,MAAM,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,OAAO,GACb,aAAa,CAkBf;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,OAAO,GACrB,aAAa,CAqBf;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,YAAY,EAAE,MAAM,GACnB,aAAa,CAoBf"}

package/dist/src/actions/ownable.js

@@ -0,0 +1,63 @@
+import { encodeFunctionData } from 'viem';
+export function addOwnableOwner(validator, owner) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [{ internalType: 'address', name: 'owner', type: 'address' }],
+                    name: 'addOwner',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'addOwner',
+            args: [owner],
+        }),
+    };
+}
+export function removeOwnableOwner(validator, prevOwner, ownerToRemove) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [
+                        { internalType: 'address', name: 'prevOwner', type: 'address' },
+                        { internalType: 'address', name: 'owner', type: 'address' },
+                    ],
+                    name: 'removeOwner',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'removeOwner',
+            args: [prevOwner, ownerToRemove],
+        }),
+    };
+}
+export function changeOwnableThreshold(validator, newThreshold) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [
+                        { internalType: 'uint256', name: '_threshold', type: 'uint256' },
+                    ],
+                    name: 'setThreshold',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'setThreshold',
+            args: [BigInt(newThreshold)],
+        }),
+    };
+}

package/dist/src/actions/passkeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../actions/passkeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAA;AAMvC;;;;;GAKG;AACH,iBAAS,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,aAAa,CAU7D;AAED;;;GAGG;AACH,iBAAS,OAAO,IAAI,aAAa,CAgBhC;AAED;;;;;;GAMG;AACH,iBAAS,QAAQ,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,OAAO,GAC/B,aAAa,CAyBf;AAED;;;;;GAKG;AACH,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAqBpE;AAED;;;;GAIG;AACH,iBAAS,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAoB5D;AAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA"}
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../actions/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAA;AAWvC;;;;;GAKG;AACH,iBAAS,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,aAAa,CAU7D;AAED;;;GAGG;AACH,iBAAS,OAAO,IAAI,aAAa,CAgBhC;AAED;;;;;;GAMG;AACH,iBAAS,QAAQ,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,OAAO,GAC/B,aAAa,CAOf;AAED;;;;;GAKG;AACH,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAEpE;AAED;;;;GAIG;AACH,iBAAS,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAE5D;AAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA"}

package/dist/src/actions/passkeys.js

@@ -1,6 +1,6 @@
-import { encodeFunctionData } from 'viem';
 import { resolveWebauthnCredentials, WEBAUTHN_VALIDATOR_ADDRESS, } from '../modules/validators/webauthn.js';
 import { resolveModuleInstallation, resolveModuleUninstallation, } from './runtime.js';
+import { addWebauthnCredential, changeWebauthnThreshold, removeWebauthnCredential, } from './webauthn.js';
 /**
  * Enable passkeys authentication
  * @param pubKey Public key for the passkey
@@ -46,30 +46,7 @@ function disable() {
  * @returns Call to add the passkey owner
  */
 function addOwner(pubKeyX, pubKeyY, requireUserVerification) {
-    return {
-        to: WEBAUTHN_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [
-                        { name: 'pubKeyX', type: 'uint256' },
-                        { name: 'pubKeyY', type: 'uint256' },
-                        {
-                            name: 'requireUserVerification',
-                            type: 'bool',
-                        },
-                    ],
-                    name: 'addCredential',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'addCredential',
-            args: [pubKeyX, pubKeyY, requireUserVerification],
-        }),
-    };
+    return addWebauthnCredential(WEBAUTHN_VALIDATOR_ADDRESS, pubKeyX, pubKeyY, requireUserVerification);
 }
 /**
  * Remove a passkey owner
@@ -78,26 +55,7 @@ function addOwner(pubKeyX, pubKeyY, requireUserVerification) {
  * @returns Call to remove the passkey owner
  */
 function removeOwner(pubKeyX, pubKeyY) {
-    return {
-        to: WEBAUTHN_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [
-                        { name: 'pubKeyX', type: 'uint256' },
-                        { name: 'pubKeyY', type: 'uint256' },
-                    ],
-                    name: 'removeCredential',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'removeCredential',
-            args: [pubKeyX, pubKeyY],
-        }),
-    };
+    return removeWebauthnCredential(WEBAUTHN_VALIDATOR_ADDRESS, pubKeyX, pubKeyY);
 }
 /**
  * Change an account's signer threshold (passkey)
@@ -105,24 +63,6 @@ function removeOwner(pubKeyX, pubKeyY) {
  * @returns Call to change the threshold
  */
 function changeThreshold(newThreshold) {
-    return {
-        to: WEBAUTHN_VALIDATOR_ADDRESS,
-        value: 0n,
-        data: encodeFunctionData({
-            abi: [
-                {
-                    inputs: [
-                        { internalType: 'uint256', name: '_threshold', type: 'uint256' },
-                    ],
-                    name: 'setThreshold',
-                    outputs: [],
-                    stateMutability: 'nonpayable',
-                    type: 'function',
-                },
-            ],
-            functionName: 'setThreshold',
-            args: [BigInt(newThreshold)],
-        }),
-    };
+    return changeWebauthnThreshold(WEBAUTHN_VALIDATOR_ADDRESS, newThreshold);
 }
 export { addOwner, removeOwner, changeThreshold, disable, enable };

