@rhinestone/sdk 2.2.2 → 2.2.5

package/dist/src/accounts/adapters/kernel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,GAAG,EAOT,MAAM,MAAM,CAAA;AAEb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAGhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAKnD,eAAO,MAAM,6BAA6B,EACxC,4CAAqD,CAAA;AAQvD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAgBzE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,EAAE,CA2CxE;AAyED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAmChB"}
+{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,GAAG,EAMT,MAAM,MAAM,CAAA;AAEb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAQhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAKnD,eAAO,MAAM,6BAA6B,EACxC,4CAAqD,CAAA;AAQvD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAgBzE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,EAAE,CA2CxE;AAsED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAmChB"}

package/dist/src/accounts/adapters/kernel.js

@@ -1,6 +1,6 @@
-import { concat, concatHex, decodeAbiParameters, decodeFunctionData, domainSeparator, encodeAbiParameters, encodeFunctionData, getContractAddress, keccak256, parseAbi, stringToHex, toHex, zeroAddress, zeroHash, } from 'viem';
+import { concat, concatHex, decodeAbiParameters, decodeFunctionData, domainSeparator, encodeAbiParameters, encodeFunctionData, getContractAddress, keccak256, parseAbi, stringToHex, toHex, zeroAddress, } from 'viem';
 import { moduleTypeId } from '../../modules/erc7579-abi.js';
-import { deploymentPlan } from '../deployment.js';
+import { deploymentPlan, KERNEL_SALT_DEFAULTS, selectedValue, } from '../deployment.js';
 import { encodeErc7579Calls } from '../erc7579-calls.js';
 import { encodeUninstallModule } from './shared.js';
 const KERNEL_META_FACTORY_ADDRESS = '0xd703aae79538628d27099b8c4f621be4ccd142d5';
@@ -99,10 +99,7 @@ function kernelMaterial(input) {
                 initConfig,
             ],
         });
-        salt =
-            input.account.salt.source === 'explicit'
-                ? input.account.salt.value
-                : zeroHash;
+        salt = selectedValue(input.account.salt, KERNEL_SALT_DEFAULTS);
         factoryData = encodeFunctionData({
             abi: parseAbi(['function deployWithFactory(address,bytes,bytes32)']),
             functionName: 'deployWithFactory',

package/dist/src/accounts/adapters/nexus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/nexus.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAOZ,KAAK,GAAG,EAKT,MAAM,MAAM,CAAA;AAEb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAkB,MAAM,eAAe,CAAA;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAOnD,eAAO,MAAM,4BAA4B,EACvC,4CAAqD,CAAA;AACvD,eAAO,MAAM,qBAAqB,EAChC,4CAAqD,CAAA;AAIvD,eAAO,MAAM,0BAA0B,EACrC,4CAAqD,CAAA;AACvD,eAAO,MAAM,mBAAmB,EAC9B,4CAAqD,CAAA;AAmCvD,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CACpB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,mBAAmB,GACzB,uBAAuB,CAwHzB;AA4CD,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAoChB"}
+{"version":3,"file":"nexus.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/nexus.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAOZ,KAAK,GAAG,EAIT,MAAM,MAAM,CAAA;AAEb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EACL,KAAK,kBAAkB,EAIxB,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAOnD,eAAO,MAAM,4BAA4B,EACvC,4CAAqD,CAAA;AACvD,eAAO,MAAM,qBAAqB,EAChC,4CAAqD,CAAA;AAIvD,eAAO,MAAM,0BAA0B,EACrC,4CAAqD,CAAA;AACvD,eAAO,MAAM,mBAAmB,EAC9B,4CAAqD,CAAA;AAmCvD,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CACpB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,mBAAmB,GACzB,uBAAuB,CAqHzB;AA4CD,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAoChB"}

package/dist/src/accounts/adapters/nexus.js

@@ -1,6 +1,6 @@
-import { concat, decodeFunctionData, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, parseAbi, size, zeroAddress, } from 'viem';
+import { concat, decodeFunctionData, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, parseAbi, size, zeroAddress, } from 'viem';
 import { OWNABLE_VALIDATOR_ADDRESS } from '../../modules/validators/ownable.js';
-import { deploymentPlan } from '../deployment.js';
+import { deploymentPlan, NEXUS_SALT_DEFAULTS, selectedValue, } from '../deployment.js';
 import { encodeErc7579Calls } from '../erc7579-calls.js';
 import { encodeAddressEnvelope, encodeInstallModule, encodeUninstallModule, } from './shared.js';
 export const NEXUS_IMPLEMENTATION_ADDRESS = '0x000000000032ddc454c3bdcba80484ad5a798705';
@@ -72,10 +72,7 @@ export function nexusMaterial(input) {
         const deployment = getNexusDeployment(version);
         factory = deployment.factory;
         implementation = deployment.implementation;
-        salt =
-            input.account.salt.source === 'explicit'
-                ? input.account.salt.value
-                : keccak256('0x');
+        salt = selectedValue(input.account.salt, NEXUS_SALT_DEFAULTS);
         const defaultValidator = input.setup.validators.find((module) => module.address === OWNABLE_VALIDATOR_ADDRESS);
         const defaultValidatorInitData = defaultValidator?.initData ?? '0x';
         const validators = input.setup.validators.filter((module) => module.address !== OWNABLE_VALIDATOR_ADDRESS);

