@thru/passkey 0.2.14 → 0.2.16

package/dist/server.cjs

@@ -81,6 +81,14 @@ function maskForBits(bits) {
 }
 
 // src/server/utils.ts
+var feePayerQueueSymbol = /* @__PURE__ */ Symbol.for("thru.sharedFeePayerQueues");
+function getFeePayerQueues() {
+  const globalQueues = globalThis;
+  if (!globalQueues[feePayerQueueSymbol]) {
+    globalQueues[feePayerQueueSymbol] = /* @__PURE__ */ new Map();
+  }
+  return globalQueues[feePayerQueueSymbol];
+}
 async function getStateProof(client, address, proofType = 1, targetSlot) {
   const proofRequest = {
     address,
@@ -97,21 +105,29 @@ async function getStateProof(client, address, proofType = 1, targetSlot) {
 }
 async function trackTransaction(client, signature, timeoutMs = 5e3) {
   try {
+    let finalizedSeen = false;
     for await (const update of client.transactions.track(signature, { timeoutMs })) {
       if (update.executionResult) {
+        const vmError = update.executionResult.vmError !== void 0 && update.executionResult.vmError !== null ? BigInt(update.executionResult.vmError) : 0n;
+        const userErrorCode = update.executionResult.userErrorCode;
+        const executionError = update.executionResult.executionResult !== void 0 && update.executionResult.executionResult !== null ? BigInt(update.executionResult.executionResult) : 0n;
+        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;
         return {
           signature,
-          status: update.executionResult.userErrorCode === 0n ? "finalized" : "failed",
-          errorCode: update.executionResult.userErrorCode
+          status: success ? "finalized" : "failed",
+          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode
         };
       }
       if (update.statusCode === 3) {
-        return {
-          signature,
-          status: "finalized"
-        };
+        finalizedSeen = true;
       }
     }
+    if (finalizedSeen) {
+      return {
+        signature,
+        status: "finalized_without_execution"
+      };
+    }
   } catch {
     return {
       signature,
@@ -126,6 +142,26 @@ async function trackTransaction(client, signature, timeoutMs = 5e3) {
 function toThruAddress(bytes) {
   return encodeAddress(bytes);
 }
+async function withSerializedFeePayer(feePayerPublicKey, work) {
+  const queueKey = toThruAddress(feePayerPublicKey);
+  const feePayerQueues = getFeePayerQueues();
+  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve) => {
+    release = resolve;
+  });
+  const tail = previous.then(() => current);
+  feePayerQueues.set(queueKey, tail);
+  await previous;
+  try {
+    return await work();
+  } finally {
+    release();
+    if (feePayerQueues.get(queueKey) === tail) {
+      feePayerQueues.delete(queueKey);
+    }
+  }
+}
 
 // src/server/create-wallet.ts
 async function createPasskeyWallet(opts) {
@@ -133,14 +169,15 @@ async function createPasskeyWallet(opts) {
   const seed = await (0, import_passkey_manager.createWalletSeed)(walletName, opts.pubkeyX, opts.pubkeyY);
   const walletBytes = await (0, import_passkey_manager.deriveWalletAddress)(seed, import_passkey_manager.PASSKEY_MANAGER_PROGRAM_ADDRESS);
   const walletAddress = toThruAddress(walletBytes);
-  let walletExists = false;
-  try {
-    await opts.client.accounts.get(walletAddress);
-    walletExists = true;
-  } catch {
-    walletExists = false;
-  }
-  if (!walletExists) {
+  await withSerializedFeePayer(opts.adminPublicKey, async () => {
+    let walletExists = false;
+    try {
+      await opts.client.accounts.get(walletAddress);
+      walletExists = true;
+    } catch {
+      walletExists = false;
+    }
+    if (walletExists) return;
     const stateProof = await getStateProof(opts.client, walletAddress);
     const accountCtx = (0, import_passkey_manager.buildAccountContext)({
       walletAddress,
@@ -174,10 +211,10 @@ async function createPasskeyWallet(opts) {
     const result = await trackTransaction(opts.client, signature, 6e4);
     if (result.status !== "finalized") {
       throw new Error(
-        `Wallet creation failed with error code: ${result.errorCode ?? "unknown"}`
+        `Wallet creation failed with status: ${result.status}${result.errorCode !== void 0 ? ` (error code: ${result.errorCode})` : ""}`
       );
     }
-  }
+  });
   let credentialLookupAddress;
   if (opts.credentialId) {
     const credentialIdBytes = (0, import_passkey_manager.base64UrlToBytes)(opts.credentialId);
@@ -186,18 +223,20 @@ async function createPasskeyWallet(opts) {
       walletName,
       import_passkey_manager.PASSKEY_MANAGER_PROGRAM_ADDRESS
     );
-    credentialLookupAddress = toThruAddress(lookupAddressBytes);
-    let lookupExists = false;
+    const lookupAddress = toThruAddress(lookupAddressBytes);
+    credentialLookupAddress = lookupAddress;
     try {
-      await opts.client.accounts.get(credentialLookupAddress);
-      lookupExists = true;
-    } catch {
-      lookupExists = false;
-    }
-    if (!lookupExists) {
-      try {
+      await withSerializedFeePayer(opts.adminPublicKey, async () => {
+        let lookupExists = false;
+        try {
+          await opts.client.accounts.get(lookupAddress);
+          lookupExists = true;
+        } catch {
+          lookupExists = false;
+        }
+        if (lookupExists) return;
         const credSeed = await (0, import_passkey_manager.createCredentialLookupSeed)(credentialIdBytes, walletName);
-        const stateProof = await getStateProof(opts.client, credentialLookupAddress);
+        const stateProof = await getStateProof(opts.client, lookupAddress);
         const accountCtx = (0, import_passkey_manager.buildAccountContext)({
           walletAddress,
           readWriteAccounts: [lookupAddressBytes],
@@ -216,7 +255,7 @@ async function createPasskeyWallet(opts) {
           program: import_passkey_manager.PASSKEY_MANAGER_PROGRAM_ADDRESS,
           instructionData: registerIx,
           accounts: {
-            readWrite: [walletAddress, credentialLookupAddress],
+            readWrite: [walletAddress, lookupAddress],
             readOnly: []
           },
           header: { fee: 0n }
@@ -229,9 +268,9 @@ async function createPasskeyWallet(opts) {
             `Credential registration failed with status: ${result.status}${result.errorCode !== void 0 ? ` (error code: ${result.errorCode})` : ""}`
           );
         }
-      } catch (error) {
-        console.warn("Credential registration failed (non-fatal):", error);
-      }
+      });
+    } catch (error) {
+      console.warn("Credential registration failed (non-fatal):", error);
     }
   }
   return {
@@ -258,28 +297,30 @@ async function createPasskeyChallenge(opts) {
 // src/server/submit.ts
 var import_passkey_manager3 = require("@thru/passkey-manager");
 async function submitPasskeyTransaction(opts) {
-  const validateIx = (0, import_passkey_manager3.encodeValidateInstruction)({
-    walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
-    signatureR: (0, import_passkey_manager3.hexToBytes)(opts.signatureR),
-    signatureS: (0, import_passkey_manager3.hexToBytes)(opts.signatureS),
-    authenticatorData: Buffer.from(opts.authenticatorData, "base64"),
-    clientDataJSON: Buffer.from(opts.clientDataJSON, "base64")
-  });
-  const instructionData = (0, import_passkey_manager3.concatenateInstructions)([validateIx, opts.invokeIx]);
-  const transaction = await opts.client.transactions.build({
-    feePayer: { publicKey: opts.adminPublicKey },
-    program: import_passkey_manager3.PASSKEY_MANAGER_PROGRAM_ADDRESS,
-    instructionData,
-    accounts: {
-      readWrite: opts.accountCtx.readWriteAddresses,
-      readOnly: opts.accountCtx.readOnlyAddresses
-    },
-    header: { fee: 0n }
+  return withSerializedFeePayer(opts.adminPublicKey, async () => {
+    const validateIx = (0, import_passkey_manager3.encodeValidateInstruction)({
+      walletAccountIdx: opts.accountCtx.walletAccountIdx,
+      authIdx: 0,
+      signatureR: (0, import_passkey_manager3.hexToBytes)(opts.signatureR),
+      signatureS: (0, import_passkey_manager3.hexToBytes)(opts.signatureS),
+      authenticatorData: Buffer.from(opts.authenticatorData, "base64"),
+      clientDataJSON: Buffer.from(opts.clientDataJSON, "base64")
+    });
+    const instructionData = (0, import_passkey_manager3.concatenateInstructions)([validateIx, opts.invokeIx]);
+    const transaction = await opts.client.transactions.build({
+      feePayer: { publicKey: opts.adminPublicKey },
+      program: import_passkey_manager3.PASSKEY_MANAGER_PROGRAM_ADDRESS,
+      instructionData,
+      accounts: {
+        readWrite: opts.accountCtx.readWriteAddresses,
+        readOnly: opts.accountCtx.readOnlyAddresses
+      },
+      header: { fee: 0n }
+    });
+    await transaction.sign(opts.adminPrivateKey);
+    const signature = await opts.client.transactions.send(transaction.toWire());
+    return trackTransaction(opts.client, signature);
   });
-  await transaction.sign(opts.adminPrivateKey);
-  const signature = await opts.client.transactions.send(transaction.toWire());
-  return trackTransaction(opts.client, signature);
 }
 