package/dist/src/actions/recovery.d.ts

@@ -0,0 +1,67 @@
+import { type Account } from 'viem';
+import type { CalldataInput, CallResolveContext, LazyCallInput, OwnableValidatorConfig, WebauthnValidatorConfig } from '../config/account.js';
+interface PasskeyCredential {
+    pubKeyX: bigint;
+    pubKeyY: bigint;
+}
+export interface RecoverEcdsaOwnershipOptions extends CallResolveContext {
+    /**
+     * Target owner set. Existing owners not listed here are removed. If supplied,
+     * `module` must match the account's configured owner validator.
+     */
+    newOwners: OwnableValidatorConfig;
+}
+export interface RecoverPasskeyOwnershipOptions extends CallResolveContext {
+    /**
+     * The account's complete current credential set, not just the ones being
+     * replaced. Credentials absent from `newOwners` are removed, and those
+     * already present here are not added again — passing a partial set makes the
+     * recovery re-add an installed credential, which reverts with
+     * `CredentialAlreadyExists`.
+     *
+     * This has to be supplied because the validator stores credentials by hashed
+     * id, so their coordinates cannot be read back onchain.
+     */
+    currentCredentials: readonly PasskeyCredential[];
+    /**
+     * Target passkey owner set. If supplied, `module` must match the account's
+     * configured owner validator.
+     */
+    newOwners: WebauthnValidatorConfig;
+}
+/**
+ * Set up social recovery.
+ *
+ * @param guardians Guardians permitted to recover the account
+ * @param threshold Guardian signatures required to recover
+ * @returns Calls to install the social recovery validator
+ */
+declare function enable(guardians: Account[], threshold?: number): LazyCallInput;
+/**
+ * Build the calls that rotate an account's ECDSA ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous owners stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
+ */
+declare function recoverEcdsaOwnership(options: RecoverEcdsaOwnershipOptions): Promise<CalldataInput[]>;
+/**
+ * Build the calls that rotate an account's passkey ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous credentials stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
+ */
+declare function recoverPasskeyOwnership(options: RecoverPasskeyOwnershipOptions): Promise<CalldataInput[]>;
+export { enable, recoverEcdsaOwnership, recoverPasskeyOwnership };
+//# sourceMappingURL=recovery.d.ts.map

package/dist/src/actions/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../actions/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAgC,MAAM,MAAM,CAAA;AACjE,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,mBAAmB,CAAA;AA0B1B,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,4BAA6B,SAAQ,kBAAkB;IACtE;;;OAGG;IACH,SAAS,EAAE,sBAAsB,CAAA;CAClC;AAED,MAAM,WAAW,8BAA+B,SAAQ,kBAAkB;IACxE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD;;;OAGG;IACH,SAAS,EAAE,uBAAuB,CAAA;CACnC;AAED;;;;;;GAMG;AACH,iBAAS,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,SAAI,GAAG,aAAa,CAUlE;AAED;;;;;;;;;;;GAWG;AACH,iBAAe,qBAAqB,CAClC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CA4D1B;AAED;;;;;;;;;;;GAWG;AACH,iBAAe,uBAAuB,CACpC,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwE1B;AAMD,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,CAAA"}