package/dist/src/accounts/adapters/safe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/safe.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,KAAK,kBAAkB,EAAkB,MAAM,eAAe,CAAA;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAyHnD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,GACzB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,CA0D/D;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,mBAAmB,GAChC,cAAc,CA8BhB"}
+{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/safe.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EACL,KAAK,kBAAkB,EAIxB,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAyHnD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,GACzB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,CA2D/D;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,mBAAmB,GAChC,cAAc,CA8BhB"}

package/dist/src/accounts/adapters/safe.js

@@ -1,8 +1,8 @@
 import { concat, decodeFunctionData, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, parseAbi, parseAbiParameters, zeroAddress, } from 'viem';
 import { getV0Attesters } from '../../modules/legacy-core.js';
-import { deploymentPlan } from '../deployment.js';
+import { deploymentPlan, SAFE_NONCE_DEFAULTS, selectedValue, } from '../deployment.js';
 import { encodeErc7579Calls } from '../erc7579-calls.js';
-import { encodeAddressEnvelope, encodeInstallModule, encodeUninstallModule, primaryOwnerAddresses, primaryThreshold, } from './shared.js';
+import { canonicalOwnerAddresses, encodeAddressEnvelope, encodeInstallModule, encodeUninstallModule, primaryOwnerAddresses, primaryThreshold, } from './shared.js';
 const SAFE_LAUNCHPAD = '0x75798463024bda64d83c94a64bc7d7eab41300ef';
 const SAFE_ADAPTER = '0x7579f2ad53b01c3d8779fe17928e0d48885b0003';
 const SAFE_V0_LAUNCHPAD = '0x7579011ab74c46090561ea277ba79d510c6c00ff';
@@ -75,7 +75,7 @@ function safeMaterial(input) {
             ]),
             functionName: 'setup',
             args: [
-                [...primaryOwnerAddresses(input.owner)],
+                [...canonicalOwnerAddresses(input.owner)],
                 primaryThreshold(input.owner),
                 SAFE_LAUNCHPAD,
                 addSafe7579,
@@ -85,7 +85,7 @@ function safeMaterial(input) {
                 zeroAddress,
             ],
         });
-        const nonce = input.account.nonce.source === 'explicit' ? input.account.nonce.value : 0n;
+        const nonce = selectedValue(input.account.nonce, SAFE_NONCE_DEFAULTS);
         factoryData = encodeFunctionData({
             abi: parseAbi([
                 'function createProxyWithNonce(address singleton,bytes initializer,uint256 saltNonce)',
@@ -139,6 +139,8 @@ export function safeV0FactoryMaterial(input) {
         ]),
         functionName: 'setup',
         args: [
+            // Caller order, not canonical order: this path reconstructs accounts that
+            // SDK v0 already deployed from the owner list as it was supplied.
             [...primaryOwnerAddresses(input.owner)],
             primaryThreshold(input.owner),
             SAFE_V0_LAUNCHPAD,
@@ -149,7 +151,7 @@ export function safeV0FactoryMaterial(input) {
             zeroAddress,
         ],
     });
-    const nonce = input.account.nonce.source === 'explicit' ? input.account.nonce.value : 0n;
+    const nonce = selectedValue(input.account.nonce, SAFE_NONCE_DEFAULTS);
     return {
         factory: SAFE_FACTORY,
         factoryData: encodeFunctionData({

package/dist/src/accounts/adapters/shared.d.ts

@@ -2,6 +2,7 @@ import { type Hex } from 'viem';
 import type { ResolvedModule } from '../../modules/types.js';
 import type { ResolvedValidatorDefinition } from '../../modules/validators/types.js';
 export declare function primaryOwnerAddresses(validator: ResolvedValidatorDefinition): readonly `0x${string}`[];
+export declare function canonicalOwnerAddresses(validator: ResolvedValidatorDefinition): readonly `0x${string}`[];
 export declare function primaryThreshold(validator: ResolvedValidatorDefinition): bigint;
 export declare function encodeInstallModule(module: ResolvedModule): Hex;
 export declare function encodeUninstallModule(module: ResolvedModule): Hex;