 // src/server/handlers.ts

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/index.ts","../src/server/create-wallet.ts","../../helpers/src/constants.ts","../../helpers/src/address.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["export type {\n  ThruClient,\n  PasskeySignaturePayload,\n  PasskeyChallengeSubmitPayload,\n  TransactionResult,\n  PasskeyChallengeResult,\n  PasskeyContextResult,\n} from './types';\n\nexport { createPasskeyWallet } from './create-wallet';\nexport { createPasskeyChallenge } from './challenge';\nexport { submitPasskeyTransaction } from './submit';\nexport { createPasskeyHandlers } from './handlers';\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/passkey-manager';\nimport { toThruAddress, getStateProof, trackTransaction } from './utils';\nimport type { ThruClient } from './types';\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? 'default';\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);\n  const walletAddress = toThruAddress(walletBytes);\n\n  let walletExists = false;\n  try {\n    await opts.client.accounts.get(walletAddress);\n    walletExists = true;\n  } catch {\n    walletExists = false;\n  }\n\n  if (!walletExists) {\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: [walletAddress],\n        readOnly: [],\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== 'finalized') {\n      throw new Error(\n        `Wallet creation failed with error code: ${result.errorCode ?? 'unknown'}`\n      );\n    }\n  }\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      walletName,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS\n    );\n\n    credentialLookupAddress = toThruAddress(lookupAddressBytes);\n\n    let lookupExists = false;\n    try {\n      await opts.client.accounts.get(credentialLookupAddress);\n      lookupExists = true;\n    } catch {\n      lookupExists = false;\n    }\n\n    if (!lookupExists) {\n      try {\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);\n        const stateProof = await getStateProof(opts.client, credentialLookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: [walletAddress, credentialLookupAddress],\n            readOnly: [],\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(transaction.toWire());\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== 'finalized') {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n            }`\n          );\n        }\n      } catch (error) {\n        console.warn('Credential registration failed (non-fatal):', error);\n      }\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","export const BASE64_URL_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst tempMap = new Int16Array(256).fill(-1);\nfor (let i = 0; i < BASE64_URL_ALPHABET.length; i++) {\n    tempMap[BASE64_URL_ALPHABET.charCodeAt(i)] = i;\n}\nexport const BASE64_URL_MAP = tempMap\n\n","import { BASE64_URL_ALPHABET, BASE64_URL_MAP } from \"./constants\";\n\nexport function encodeAddress(bytes: Uint8Array): string {\n  if (bytes.length !== 32) {\n    throw new Error('Expected 32-byte address');\n  }\n\n  let checksum = 0;\n  let accumulator = 0;\n  let bitsCollected = 0;\n  const output: string[] = ['t', 'a'];\n\n  for (let i = 0; i < 30; i++) {\n    const byte = bytes[i];\n    checksum += byte;\n    accumulator = ((accumulator << 8) | byte) >>> 0;\n    bitsCollected += 8;\n    while (bitsCollected >= 6) {\n      const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n      output.push(BASE64_URL_ALPHABET[index]);\n      bitsCollected -= 6;\n      accumulator &= maskForBits(bitsCollected);\n    }\n  }\n\n  const secondLast = bytes[30];\n  checksum += secondLast;\n  accumulator = ((accumulator << 8) | secondLast) >>> 0;\n  bitsCollected += 8;\n\n  const last = bytes[31];\n  checksum += last;\n  accumulator = ((accumulator << 8) | last) >>> 0;\n  bitsCollected += 8;\n\n  accumulator = ((accumulator << 8) | (checksum & 0xff)) >>> 0;\n  bitsCollected += 8;\n\n  while (bitsCollected >= 6) {\n    const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n    output.push(BASE64_URL_ALPHABET[index]);\n    bitsCollected -= 6;\n    accumulator &= maskForBits(bitsCollected);\n  }\n\n  return output.join('');\n}\n\nexport function decodeAddress(value: string): Uint8Array {\n  if (value.length !== 46) {\n    throw new Error('Invalid address length');\n  }\n  if (!value.startsWith('ta')) {\n    throw new Error('Address must start with \"ta\"');\n  }\n\n  const output = new Uint8Array(32);\n  let checksum = 0;\n  let inIdx = 2;\n  let remaining = 40;\n  let outIdx = 0;\n\n  while (remaining >= 4) {\n    const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n    const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n    const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n    const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n    if (a < 0 || b < 0 || c < 0 || d < 0) {\n      throw new Error('Invalid address encoding');\n    }\n    const triple = (a << 18) | (b << 12) | (c << 6) | d;\n    const byte1 = (triple >> 16) & 0xff;\n    const byte2 = (triple >> 8) & 0xff;\n    const byte3 = triple & 0xff;\n    checksum += byte1;\n    checksum += byte2;\n    checksum += byte3;\n    output[outIdx++] = byte1;\n    output[outIdx++] = byte2;\n    output[outIdx++] = byte3;\n    inIdx += 4;\n    remaining -= 4;\n  }\n\n  const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n  const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n  const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n  const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n  if (a < 0 || b < 0 || c < 0 || d < 0) {\n    throw new Error('Invalid address encoding');\n  }\n  const triple = (a << 18) | (b << 12) | (c << 6) | d;\n  const byte1 = (triple >> 16) & 0xff;\n  const byte2 = (triple >> 8) & 0xff;\n  const incomingChecksum = triple & 0xff;\n\n  checksum += byte1;\n  checksum += byte2;\n  output[outIdx++] = byte1;\n  output[outIdx++] = byte2;\n\n  checksum &= 0xff;\n  if (checksum !== incomingChecksum) {\n    throw new Error('Address checksum mismatch');\n  }\n\n  return output;\n}\n\nfunction maskForBits(bits: number): number {\n  return bits === 0 ? 0 : (1 << bits) - 1;\n}\n","import { encodeAddress } from '@thru/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        return {\n          signature,\n          status: update.executionResult.userErrorCode === 0n ? 