package/dist/src/actions/recovery.js

@@ -0,0 +1,134 @@
+import { isAddressEqual } from 'viem';
+import { OWNABLE_VALIDATOR_ADDRESS } from '../modules/validators/ownable.js';
+import { resolveSocialRecoveryValidator } from '../modules/validators/social-recovery.js';
+import { parseWebauthnPublicKey, WEBAUTHN_VALIDATOR_ADDRESS, } from '../modules/validators/webauthn.js';
+import { addOwnableOwner, changeOwnableThreshold, removeOwnableOwner, } from './ownable.js';
+import { readOwnershipFor, readThresholdFor, resolveValidatorInstallation, } from './runtime.js';
+import { addWebauthnCredential, changeWebauthnThreshold, removeWebauthnCredential, } from './webauthn.js';
+/** Sentinel head of the validator's owner linked list. */
+const SENTINEL_OWNER = '0x0000000000000000000000000000000000000001';
+/**
+ * Set up social recovery.
+ *
+ * @param guardians Guardians permitted to recover the account
+ * @param threshold Guardian signatures required to recover
+ * @returns Calls to install the social recovery validator
+ */
+function enable(guardians, threshold = 1) {
+    const module = resolveSocialRecoveryValidator({
+        guardians: guardians.map((guardian) => guardian.address),
+        threshold,
+    });
+    return {
+        async resolve(context) {
+            return resolveValidatorInstallation(context, module);
+        },
+    };
+}
+/**
+ * Build the calls that rotate an account's ECDSA ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous owners stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
+ */
+async function recoverEcdsaOwnership(options) {
+    const configuredValidator = options.config.owners?.type === 'ecdsa'
+        ? (options.config.owners.module ?? OWNABLE_VALIDATOR_ADDRESS)
+        : undefined;
+    const requestedValidator = options.newOwners.module;
+    if (configuredValidator &&
+        requestedValidator &&
+        !isAddressEqual(configuredValidator, requestedValidator)) {
+        throw new Error('Recovery owner validator must match the configured owner validator');
+    }
+    const validator = configuredValidator ?? requestedValidator ?? OWNABLE_VALIDATOR_ADDRESS;
+    const existing = await readOwnershipFor(options, options.accountAddress, validator);
+    const newOwners = options.newOwners.accounts
+        .map((account) => account.address.toLowerCase())
+        .sort();
+    const newThreshold = options.newOwners.threshold ?? 1;
+    const ownersToAdd = newOwners.filter((owner) => !existing.owners.includes(owner));
+    const ownersToRemove = existing.owners.filter((owner) => !newOwners.includes(owner));
+    const calls = [];
+    // Additions run first so the owner count already covers the new threshold:
+    // `setThreshold` reverts while `ownerCount < threshold`. Removals run last
+    // for the same reason, since `removeOwner` reverts once the count would drop
+    // to the threshold.
+    let currentOwners = [...existing.owners];
+    for (const owner of ownersToAdd) {
+        calls.push(addOwnableOwner(validator, owner));
+        // The validator pushes new owners onto the front of the linked list.
+        currentOwners.unshift(owner);
+    }