package/dist/src/accounts/adapters/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,GAAG,EAAe,MAAM,MAAM,CAAA;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAEjF,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,2BAA2B,GACrC,SAAS,KAAK,MAAM,EAAE,EAAE,CAU1B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,2BAA2B,GACrC,MAAM,CAMR;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,GAAG,CAkB/D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,GAAG,CAkBjE;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,KAAK,MAAM,EAAE,EACxB,SAAS,EAAE,GAAG,EACd,gBAAgB,CAAC,EAAE,KAAK,MAAM,EAAE,GAC/B,GAAG,CAML"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,GAAG,EAAe,MAAM,MAAM,CAAA;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAEjF,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,2BAA2B,GACrC,SAAS,KAAK,MAAM,EAAE,EAAE,CAU1B;AAKD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,2BAA2B,GACrC,SAAS,KAAK,MAAM,EAAE,EAAE,CAE1B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,2BAA2B,GACrC,MAAM,CAMR;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,GAAG,CAkB/D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,GAAG,CAkBjE;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,KAAK,MAAM,EAAE,EACxB,SAAS,EAAE,GAAG,EACd,gBAAgB,CAAC,EAAE,KAAK,MAAM,EAAE,GAC/B,GAAG,CAML"}

package/dist/src/accounts/adapters/shared.js

@@ -1,5 +1,6 @@
 import { encodeFunctionData, encodePacked, zeroAddress } from 'viem';
 import { moduleTypeId } from '../../modules/erc7579-abi.js';
+import { compareHexValues } from '../../modules/validators/ordering.js';
 export function primaryOwnerAddresses(validator) {
     if (validator.kind === 'passkey' || validator.kind === 'multi-factor') {
         return ['0xbabe99e62d8bcbd3acf5ccbcfcd4f64fe75e5e72'];
@@ -11,6 +12,12 @@ export function primaryOwnerAddresses(validator) {
         return owner.account.address;
     });
 }
+// Safe keeps owners in a linked list and imposes no order on them, but the
+// owner array is part of the `setup` initializer that becomes the account's
+// CREATE2 salt — so it must be ordered by value, never by caller order.
+export function canonicalOwnerAddresses(validator) {
+    return [...primaryOwnerAddresses(validator)].sort(compareHexValues);
+}
 export function primaryThreshold(validator) {
     return BigInt(validator.kind === 'passkey' || validator.kind === 'multi-factor'
         ? 1

package/dist/src/accounts/adapters/startale.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startale.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/startale.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAYb,MAAM,MAAM,CAAA;AAEb,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAGhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAQnD,OAAO,EAAE,4BAA4B,EAAE,CAAA;AACvC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM;;;;;;EAQrE;AAqID,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAoChB"}
+{"version":3,"file":"startale.d.ts","sourceRoot":"","sources":["../../../../accounts/adapters/startale.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAYb,MAAM,MAAM,CAAA;AAEb,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAQhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAQnD,OAAO,EAAE,4BAA4B,EAAE,CAAA;AACvC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM;;;;;;EAQrE;AAkID,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,mBAAmB,GAChC,cAAc,CAoChB"}

package/dist/src/accounts/adapters/startale.js

@@ -1,6 +1,6 @@
 import { concat, decodeFunctionData, encodeAbiParameters, encodeFunctionData, encodePacked, keccak256, parseAbi, slice, zeroAddress, zeroHash, } from 'viem';
 import { K1_DEFAULT_VALIDATOR_ADDRESS } from '../../modules/validators/k1.js';
-import { deploymentPlan } from '../deployment.js';
+import { deploymentPlan, STARTALE_SALT_DEFAULTS, selectedValue, } from '../deployment.js';
 import { encodeErc7579Calls } from '../erc7579-calls.js';
 import { encodeAddressEnvelope, encodeInstallModule, encodeUninstallModule, primaryOwnerAddresses, } from './shared.js';
 export { K1_DEFAULT_VALIDATOR_ADDRESS };
@@ -106,10 +106,7 @@ function startaleMaterial(input) {
         }
     }
     else {
-        salt =
-            input.account.salt.source === 'explicit'
-                ? input.account.salt.value
-                : zeroHash;
+        salt = selectedValue(input.account.salt, STARTALE_SALT_DEFAULTS);
         const initData = startaleInitData(input);
         factoryData = encodeFunctionData({
             abi: parseAbi(['function createAccount(bytes,bytes32)']),

package/dist/src/accounts/construction.d.ts

@@ -1,4 +1,4 @@
-import type { Account } from 'viem';
+import { type Account } from 'viem';
 import type { EvmChainReference } from '../chains/types.js';
 import type { ConfiguredModule, ModuleSetup } from '../modules/types.js';
 import type { ResolvedValidatorDefinition } from '../modules/validators/types.js';