'finalized' : 'failed',\n          errorCode: update.executionResult.userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        return {\n          signature,\n          status: 'finalized',\n        };\n      }\n    }\n  } catch {\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport { trackTransaction } from './utils';\nimport type {\n  PasskeySignaturePayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: 0,\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),\n    clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),\n  });\n\n  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: { fee: 0n },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  const signature = await opts.client.transactions.send(transaction.toWire());\n  return trackTransaction(opts.client, signature);\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,6BAUO;;;ACVA,IAAM,sBAAsB;AAEnC,IAAM,UAAU,IAAI,WAAW,GAAG,EAAE,KAAK,EAAE;AAC3C,SAAS,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;AACjD,UAAQ,oBAAoB,WAAW,CAAC,CAAC,IAAI;AACjD;;;ACHO,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM,WAAW,IAAI;AACvB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,MAAI,gBAAgB;AACpB,QAAM,SAAmB,CAAC,KAAK,GAAG;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,gBAAY;AACZ,mBAAgB,eAAe,IAAK,UAAU;AAC9C,qBAAiB;AACjB,WAAO,iBAAiB,GAAG;AACzB,YAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,aAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,uBAAiB;AACjB,qBAAe,YAAY,aAAa;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,aAAa,MAAM,EAAE;AAC3B,cAAY;AACZ,iBAAgB,eAAe,IAAK,gBAAgB;AACpD,mBAAiB;AAEjB,QAAM,OAAO,MAAM,EAAE;AACrB,cAAY;AACZ,iBAAgB,eAAe,IAAK,UAAU;AAC9C,mBAAiB;AAEjB,iBAAgB,eAAe,IAAM,WAAW,SAAW;AAC3D,mBAAiB;AAEjB,SAAO,iBAAiB,GAAG;AACzB,UAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,WAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,qBAAiB;AACjB,mBAAe,YAAY,aAAa;AAAA,EAC1C;AAEA,SAAO,OAAO,KAAK,EAAE;AACvB;AA+DA,SAAS,YAAY,MAAsB;AACzC,SAAO,SAAS,IAAI,KAAK,KAAK,QAAQ;AACxC;;;AC5GA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,gBAAgB,kBAAkB,KAAK,cAAc;AAAA,UACpE,WAAW,OAAO,gBAAgB;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;;;AHtDA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,UAAM,yCAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,UAAM,4CAAoB,MAAM,sDAA+B;AACnF,QAAM,gBAAgB,cAAc,WAAW;AAE/C,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,mBAAe;AAAA,EACjB,QAAQ;AACN,mBAAe;AAAA,EACjB;AAEA,MAAI,CAAC,cAAc;AACjB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,iBAAa,4CAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,eAAW,gDAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,CAAC,aAAa;AAAA,QACzB,UAAU,CAAC;AAAA,MACb;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,2CAA2C,OAAO,aAAa,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,wBAAoB,yCAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,UAAM;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,8BAA0B,cAAc,kBAAkB;AAE1D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,uBAAuB;AACtD,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,CAAC,cAAc;AACjB,UAAI;AACF,cAAM,WAAW,UAAM,mDAA2B,mBAAmB,UAAU;AAC/E,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,uBAAuB;AAC3E,cAAM,iBAAa,4CAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,iBAAa,4DAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,CAAC,eAAe,uBAAuB;AAAA,YAClD,UAAU,CAAC;AAAA,UACb;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,gBAAQ,KAAK,+CAA+C,KAAK;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AIpJA,IAAAA,0BAIO;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,UAAM,0CAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,UAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,eAAW,0CAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA,IAAAC,0BAKO;AASP,eAAsB,yBAAyB,MAOU;AACvD,QAAM,iBAAa,mDAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS;AAAA,IACT,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,OAAO,KAAK,KAAK,mBAAmB,QAAQ;AAAA,IAC/D,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,QAAQ;AAAA,EAC3D,CAAC;AAED,QAAM,sBAAkB,iDAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAAS;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ,EAAE,KAAK,GAAG;AAAA,EACpB,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,QAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,SAAO,iBAAiB,KAAK,QAAQ,SAAS;AAChD;;;ACrCO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["import_passkey_manager","import_passkey_manager"]}
+{"version":3,"sources":["../src/server/index.ts","../src/server/create-wallet.ts","../../helpers/src/constants.ts","../../helpers/src/address.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["export type {\n  ThruClient,\n  PasskeySignaturePayload,\n  PasskeyChallengeSubmitPayload,\n  TransactionResult,\n  PasskeyChallengeResult,\n  PasskeyContextResult,\n} from './types';\n\nexport { createPasskeyWallet } from './create-wallet';\nexport { createPasskeyChallenge } from './challenge';\nexport { submitPasskeyTransaction } from './submit';\nexport { createPasskeyHandlers } from './handlers';\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from './utils';\nimport type { ThruClient } from './types';\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? 'default';\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: [walletAddress],\n        readOnly: [],\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== 'finalized') {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n        }`\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      walletName,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: [walletAddress, lookupAddress],\n            readOnly: [],\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(transaction.toWire());\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== 'finalized') {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n            }`\n          );\n        }\n      });\n    } catch (error) {\n      console.warn('Credential registration failed (non-fatal):', error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","export const BASE64_URL_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst tempMap = new Int16Array(256).fill(-1);\nfor (let i = 0; i < BASE64_URL_ALPHABET.length; i++) {\n    tempMap[BASE64_URL_ALPHABET.charCodeAt(i)] = i;\n}\nexport const BASE64_URL_MAP = tempMap\n\n","import { BASE64_URL_ALPHABET, BASE64_URL_MAP } from \"./constants\";\n\nexport function encodeAddress(bytes: Uint8Array): string {\n  if (bytes.length !