+    if (existing.threshold !== newThreshold) {
+        calls.push(changeOwnableThreshold(validator, newThreshold));
+    }
+    for (const owner of ownersToRemove) {
+        const index = currentOwners.indexOf(owner);
+        const prevOwner = index <= 0 ? SENTINEL_OWNER : currentOwners[index - 1];
+        calls.push(removeOwnableOwner(validator, prevOwner, owner));
+        currentOwners = currentOwners.filter((entry) => entry !== owner);
+    }
+    return calls;
+}
+/**
+ * Build the calls that rotate an account's passkey ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous credentials stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
+ */
+async function recoverPasskeyOwnership(options) {
+    const configuredValidator = options.config.owners?.type === 'passkey'
+        ? (options.config.owners.module ?? WEBAUTHN_VALIDATOR_ADDRESS)
+        : undefined;
+    const requestedValidator = options.newOwners.module;
+    if (configuredValidator &&
+        requestedValidator &&
+        !isAddressEqual(configuredValidator, requestedValidator)) {
+        throw new Error('Recovery owner validator must match the configured owner validator');
+    }
+    const validator = configuredValidator ?? requestedValidator ?? WEBAUTHN_VALIDATOR_ADDRESS;
+    const existingThreshold = await readThresholdFor(options, options.accountAddress, validator);
+    const newCredentials = options.newOwners.accounts.map((account) => {
+        // Must go through the shared parser: uncompressed SEC1 keys are 65 bytes
+        // with an 0x04 prefix, and slicing from byte 0 shifts both coordinates.
+        const { x, y } = parseWebauthnPublicKey(account.publicKey);
+        return { pubKeyX: x, pubKeyY: y, requireUV: false };
+    });
+    const newThreshold = options.newOwners.threshold ?? 1;
+    const currentKeys = options.currentCredentials.map(credentialKey);
+    const newKeys = newCredentials.map(credentialKey);
+    const credentialsToAdd = newCredentials.filter((credential) => !currentKeys.includes(credentialKey(credential)));
+    const credentialsToRemove = options.currentCredentials.filter((credential) => !newKeys.includes(credentialKey(credential)));
+    const calls = [];
+    // Additions run first so the credential count already covers the new
+    // threshold: `setThreshold` reverts while `credentials < threshold`, and
+    // `removeCredential` reverts once the count would reach the threshold.
+    // Rotating the sole credential of a 1-of-1 account is impossible otherwise.
+    for (const credential of credentialsToAdd) {
+        calls.push(addWebauthnCredential(validator, credential.pubKeyX, credential.pubKeyY, credential.requireUV));
+    }
+    if (existingThreshold !== newThreshold) {
+        calls.push(changeWebauthnThreshold(validator, newThreshold));
+    }
+    for (const credential of credentialsToRemove) {
+        calls.push(removeWebauthnCredential(validator, credential.pubKeyX, credential.pubKeyY));
+    }
+    return calls;
+}
+function credentialKey(credential) {
+    return `${credential.pubKeyX}-${credential.pubKeyY}`;
+}
+export { enable, recoverEcdsaOwnership, recoverPasskeyOwnership };