package/dist/src/accounts/construction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"construction.d.ts","sourceRoot":"","sources":["../../../accounts/construction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;QAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;QAC/B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;KAC/C,CAAA;CACF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAC7B,GAAG,mBAAmB,CAgCtB"}
+{"version":3,"file":"construction.d.ts","sourceRoot":"","sources":["../../../accounts/construction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAoC,MAAM,MAAM,CAAA;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAErE,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,6BAA6B,CAAA;AAapC,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EAChB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;QAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;QAC/B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;KAC/C,CAAA;CACF;AAqBD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAC7B,GAAG,mBAAmB,CAwEtB"}

package/dist/src/accounts/construction.js

@@ -1,34 +1,82 @@
+import { keccak256, stringToHex } from 'viem';
 import { planModuleSetup } from '../modules/plan.js';
 import { resolveValidator } from '../modules/validators/resolve.js';
+import { orderWebauthnCredentials, toWebauthnInstallCredentials, webauthnDefinitionCredentials, } from '../modules/validators/webauthn.js';
+import { accountSupportsSaltSearch, assertPasskeySetInstallable, selectPasskeyAccount, } from './passkey-install.js';
+import { createAccountAdapter } from './registry.js';
+function passkeyOwner(owner) {
+    return owner?.kind === 'passkey' ? owner : undefined;
+}
+function setupFingerprint(input) {
+    return keccak256(stringToHex(JSON.stringify(input, (_key, value) => typeof value === 'bigint' ? `${value}n` : value)));
+}
 export function createAccountConstruction(input) {
-    const ownerModule = input.material.owner
-        ? resolveValidator(input.material.owner)
+    const material = input.material;
+    const passkey = passkeyOwner(material.owner);
+    // Caller-pinned init data carrying a factory is used verbatim, so neither the
+    // credential order nor the salt has any effect on the deployed account.
+    const pinned = material.initData !== undefined && 'factory' in material.initData;
+    const knownAddress = material.eoa?.address ?? material.initData?.address;
+    const credentials = passkey && !pinned
+        ? toWebauthnInstallCredentials(webauthnDefinitionCredentials(passkey))
         : undefined;
-    if (!ownerModule && input.material.account.kind !== 'eoa') {
+    const searchable = credentials !== undefined &&
+        credentials.length > 1 &&
+        knownAddress === undefined &&
+        accountSupportsSaltSearch(material.account);
+    if (credentials && (knownAddress !== undefined || searchable)) {
+        assertPasskeySetInstallable({ credentials, atDeployment: searchable });
+    }
+    const ordering = knownAddress
+        ? // The address is already fixed (EIP-7702 adoption or a caller-supplied
+            // address), so the exact order the validator requires is computable.
+            { kind: 'credential-id', account: knownAddress }
+        : searchable
+            ? { kind: 'canonical' }
+            : undefined;
+    const ownerModule = material.owner
+        ? resolveValidator(material.owner, ordering)
+        : undefined;
+    if (!ownerModule && material.account.kind !== 'eoa') {
         throw new Error('Smart account owner is required');
     }
     const setup = input.setup ??
         (ownerModule
             ? planModuleSetup({
-                accountKind: input.material.account.kind,
+                accountKind: material.account.kind,
                 owner: ownerModule,
-                configured: input.material.modules,
-                environment: input.material.sessions.environment,
-                sessions: input.material.sessions,
+                configured: material.modules,
+                environment: material.sessions.environment,
+                sessions: material.sessions,
             })
             : { validators: [], executors: [], hooks: [], fallbacks: [] });
-    return {
-        account: input.material.account,
-        ...(input.material.owner ? { owner: input.material.owner } : {}),
-        modules: input.material.modules,
+    const base = {
+        account: material.account,
+        ...(material.owner ? { owner: material.owner } : {}),
+        modules: material.modules,
         setup,
         sessions: {
-            enabled: input.material.sessions.enabled,
-            environment: input.material.sessions.environment,
+            enabled: material.sessions.enabled,
+            environment: material.sessions.environment,
         },
-        ...(input.material.initData ? { initData: input.material.initData } : {}),
-        ...(input.material.eoa ? { eoa: input.material.eoa } : {}),
+        ...(material.initData ? { initData: material.initData } : {}),
+        ...(material.eoa ? { eoa: material.eoa } : {}),
         chain: input.chain,
         deployed: input.deployed,
     };
+    if (!searchable || !credentials)
+        return base;
+    // The module setup is salt-independent, so only the account definition varies
+    // across attempts.
+    const account = selectPasskeyAccount({
+        account: material.account,
+        credentials: orderWebauthnCredentials(credentials, { kind: 'canonical' }),
+        fingerprint: setupFingerprint({ account: material.account, setup }),
+        deriveAddress: (candidate) => {
+            const construction = { ...base, account: candidate };
+            return createAccountAdapter(construction).getIdentity(construction)
+                .address;
+        },
+    });
+    return { ...base, account };
 }