== 32) {\n    throw new Error('Expected 32-byte address');\n  }\n\n  let checksum = 0;\n  let accumulator = 0;\n  let bitsCollected = 0;\n  const output: string[] = ['t', 'a'];\n\n  for (let i = 0; i < 30; i++) {\n    const byte = bytes[i];\n    checksum += byte;\n    accumulator = ((accumulator << 8) | byte) >>> 0;\n    bitsCollected += 8;\n    while (bitsCollected >= 6) {\n      const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n      output.push(BASE64_URL_ALPHABET[index]);\n      bitsCollected -= 6;\n      accumulator &= maskForBits(bitsCollected);\n    }\n  }\n\n  const secondLast = bytes[30];\n  checksum += secondLast;\n  accumulator = ((accumulator << 8) | secondLast) >>> 0;\n  bitsCollected += 8;\n\n  const last = bytes[31];\n  checksum += last;\n  accumulator = ((accumulator << 8) | last) >>> 0;\n  bitsCollected += 8;\n\n  accumulator = ((accumulator << 8) | (checksum & 0xff)) >>> 0;\n  bitsCollected += 8;\n\n  while (bitsCollected >= 6) {\n    const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n    output.push(BASE64_URL_ALPHABET[index]);\n    bitsCollected -= 6;\n    accumulator &= maskForBits(bitsCollected);\n  }\n\n  return output.join('');\n}\n\nexport function decodeAddress(value: string): Uint8Array {\n  if (value.length !== 46) {\n    throw new Error('Invalid address length');\n  }\n  if (!value.startsWith('ta')) {\n    throw new Error('Address must start with \"ta\"');\n  }\n\n  const output = new Uint8Array(32);\n  let checksum = 0;\n  let inIdx = 2;\n  let remaining = 40;\n  let outIdx = 0;\n\n  while (remaining >= 4) {\n    const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n    const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n    const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n    const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n    if (a < 0 || b < 0 || c < 0 || d < 0) {\n      throw new Error('Invalid address encoding');\n    }\n    const triple = (a << 18) | (b << 12) | (c << 6) | d;\n    const byte1 = (triple >> 16) & 0xff;\n    const byte2 = (triple >> 8) & 0xff;\n    const byte3 = triple & 0xff;\n    checksum += byte1;\n    checksum += byte2;\n    checksum += byte3;\n    output[outIdx++] = byte1;\n    output[outIdx++] = byte2;\n    output[outIdx++] = byte3;\n    inIdx += 4;\n    remaining -= 4;\n  }\n\n  const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n  const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n  const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n  const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n  if (a < 0 || b < 0 || c < 0 || d < 0) {\n    throw new Error('Invalid address encoding');\n  }\n  const triple = (a << 18) | (b << 12) | (c << 6) | d;\n  const byte1 = (triple >> 16) & 0xff;\n  const byte2 = (triple >> 8) & 0xff;\n  const incomingChecksum = triple & 0xff;\n\n  checksum += byte1;\n  checksum += byte2;\n  output[outIdx++] = byte1;\n  output[outIdx++] = byte2;\n\n  checksum &= 0xff;\n  if (checksum !== incomingChecksum) {\n    throw new Error('Address checksum mismatch');\n  }\n\n  return output;\n}\n\nfunction maskForBits(bits: number): number {\n  return bits === 0 ? 0 : (1 << bits) - 1;\n}\n","import { encodeAddress } from '@thru/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  try {\n    let finalizedSeen = false;\n\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  PasskeySignaturePayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const validateIx = encodeValidateInstruction({\n      walletAccountIdx: opts.accountCtx.walletAccountIdx,\n      authIdx: 0,\n      signatureR: hexToBytes(opts.signatureR),\n      signatureS: hexToBytes(opts.signatureS),\n      authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),\n      clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),\n    });\n\n    const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData,\n      accounts: {\n        readWrite: opts.accountCtx.readWriteAddresses,\n        readOnly: opts.accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,6BAUO;;;ACVA,IAAM,sBAAsB;AAEnC,IAAM,UAAU,IAAI,WAAW,GAAG,EAAE,KAAK,EAAE;AAC3C,SAAS,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;AACjD,UAAQ,oBAAoB,WAAW,CAAC,CAAC,IAAI;AACjD;;;ACHO,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM,WAAW,IAAI;AACvB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,MAAI,gBAAgB;AACpB,QAAM,SAAmB,CAAC,KAAK,GAAG;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,gBAAY;AACZ,mBAAgB,eAAe,IAAK,UAAU;AAC9C,qBAAiB;AACjB,WAAO,iBAAiB,GAAG;AACzB,YAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,aAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,uBAAiB;AACjB,qBAAe,YAAY,aAAa;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,aAAa,MAAM,EAAE;AAC3B,cAAY;AACZ,iBAAgB,eAAe,IAAK,gBAAgB;AACpD,mBAAiB;AAEjB,QAAM,OAAO,MAAM,EAAE;AACrB,cAAY;AACZ,iBAAgB,eAAe,IAAK,UAAU;AAC9C,mBAAiB;AAEjB,iBAAgB,eAAe,IAAM,WAAW,SAAW;AAC3D,mBAAiB;AAEjB,SAAO,iBAAiB,GAAG;AACzB,UAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,WAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,qBAAiB;AACjB,mBAAe,YAAY,aAAa;AAAA,EAC1C;AAEA,SAAO,OAAO,KAAK,EAAE;AACvB;AA+DA,SAAS,YAAY,MAAsB;AACzC,SAAO,SAAS,IAAI,KAAK,KAAK,QAAQ;AACxC;;;AC5GA,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI;AACF,QAAI,gBAAgB;AAEpB,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;AH3GA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,UAAM,yCAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,UAAM,4CAAoB,MAAM,sDAA+B;AACnF,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,iBAAa,4CAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,eAAW,gDAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,CAAC,aAAa;AAAA,QACzB,UAAU,CAAC;AAAA,MACb;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,wBAAoB,yCAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,UAAM;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,UAAM,mDAA2B,mBAAmB,UAAU;AAC/E,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,iBAAa,4CAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,iBAAa,4DAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,CAAC,eAAe,aAAa;AAAA,YACxC,UAAU,CAAC;AAAA,UACb;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AIhKA,IAAAA,0BAIO;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,UAAM,0CAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,UAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,eAAW,0CAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA,IAAAC,0BAKO;AASP,eAAsB,yBAAyB,MAOU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,iBAAa,mDAA0B;AAAA,MAC3C,kBAAkB,KAAK,WAAW;AAAA,MAClC,SAAS;AAAA,MACT,gBAAY,oCAAW,KAAK,UAAU;AAAA,MACtC,gBAAY,oCAAW,KAAK,UAAU;AAAA,MACtC,mBAAmB,OAAO,KAAK,KAAK,mBAAmB,QAAQ;AAAA,MAC/D,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,QAAQ;AAAA,IAC3D,CAAC;AAED,UAAM,sBAAkB,iDAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT;AAAA,MACA,UAAU;AAAA,QACR,WAAW,KAAK,WAAW;AAAA,QAC3B,UAAU,KAAK,WAAW;AAAA,MAC5B;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACvCO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["import_passkey_manager","import_passkey_manager"]}