package/dist/src/actions/runtime.d.ts

@@ -1,5 +1,10 @@
 import type { CalldataInput, CallResolveContext, Session } from '../config/account.js';
 import type { ResolvedModule } from '../modules/types.js';
+export declare function readOwnershipFor(context: CallResolveContext, account: `0x${string}`, validator: `0x${string}`): Promise<{
+    readonly owners: readonly `0x${string}`[];
+    threshold: number;
+}>;
+export declare function readThresholdFor(context: CallResolveContext, account: `0x${string}`, validator: `0x${string}`): Promise<number>;
 export declare function resolveValidatorInstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;
 export declare function resolveModuleInstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;
 export declare function resolveModuleUninstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;

package/dist/src/actions/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../actions/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,OAAO,EACR,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAyEtD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA4C1B;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAM1B;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA2B1B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CACxB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBzB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../actions/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,OAAO,EACR,MAAM,mBAAmB,CAAA;AAU1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAyEtD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,SAAS,EAAE,KAAK,MAAM,EAAE,GACvB,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3E;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,SAAS,EAAE,KAAK,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA4C1B;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAM1B;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA2B1B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CACxB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBzB"}

package/dist/src/actions/runtime.js

@@ -5,7 +5,7 @@ import { createAccountAdapter } from '../accounts/registry.js';
 import { materializeRpcReader } from '../clients/rpc/compatibility.js';
 import { resolveStandaloneAccountConfig } from '../config/resolve.js';
 import { assertAccountOwnersConfigured } from '../config/validate.js';
-import { encodeAccountModuleDeInitData, readInstalledModules, readValidatorInitialized, } from '../modules/read-core.js';
+import { encodeAccountModuleDeInitData, readInstalledModules, readValidatorInitialized, readValidatorOwnership, readValidatorThreshold, } from '../modules/read-core.js';
 import { OWNABLE_VALIDATOR_ADDRESS } from '../modules/validators/ownable.js';
 import { SESSION_LOCK_TAG } from '../modules/validators/smart-sessions/authorization.js';
 import { encodeDisableSessionCall } from '../modules/validators/smart-sessions/calls.js';
@@ -59,6 +59,30 @@ function defaultValidatorConfigured(context, validator) {
         context.construction.setup.validators.some((module) => module.address.toLowerCase() === validator.toLowerCase() &&
             size(module.initData) > 0));
 }
+export async function readOwnershipFor(context, account, validator) {
+    const reader = materializeRpcReader({
+        chain: context.chain,
+        provider: context.config.provider,
+    });
+    return readValidatorOwnership({
+        rpc: reader.rpc,
+        chain: reader.chain,
+        account,
+        validator,
+    });
+}
+export async function readThresholdFor(context, account, validator) {
+    const reader = materializeRpcReader({
+        chain: context.chain,
+        provider: context.config.provider,
+    });
+    return readValidatorThreshold({
+        rpc: reader.rpc,
+        chain: reader.chain,
+        account,
+        validator,
+    });
+}
 export async function resolveValidatorInstallation(context, module) {
     const runtime = actionContext(context);
     if (runtime.construction.account.kind === 'nexus') {

package/dist/src/actions/webauthn.d.ts

@@ -0,0 +1,6 @@
+import { type Address } from 'viem';
+import type { CalldataInput } from '../config/account.js';
+export declare function addWebauthnCredential(validator: Address, pubKeyX: bigint, pubKeyY: bigint, requireUserVerification: boolean): CalldataInput;
+export declare function removeWebauthnCredential(validator: Address, pubKeyX: bigint, pubKeyY: bigint): CalldataInput;
+export declare function changeWebauthnThreshold(validator: Address, newThreshold: number): CalldataInput;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/src/actions/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../actions/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAsB,MAAM,MAAM,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,OAAO,GAC/B,aAAa,CAsBf;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,aAAa,CAqBf;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,YAAY,EAAE,MAAM,GACnB,aAAa,CAoBf"}

package/dist/src/actions/webauthn.js

@@ -0,0 +1,67 @@
+import { encodeFunctionData } from 'viem';
+export function addWebauthnCredential(validator, pubKeyX, pubKeyY, requireUserVerification) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [
+                        { name: 'pubKeyX', type: 'uint256' },
+                        { name: 'pubKeyY', type: 'uint256' },
+                        { name: 'requireUserVerification', type: 'bool' },
+                    ],
+                    name: 'addCredential',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'addCredential',
+            args: [pubKeyX, pubKeyY, requireUserVerification],
+        }),
+    };
+}
+export function removeWebauthnCredential(validator, pubKeyX, pubKeyY) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [
+                        { name: 'pubKeyX', type: 'uint256' },
+                        { name: 'pubKeyY', type: 'uint256' },
+                    ],
+                    name: 'removeCredential',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'removeCredential',
+            args: [pubKeyX, pubKeyY],
+        }),
+    };
+}
+export function changeWebauthnThreshold(validator, newThreshold) {
+    return {
+        to: validator,
+        value: 0n,
+        data: encodeFunctionData({
+            abi: [
+                {
+                    inputs: [
+                        { internalType: 'uint256', name: '_threshold', type: 'uint256' },
+                    ],
+                    name: 'setThreshold',
+                    outputs: [],
+                    stateMutability: 'nonpayable',
+                    type: 'function',
+                },
+            ],
+            functionName: 'setThreshold',
+            args: [BigInt(newThreshold)],
+        }),
+    };
+}