package/dist/src/accounts/deployment.d.ts

@@ -1,10 +1,22 @@
-import type { Address, Hex } from 'viem';
+import { type Address, type Hex } from 'viem';
 import type { AccountDefinition, AccountDeploymentPlan, AccountInitData, AccountValueSelection } from './types.js';
 export interface DeploymentMaterial {
     readonly address: Address;
     readonly factory?: Address;
     readonly factoryData?: Hex;
 }
+export declare const NEXUS_SALT_DEFAULTS: {
+    readonly 'nexus-empty-calldata-salt': `0x${string}`;
+};
+export declare const KERNEL_SALT_DEFAULTS: {
+    readonly 'kernel-zero-salt': "0x0000000000000000000000000000000000000000000000000000000000000000";
+};
+export declare const STARTALE_SALT_DEFAULTS: {
+    readonly 'startale-zero-salt': "0x0000000000000000000000000000000000000000000000000000000000000000";
+};
+export declare const SAFE_NONCE_DEFAULTS: {
+    readonly 'safe-zero-nonce': 0n;
+};
 export declare function selectedValue<Value, Profile extends string>(selection: AccountValueSelection<Value, Profile>, defaults: Readonly<Record<Profile, Value>>): Value;
 export declare function deploymentPlan(chain: AccountDeploymentPlan['chain'], material: DeploymentMaterial, deployed: boolean): AccountDeploymentPlan;
 export declare function initDataMaterial(initData: AccountInitData | undefined): DeploymentMaterial | undefined;

package/dist/src/accounts/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../../accounts/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACxC,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAA;CAC3B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,SAAS,MAAM,EACzD,SAAS,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,GACzC,KAAK,CAIP;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACrC,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,OAAO,GAChB,qBAAqB,CAcvB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,kBAAkB,GAAG,SAAS,CAShC;AAED,wBAAgB,WAAW,CACzB,UAAU,EAAE,iBAAiB,GAC5B,iBAAiB,CAAC,MAAM,CAAC,CAE3B"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../../accounts/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAuB,MAAM,MAAM,CAAA;AAClE,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAA;CAC3B;AAID,eAAO,MAAM,mBAAmB;;CAEtB,CAAA;AACV,eAAO,MAAM,oBAAoB;;CAA4C,CAAA;AAC7E,eAAO,MAAM,sBAAsB;;CAEzB,CAAA;AACV,eAAO,MAAM,mBAAmB;;CAAqC,CAAA;AAErE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,SAAS,MAAM,EACzD,SAAS,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,GACzC,KAAK,CAIP;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACrC,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,OAAO,GAChB,qBAAqB,CAcvB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,kBAAkB,GAAG,SAAS,CAShC;AAED,wBAAgB,WAAW,CACzB,UAAU,EAAE,iBAAiB,GAC5B,iBAAiB,CAAC,MAAM,CAAC,CAE3B"}

package/dist/src/accounts/deployment.js

@@ -1,3 +1,14 @@
+import { keccak256, zeroHash } from 'viem';
+// Salt/nonce defaults live here rather than in the adapters so the passkey salt
+// search grinds the same values the adapters derive addresses from.
+export const NEXUS_SALT_DEFAULTS = {
+    'nexus-empty-calldata-salt': keccak256('0x'),
+};
+export const KERNEL_SALT_DEFAULTS = { 'kernel-zero-salt': zeroHash };
+export const STARTALE_SALT_DEFAULTS = {
+    'startale-zero-salt': zeroHash,
+};
+export const SAFE_NONCE_DEFAULTS = { 'safe-zero-nonce': 0n };
 export function selectedValue(selection, defaults) {
     return selection.source === 'explicit'
         ? selection.value