package/dist/server.d.cts

@@ -46,6 +46,8 @@ interface ThruClient {
         }) => AsyncIterable<{
             executionResult?: {
                 userErrorCode: bigint;
+                vmError?: bigint | number | null;
+                executionResult?: bigint | number | null;
             };
             statusCode?: number;
         }>;
@@ -63,7 +65,7 @@ interface PasskeyChallengeSubmitPayload extends PasskeySignaturePayload {
 }
 interface TransactionResult {
     signature: string;
-    status: 'finalized' | 'failed' | 'timeout';
+    status: 'finalized' | 'failed' | 'timeout' | 'finalized_without_execution';
     errorCode?: bigint;
 }
 interface PasskeyChallengeResult {

package/dist/server.d.ts

@@ -46,6 +46,8 @@ interface ThruClient {
         }) => AsyncIterable<{
             executionResult?: {
                 userErrorCode: bigint;
+                vmError?: bigint | number | null;
+                executionResult?: bigint | number | null;
             };
             statusCode?: number;
         }>;
@@ -63,7 +65,7 @@ interface PasskeyChallengeSubmitPayload extends PasskeySignaturePayload {
 }
 interface TransactionResult {
     signature: string;
-    status: 'finalized' | 'failed' | 'timeout';
+    status: 'finalized' | 'failed' | 'timeout' | 'finalized_without_execution';
     errorCode?: bigint;
 }
 interface PasskeyChallengeResult {

package/dist/server.js

@@ -62,6 +62,14 @@ function maskForBits(bits) {
 }
 
 // src/server/utils.ts
+var feePayerQueueSymbol = /* @__PURE__ */ Symbol.for("thru.sharedFeePayerQueues");
+function getFeePayerQueues() {
+  const globalQueues = globalThis;
+  if (!globalQueues[feePayerQueueSymbol]) {
+    globalQueues[feePayerQueueSymbol] = /* @__PURE__ */ new Map();
+  }
+  return globalQueues[feePayerQueueSymbol];
+}
 async function getStateProof(client, address, proofType = 1, targetSlot) {
   const proofRequest = {
     address,
@@ -78,21 +86,29 @@ async function getStateProof(client, address, proofType = 1, targetSlot) {
 }
 async function trackTransaction(client, signature, timeoutMs = 5e3) {
   try {
+    let finalizedSeen = false;
     for await (const update of client.transactions.track(signature, { timeoutMs })) {
       if (update.executionResult) {
+        const vmError = update.executionResult.vmError !== void 0 && update.executionResult.vmError !== null ? BigInt(update.executionResult.vmError) : 0n;
+        const userErrorCode = update.executionResult.userErrorCode;
+        const executionError = update.executionResult.executionResult !== void 0 && update.executionResult.executionResult !== null ? BigInt(update.executionResult.executionResult) : 0n;
+        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;
         return {
           signature,
-          status: update.executionResult.userErrorCode === 0n ? "finalized" : "failed",
-          errorCode: update.executionResult.userErrorCode
+          status: success ? "finalized" : "failed",
+          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode
         };
       }
       if (update.statusCode === 3) {
-        return {
-          signature,
-          status: "finalized"
-        };
+        finalizedSeen = true;
       }
     }
+    if (finalizedSeen) {
+      return {
+        signature,
+        status: "finalized_without_execution"
+      };
+    }
   } catch {
     return {
       signature,
@@ -107,6 +123,26 @@ async function trackTransaction(client, signature, timeoutMs = 5e3) {
 function toThruAddress(bytes) {
   return encodeAddress(bytes);
 }
+async function withSerializedFeePayer(feePayerPublicKey, work) {
+  const queueKey = toThruAddress(feePayerPublicKey);
+  const feePayerQueues = getFeePayerQueues();
+  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve) => {
+    release = resolve;
+  });
+  const tail = previous.then(() => current);
+  feePayerQueues.set(queueKey, tail);
+  await previous;
+  try {
+    return await work();
+  } finally {
+    release();
+    if (feePayerQueues.get(queueKey) === tail) {
+      feePayerQueues.delete(queueKey);
+    }
+  }
+}
 
 // src/server/create-wallet.ts
 async function createPasskeyWallet(opts) {
@@ -114,14 +150,15 @@ async function createPasskeyWallet(opts) {
   const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);
   const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);
   const walletAddress = toThruAddress(walletBytes);
-  let walletExists = false;
-  try {
-    await opts.client.accounts.get(walletAddress);
-    walletExists = true;
-  } catch {
-    walletExists = false;
-  }
-  if (!walletExists) {
+  await withSerializedFeePayer(opts.adminPublicKey, async () => {
+    let walletExists = false;
+    try {
+      await opts.client.accounts.get(walletAddress);
+      walletExists = true;
+    } catch {
+      walletExists = false;
+    }
+    if (walletExists) return;
     const stateProof = await getStateProof(opts.client, walletAddress);
     const accountCtx = buildAccountContext({
       walletAddress,
@@ -155,10 +192,10 @@ async function createPasskeyWallet(opts) {
     const result = await trackTransaction(opts.client, signature, 6e4);
     if (result.status !== "finalized") {
       throw new Error(
-        `Wallet creation failed with error code: ${result.errorCode ?? "unknown"}`
+        `Wallet creation failed with status: ${result.status}${result.errorCode !== void 0 ? ` (error code: ${result.errorCode})` : ""}`
       );
     }
-  }
+  });
   let credentialLookupAddress;
   if (opts.credentialId) {
     const credentialIdBytes = base64UrlToBytes(opts.credentialId);
@@ -167,18 +204,20 @@ async function createPasskeyWallet(opts) {
       walletName,
       PASSKEY_MANAGER_PROGRAM_ADDRESS
     );
-    credentialLookupAddress = toThruAddress(lookupAddressBytes);
-    let lookupExists = false;
+    const lookupAddress = toThruAddress(lookupAddressBytes);
+    credentialLookupAddress = lookupAddress;
     try {
-      await opts.client.accounts.get(credentialLookupAddress);
-      lookupExists = true;
-    } catch {
-      lookupExists = false;
-    }
-    if (!lookupExists) {
-      try {
+      await withSerializedFeePayer(opts.adminPublicKey, async () => {
+        let lookupExists = false;
+        try {
+          await opts.client.accounts.get(lookupAddress);
+          lookupExists = true;
+        } catch {
+          lookupExists = false;
+        }
+        if (lookupExists) return;
         const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);
-        const stateProof = await getStateProof(opts.client, credentialLookupAddress);
+        const stateProof = await getStateProof(opts.client, lookupAddress);
         const accountCtx = buildAccountContext({
           walletAddress,
           readWriteAccounts: [lookupAddressBytes],
@@ -197,7 +236,7 @@ async function createPasskeyWallet(opts) {
           program: PASSKEY_MANAGER_PROGRAM_ADDRESS,
           instructionData: registerIx,
           accounts: {
-            readWrite: [walletAddress, credentialLookupAddress],
+            readWrite: [walletAddress, lookupAddress],
             readOnly: []
           },
           header: { fee: 0n }
@@ -210,9 +249,9 @@ async function createPasskeyWallet(opts) {
             `Credential registration failed with status: ${result.status}${result.errorCode !== void 0 ? ` (error code: ${result.errorCode})` : ""}`
           );
         }
-      } catch (error) {
-        console.warn("Credential registration failed (non-fatal):", error);
-      }
+      });
+    } catch (error) {
+      console.warn("Credential registration failed (non-fatal):", error);
     }
   }
   return {
@@ -248,28 +287,30 @@ import {
   hexToBytes as hexToBytes2
 } from "@thru/passkey-manager";
 async function submitPasskeyTransaction(opts) {
-  const validateIx = encodeValidateInstruction({
-    walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
-    signatureR: hexToBytes2(opts.signatureR),
-    signatureS: hexToBytes2(opts.signatureS),
-    authenticatorData: Buffer.from(opts.authenticatorData, "base64"),
-    clientDataJSON: Buffer.from(opts.clientDataJSON, "base64")
-  });
-  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
-  const transaction = await opts.client.transactions.build({
-    feePayer: { publicKey: opts.adminPublicKey },
-    program: PASSKEY_MANAGER_PROGRAM_ADDRESS2,
-    instructionData,
-    accounts: {
-      readWrite: opts.accountCtx.readWriteAddresses,
-      readOnly: opts.accountCtx.readOnlyAddresses
-    },
-    header: { fee: 0n }
+  return withSerializedFeePayer(opts.adminPublicKey, async () => {
+    const validateIx = encodeValidateInstruction({
+      walletAccountIdx: opts.accountCtx.walletAccountIdx,
+      authIdx: 0,
+      signatureR: hexToBytes2(opts.signatureR),
+      signatureS: hexToBytes2(opts.signatureS),
+      authenticatorData: Buffer.from(opts.authenticatorData, "base64"),
+      clientDataJSON: Buffer.from(opts.clientDataJSON, "base64")
+    });
+    const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
+    const transaction = await opts.client.transactions.build({
+      feePayer: { publicKey: opts.adminPublicKey },
+      program: PASSKEY_MANAGER_PROGRAM_ADDRESS2,
+      instructionData,
+      accounts: {
+        readWrite: opts.accountCtx.readWriteAddresses,
+        readOnly: opts.accountCtx.readOnlyAddresses
+      },
+      header: { fee: 0n }
+    });
+    await transaction.sign(opts.adminPrivateKey);
+    const signature = await opts.client.transactions.send(transaction.toWire());
+    return trackTransaction(opts.client, signature);
   });
-  await transaction.sign(opts.adminPrivateKey);
-  const signature = await opts.client.transactions.send(transaction.toWire());
-  return trackTransaction(opts.client, signature);
 }
 