package/dist/src/accounts/error.d.ts

@@ -99,9 +99,16 @@ declare class OwnersFieldRequiredError extends AccountError {
         traceId?: string;
     });
 }
+declare class PasskeyConfigurationNotInstallableError extends AccountError {
+    constructor(reason: string, params?: {
+        context?: any;
+        errorType?: string;
+        traceId?: string;
+    });
+}
 declare class Eip712DomainNotAvailableError extends AccountError {
     constructor(message: string);
 }
 declare function isAccountError(error: Error): error is AccountError;
-export { isAccountError, AccountError, Eip712DomainNotAvailableError, Eip7702AccountMustHaveEoaError, EoaAccountMustHaveAccountError, FactoryArgsNotAvailableError, DefaultValidatorAlreadyInitializedError, SigningNotSupportedForAccountError, Eip7702NotSupportedForAccountError, AccountConfigurationNotSupportedError, WalletClientNoConnectedAccountError, ModuleInstallationNotSupportedError, EoaSigningNotSupportedError, EoaSigningMethodNotConfiguredError, OwnersFieldRequiredError, };
+export { isAccountError, AccountError, Eip712DomainNotAvailableError, Eip7702AccountMustHaveEoaError, EoaAccountMustHaveAccountError, FactoryArgsNotAvailableError, DefaultValidatorAlreadyInitializedError, SigningNotSupportedForAccountError, Eip7702NotSupportedForAccountError, AccountConfigurationNotSupportedError, WalletClientNoConnectedAccountError, ModuleInstallationNotSupportedError, EoaSigningNotSupportedError, EoaSigningMethodNotConfiguredError, OwnersFieldRequiredError, PasskeyConfigurationNotInstallableError, };
 //# sourceMappingURL=error.d.ts.map

package/dist/src/accounts/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../accounts/error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,cAAM,YAAa,SAAQ,KAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;IAQD,IAAI,OAAO,WAEV;IAED,IAAI,OAAO,QAEV;IAED,IAAI,SAAS,WAEZ;IAED,IAAI,OAAO,WAEV;CACF;AAED,cAAM,8BAA+B,SAAQ,YAAY;gBAC3C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,8BAA+B,SAAQ,YAAY;gBAC3C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,4BAA6B,SAAQ,YAAY;gBACzC,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,uCAAwC,SAAQ,YAAY;gBACpD,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOF;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAC/C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAEzD,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAQnE;AAED,cAAM,qCAAsC,SAAQ,YAAY;gBAE5D,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOJ;AAED,cAAM,mCAAoC,SAAQ,YAAY;gBAChD,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOF;AAED,cAAM,mCAAoC,SAAQ,YAAY;gBAE1D,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAQnE;AAED,cAAM,2BAA4B,SAAQ,YAAY;gBAElD,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAOnE;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAEzD,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAOnE;AAED,cAAM,wBAAyB,SAAQ,YAAY;gBACrC,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,6BAA8B,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM;CAK5B;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,IAAI,YAAY,CAE3D;AAmBD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,uCAAuC,EACvC,kCAAkC,EAClC,kCAAkC,EAClC,qCAAqC,EACrC,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,GACzB,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../accounts/error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,cAAM,YAAa,SAAQ,KAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;IAQD,IAAI,OAAO,WAEV;IAED,IAAI,OAAO,QAEV;IAED,IAAI,SAAS,WAEZ;IAED,IAAI,OAAO,WAEV;CACF;AAED,cAAM,8BAA+B,SAAQ,YAAY;gBAC3C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,8BAA+B,SAAQ,YAAY;gBAC3C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,4BAA6B,SAAQ,YAAY;gBACzC,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,uCAAwC,SAAQ,YAAY;gBACpD,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOF;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAC/C,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAEzD,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAQnE;AAED,cAAM,qCAAsC,SAAQ,YAAY;gBAE5D,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOJ;AAED,cAAM,mCAAoC,SAAQ,YAAY;gBAChD,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAOF;AAED,cAAM,mCAAoC,SAAQ,YAAY;gBAE1D,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAQnE;AAED,cAAM,2BAA4B,SAAQ,YAAY;gBAElD,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAOnE;AAED,cAAM,kCAAmC,SAAQ,YAAY;gBAEzD,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAOnE;AAED,cAAM,wBAAyB,SAAQ,YAAY;gBACrC,MAAM,CAAC,EAAE;QACnB,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAMF;AAED,cAAM,uCAAwC,SAAQ,YAAY;gBAE9D,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAOnE;AAED,cAAM,6BAA8B,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM;CAK5B;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,IAAI,YAAY,CAE3D;AAmBD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,uCAAuC,EACvC,kCAAkC,EAClC,kCAAkC,EAClC,qCAAqC,EACrC,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,EACxB,uCAAuC,GACxC,CAAA"}