 // src/server/handlers.ts

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/create-wallet.ts","../../helpers/src/constants.ts","../../helpers/src/address.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/passkey-manager';\nimport { toThruAddress, getStateProof, trackTransaction } from './utils';\nimport type { ThruClient } from './types';\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? 'default';\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);\n  const walletAddress = toThruAddress(walletBytes);\n\n  let walletExists = false;\n  try {\n    await opts.client.accounts.get(walletAddress);\n    walletExists = true;\n  } catch {\n    walletExists = false;\n  }\n\n  if (!walletExists) {\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: [walletAddress],\n        readOnly: [],\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== 'finalized') {\n      throw new Error(\n        `Wallet creation failed with error code: ${result.errorCode ?? 'unknown'}`\n      );\n    }\n  }\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      walletName,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS\n    );\n\n    credentialLookupAddress = toThruAddress(lookupAddressBytes);\n\n    let lookupExists = false;\n    try {\n      await opts.client.accounts.get(credentialLookupAddress);\n      lookupExists = true;\n    } catch {\n      lookupExists = false;\n    }\n\n    if (!lookupExists) {\n      try {\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);\n        const stateProof = await getStateProof(opts.client, credentialLookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: [walletAddress, credentialLookupAddress],\n            readOnly: [],\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(transaction.toWire());\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== 'finalized') {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n            }`\n          );\n        }\n      } catch (error) {\n        console.warn('Credential registration failed (non-fatal):', error);\n      }\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","export const BASE64_URL_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst tempMap = new Int16Array(256).fill(-1);\nfor (let i = 0; i < BASE64_URL_ALPHABET.length; i++) {\n    tempMap[BASE64_URL_ALPHABET.charCodeAt(i)] = i;\n}\nexport const BASE64_URL_MAP = tempMap\n\n","import { BASE64_URL_ALPHABET, BASE64_URL_MAP } from \"./constants\";\n\nexport function encodeAddress(bytes: Uint8Array): string {\n  if (bytes.length !== 32) {\n    throw new Error('Expected 32-byte address');\n  }\n\n  let checksum = 0;\n  let accumulator = 0;\n  let bitsCollected = 0;\n  const output: string[] = ['t', 'a'];\n\n  for (let i = 0; i < 30; i++) {\n    const byte = bytes[i];\n    checksum += byte;\n    accumulator = ((accumulator << 8) | byte) >>> 0;\n    bitsCollected += 8;\n    while (bitsCollected >= 6) {\n      const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n      output.push(BASE64_URL_ALPHABET[index]);\n      bitsCollected -= 6;\n      accumulator &= maskForBits(bitsCollected);\n    }\n  }\n\n  const secondLast = bytes[30];\n  checksum += secondLast;\n  accumulator = ((accumulator << 8) | secondLast) >>> 0;\n  bitsCollected += 8;\n\n  const last = bytes[31];\n  checksum += last;\n  accumulator = ((accumulator << 8) | last) >>> 0;\n  bitsCollected += 8;\n\n  accumulator = ((accumulator << 8) | (checksum & 0xff)) >>> 0;\n  bitsCollected += 8;\n\n  while (bitsCollected >= 6) {\n    const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n    output.push(BASE64_URL_ALPHABET[index]);\n    bitsCollected -= 6;\n    accumulator &= maskForBits(bitsCollected);\n  }\n\n  return output.join('');\n}\n\nexport function decodeAddress(value: string): Uint8Array {\n  if (value.length !== 46) {\n    throw new Error('Invalid address length');\n  }\n  if (!value.startsWith('ta')) {\n    throw new Error('Address must start with \"ta\"');\n  }\n\n  const output = new Uint8Array(32);\n  let checksum = 0;\n  let inIdx = 2;\n  let remaining = 40;\n  let outIdx = 0;\n\n  while (remaining >= 4) {\n    const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n    const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n    const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n    const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n    if (a < 0 || b < 0 || c < 0 || d < 0) {\n      throw new Error('Invalid address encoding');\n    }\n    const triple = (a << 18) | (b << 12) | (c << 6) | d;\n    const byte1 = (triple >> 16) & 0xff;\n    const byte2 = (triple >> 8) & 0xff;\n    const byte3 = triple & 0xff;\n    checksum += byte1;\n    checksum += byte2;\n    checksum += byte3;\n    output[outIdx++] = byte1;\n    output[outIdx++] = byte2;\n    output[outIdx++] = byte3;\n    inIdx += 4;\n    remaining -= 4;\n  }\n\n  const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n  const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n  const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n  const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n  if (a < 0 || b < 0 || c < 0 || d < 0) {\n    throw new Error('Invalid address encoding');\n  }\n  const triple = (a << 18) | (b << 12) | (c << 6) | d;\n  const byte1 = (triple >> 16) & 0xff;\n  const byte2 = (triple >> 8) & 0xff;\n  const incomingChecksum = triple & 0xff;\n\n  checksum += byte1;\n  checksum += byte2;\n  output[outIdx++] = byte1;\n  output[outIdx++] = byte2;\n\n  checksum &= 0xff;\n  if (checksum !== incomingChecksum) {\n    throw new Error('Address checksum mismatch');\n  }\n\n  return output;\n}\n\nfunction maskForBits(bits: number): number {\n  return bits === 0 ? 0 : (1 << bits) - 1;\n}\n","import { encodeAddress } from '@thru/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        return {\n          signature,\n          status: update.executionResult.userErrorCode === 0n ? 