package/dist/src/accounts/error.js

@@ -121,6 +121,14 @@ class OwnersFieldRequiredError extends AccountError {
         });
     }
 }
+class PasskeyConfigurationNotInstallableError extends AccountError {
+    constructor(reason, params) {
+        super({
+            message: `Passkey owner set cannot be installed on a new account: ${reason}`,
+            ...params,
+        });
+    }
+}
 class Eip712DomainNotAvailableError extends AccountError {
     constructor(message) {
         super({
@@ -147,4 +155,4 @@ function getAccountName(account) {
             return 'EOA';
     }
 }
-export { isAccountError, AccountError, Eip712DomainNotAvailableError, Eip7702AccountMustHaveEoaError, EoaAccountMustHaveAccountError, FactoryArgsNotAvailableError, DefaultValidatorAlreadyInitializedError, SigningNotSupportedForAccountError, Eip7702NotSupportedForAccountError, AccountConfigurationNotSupportedError, WalletClientNoConnectedAccountError, ModuleInstallationNotSupportedError, EoaSigningNotSupportedError, EoaSigningMethodNotConfiguredError, OwnersFieldRequiredError, };
+export { isAccountError, AccountError, Eip712DomainNotAvailableError, Eip7702AccountMustHaveEoaError, EoaAccountMustHaveAccountError, FactoryArgsNotAvailableError, DefaultValidatorAlreadyInitializedError, SigningNotSupportedForAccountError, Eip7702NotSupportedForAccountError, AccountConfigurationNotSupportedError, WalletClientNoConnectedAccountError, ModuleInstallationNotSupportedError, EoaSigningNotSupportedError, EoaSigningMethodNotConfiguredError, OwnersFieldRequiredError, PasskeyConfigurationNotInstallableError, };

package/dist/src/accounts/passkey-install.d.ts

@@ -0,0 +1,25 @@
+import { type Address, type Hex } from 'viem';
+import { type WebauthnInstallCredential } from '../modules/validators/webauthn.js';
+import type { AccountDefinition } from './types.js';
+export declare const MAX_DEPLOYMENT_PASSKEYS = 6;
+export declare const MAX_PASSKEY_CREDENTIALS = 32;
+export declare const MAX_PASSKEY_SALT_ATTEMPTS = 65536;
+export declare function accountSupportsSaltSearch(account: AccountDefinition): boolean;
+export declare function accountWithSaltAttempt(account: AccountDefinition, attempt: number): AccountDefinition;
+export declare function assertPasskeySetInstallable(input: {
+    readonly credentials: readonly WebauthnInstallCredential[];
+    readonly atDeployment: boolean;
+}): void;
+/**
+ * Picks the account salt whose derived address makes the (canonically ordered)
+ * passkey set installable. Deterministic: the same inputs select the same salt
+ * on every host and in every run.
+ */
+export declare function selectPasskeyAccount(input: {
+    readonly account: AccountDefinition;
+    readonly credentials: readonly WebauthnInstallCredential[];
+    readonly fingerprint: Hex;
+    readonly deriveAddress: (account: AccountDefinition) => Address;
+    readonly maxAttempts?: number;
+}): AccountDefinition;
+//# sourceMappingURL=passkey-install.d.ts.map

package/dist/src/accounts/passkey-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-install.d.ts","sourceRoot":"","sources":["../../../accounts/passkey-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAuB,KAAK,GAAG,EAAa,MAAM,MAAM,CAAA;AAC7E,OAAO,EAEL,KAAK,yBAAyB,EAE/B,MAAM,gCAAgC,CAAA;AASvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAOhD,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAGzC,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAK/C,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAO7E;AAaD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,MAAM,GACd,iBAAiB,CA2DnB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC1D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;CAC/B,GAAG,IAAI,CAmBP;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC1D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAA;IAG/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B,GAAG,iBAAiB,CAgBpB"}

package/dist/src/accounts/passkey-install.js

@@ -0,0 +1,105 @@
+import { encodeAbiParameters, keccak256 } from 'viem';
+import { hasDuplicateWebauthnCredentials, webauthnCredentialsAreAscending, } from '../modules/validators/webauthn.js';
+import { KERNEL_SALT_DEFAULTS, NEXUS_SALT_DEFAULTS, SAFE_NONCE_DEFAULTS, STARTALE_SALT_DEFAULTS, selectedValue, } from './deployment.js';
+import { PasskeyConfigurationNotInstallableError } from './error.js';
+// The validator's install data must list credentials with strictly ascending
+// `keccak(x, y, account)`, so the number of salts that have to be tried grows
+// with the factorial of the credential count. Six passkeys is ~0.2s of
+// synchronous work in the worst realistic case; beyond that the remaining
+// passkeys are added after deployment, which the validator accepts in any order.
+export const MAX_DEPLOYMENT_PASSKEYS = 6;
+// The validator's own `MAX_CREDENTIALS`.
+export const MAX_PASSKEY_CREDENTIALS = 32;
+// A fixed attempt count, never a wall-clock budget: a slower host must derive
+// the same address as a faster one.
+export const MAX_PASSKEY_SALT_ATTEMPTS = 65_536;
+const MEMO_LIMIT = 256;
+const memo = new Map();
+export function accountSupportsSaltSearch(account) {
+    return (account.kind === 'nexus' ||
+        account.kind === 'kernel' ||
+        account.kind === 'startale' ||
+        account.kind === 'safe');
+}
+function saltAttempt(base, attempt) {
+    return keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'uint256' }], [base, BigInt(attempt)]));
+}
+// Attempt 0 is the caller's own salt, so a configuration that already installs
+// cleanly keeps the address it derives today.
+export function accountWithSaltAttempt(account, attempt) {
+    if (attempt === 0)
+        return account;
+    switch (account.kind) {
+        case 'nexus':
+            return {
+                ...account,
+                salt: {
+                    source: 'explicit',
+                    value: saltAttempt(selectedValue(account.salt, NEXUS_SALT_DEFAULTS), attempt),
+                },
+            };
+        case 'kernel':
+            return {
+                ...account,
+                salt: {
+                    source: 'explicit',
+                    value: saltAttempt(selectedValue(account.salt, KERNEL_SALT_DEFAULTS), attempt),
+                },
+            };
+        case 'startale':
+            return {
+                ...account,
+                salt: {
+                    source: 'explicit',
+                    value: saltAttempt(selectedValue(account.salt, STARTALE_SALT_DEFAULTS), attempt),
+                },
+            };
+        case 'safe': {
+            const nonce = selectedValue(account.nonce, SAFE_NONCE_DEFAULTS);
+            return {
+                ...account,
+                nonce: {
+                    source: 'explicit',
+                    value: BigInt(keccak256(encodeAbiParameters([{ type: 'uint256' }, { type: 'uint256' }], [nonce, BigInt(attempt)]))),
+                },
+            };
+        }
+        case 'hca':
+        case 'eoa':
+            throw new PasskeyConfigurationNotInstallableError(`${account.kind} accounts have no salt to search`);
+    }
+}
+export function assertPasskeySetInstallable(input) {
+    if (hasDuplicateWebauthnCredentials(input.credentials)) {
+        throw new PasskeyConfigurationNotInstallableError('the owner set contains duplicate passkeys');
+    }
+    if (input.credentials.length > MAX_PASSKEY_CREDENTIALS) {
+        throw new PasskeyConfigurationNotInstallableError(`the WebAuthn validator supports at most ${MAX_PASSKEY_CREDENTIALS} passkeys, received ${input.credentials.length}`);
+    }
+    if (input.atDeployment &&
+        input.credentials.length > MAX_DEPLOYMENT_PASSKEYS) {
+        throw new PasskeyConfigurationNotInstallableError(`at most ${MAX_DEPLOYMENT_PASSKEYS} passkeys can be installed at deployment, received ${input.credentials.length}. Deploy with ${MAX_DEPLOYMENT_PASSKEYS} or fewer and add the rest with \`passkeys.addOwner\``);
+    }
+}
+/**
+ * Picks the account salt whose derived address makes the (canonically ordered)
+ * passkey set installable. Deterministic: the same inputs select the same salt
+ * on every host and in every run.
+ */
+export function selectPasskeyAccount(input) {
+    const cached = memo.get(input.fingerprint);
+    if (cached)
+        return cached;
+    const maxAttempts = input.maxAttempts ?? MAX_PASSKEY_SALT_ATTEMPTS;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const candidate = accountWithSaltAttempt(input.account, attempt);
+        const address = input.deriveAddress(candidate);
+        if (webauthnCredentialsAreAscending(input.credentials, address)) {
+            if (memo.size >= MEMO_LIMIT)
+                memo.clear();
+            memo.set(input.fingerprint, candidate);
+            return candidate;
+        }
+    }
+    throw new PasskeyConfigurationNotInstallableError(`no account salt in ${maxAttempts} attempts installs these ${input.credentials.length} passkeys. Deploy with fewer passkeys and add the rest with \`passkeys.addOwner\``);
+}

package/dist/src/api/direct-signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"direct-signing.d.ts","sourceRoot":"","sources":["../../../api/direct-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,GAAG,EAGR,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAIxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAA;AAa1F,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAA;CAC5C;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,mBAAmB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACjE,OAAO,CAAC;IACT,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CA4ED;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,GACvE,OAAO,CAAC;IACT,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAyDD"}
+{"version":3,"file":"direct-signing.d.ts","sourceRoot":"","sources":["../../../api/direct-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,GAAG,EAIR,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAIxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAA;AAa1F,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAA;CAC5C;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,mBAAmB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACjE,OAAO,CAAC;IACT,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CAwDD;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,GACvE,OAAO,CAAC;IACT,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC,CAAC,CA0DD"}