'finalized' : 'failed',\n          errorCode: update.executionResult.userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        return {\n          signature,\n          status: 'finalized',\n        };\n      }\n    }\n  } catch {\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport { trackTransaction } from './utils';\nimport type {\n  PasskeySignaturePayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: 0,\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),\n    clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),\n  });\n\n  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: { fee: 0n },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  const signature = await opts.client.transactions.send(transaction.toWire());\n  return trackTransaction(opts.client, signature);\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACVA,IAAM,sBAAsB;AAEnC,IAAM,UAAU,IAAI,WAAW,GAAG,EAAE,KAAK,EAAE;AAC3C,SAAS,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;AACjD,UAAQ,oBAAoB,WAAW,CAAC,CAAC,IAAI;AACjD;;;ACHO,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM,WAAW,IAAI;AACvB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,MAAI,gBAAgB;AACpB,QAAM,SAAmB,CAAC,KAAK,GAAG;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,gBAAY;AACZ,mBAAgB,eAAe,IAAK,UAAU;AAC9C,qBAAiB;AACjB,WAAO,iBAAiB,GAAG;AACzB,YAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,aAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,uBAAiB;AACjB,qBAAe,YAAY,aAAa;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,aAAa,MAAM,EAAE;AAC3B,cAAY;AACZ,iBAAgB,eAAe,IAAK,gBAAgB;AACpD,mBAAiB;AAEjB,QAAM,OAAO,MAAM,EAAE;AACrB,cAAY;AACZ,iBAAgB,eAAe,IAAK,UAAU;AAC9C,mBAAiB;AAEjB,iBAAgB,eAAe,IAAM,WAAW,SAAW;AAC3D,mBAAiB;AAEjB,SAAO,iBAAiB,GAAG;AACzB,UAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,WAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,qBAAiB;AACjB,mBAAe,YAAY,aAAa;AAAA,EAC1C;AAEA,SAAO,OAAO,KAAK,EAAE;AACvB;AA+DA,SAAS,YAAY,MAAsB;AACzC,SAAO,SAAS,IAAI,KAAK,KAAK,QAAQ;AACxC;;;AC5GA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,OAAO,gBAAgB,kBAAkB,KAAK,cAAc;AAAA,UACpE,WAAW,OAAO,gBAAgB;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;;;AHtDA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,MAAM,iBAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,MAAM,oBAAoB,MAAM,+BAA+B;AACnF,QAAM,gBAAgB,cAAc,WAAW;AAE/C,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,mBAAe;AAAA,EACjB,QAAQ;AACN,mBAAe;AAAA,EACjB;AAEA,MAAI,CAAC,cAAc;AACjB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,aAAa,oBAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,wBAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,CAAC,aAAa;AAAA,QACzB,UAAU,CAAC;AAAA,MACb;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,2CAA2C,OAAO,aAAa,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,oBAAoB,iBAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,MAAM;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,8BAA0B,cAAc,kBAAkB;AAE1D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,uBAAuB;AACtD,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,CAAC,cAAc;AACjB,UAAI;AACF,cAAM,WAAW,MAAM,2BAA2B,mBAAmB,UAAU;AAC/E,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,uBAAuB;AAC3E,cAAM,aAAa,oBAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,aAAa,oCAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,CAAC,eAAe,uBAAuB;AAAA,YAClD,UAAU,CAAC;AAAA,UACb;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,gBAAQ,KAAK,+CAA+C,KAAK;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AIpJA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,MAAM,iBAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,WAAW,iBAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA;AAAA,EACE,mCAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,OACK;AASP,eAAsB,yBAAyB,MAOU;AACvD,QAAM,aAAa,0BAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS;AAAA,IACT,YAAYC,YAAW,KAAK,UAAU;AAAA,IACtC,YAAYA,YAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,OAAO,KAAK,KAAK,mBAAmB,QAAQ;AAAA,IAC/D,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,QAAQ;AAAA,EAC3D,CAAC;AAED,QAAM,kBAAkB,wBAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAASC;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ,EAAE,KAAK,GAAG;AAAA,EACpB,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,QAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,SAAO,iBAAiB,KAAK,QAAQ,SAAS;AAChD;;;ACrCO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["PASSKEY_MANAGER_PROGRAM_ADDRESS","hexToBytes","hexToBytes","PASSKEY_MANAGER_PROGRAM_ADDRESS"]}
+{"version":3,"sources":["../src/server/create-wallet.ts","../../helpers/src/constants.ts","../../helpers/src/address.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from './utils';\nimport type { ThruClient } from './types';\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? 'default';\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: [walletAddress],\n        readOnly: [],\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== 'finalized') {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n        }`\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      walletName,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: [walletAddress, lookupAddress],\n            readOnly: [],\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(transaction.toWire());\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== 'finalized') {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''\n            }`\n          );\n        }\n      });\n    } catch (error) {\n      console.warn('Credential registration failed (non-fatal):', error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","export const BASE64_URL_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst tempMap = new Int16Array(256).fill(-1);\nfor (let i = 0; i < BASE64_URL_ALPHABET.length; i++) {\n    tempMap[BASE64_URL_ALPHABET.charCodeAt(i)] = i;\n}\nexport const BASE64_URL_MAP = tempMap\n\n","import { BASE64_URL_ALPHABET, BASE64_URL_MAP } from \"./constants\";\n\nexport function encodeAddress(bytes: Uint8Array): string {\n  if (bytes.length !== 32) {\n    throw new Error('Expected 32-byte address');\n  }\n\n  let checksum = 0;\n  let accumulator = 0;\n  let bitsCollected = 0;\n  const output: string[] = ['t', 'a'];\n\n  for (let i = 0; i < 30; i++) {\n    const byte = bytes[i];\n    checksum += byte;\n    accumulator = ((accumulator << 8) | byte) >>> 0;\n    bitsCollected += 8;\n    while (bitsCollected >= 6) {\n      const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n      output.push(BASE64_URL_ALPHABET[index]);\n      bitsCollected -= 6;\n      accumulator &= maskForBits(bitsCollected);\n    }\n  }\n\n  const secondLast = bytes[30];\n  checksum += secondLast;\n  accumulator = ((accumulator << 8) | secondLast) >>> 0;\n  bitsCollected += 8;\n\n  const last = bytes[31];\n  checksum += last;\n  accumulator = ((accumulator << 8) | last) >>> 0;\n  bitsCollected += 8;\n\n  accumulator = ((accumulator << 8) | (checksum & 0xff)) >>> 0;\n  bitsCollected += 8;\n\n  while (bitsCollected >= 6) {\n    const index = (accumulator >> (bitsCollected - 6)) & 0x3f;\n    output.push(BASE64_URL_ALPHABET[index]);\n    bitsCollected -= 6;\n    accumulator &= maskForBits(bitsCollected);\n  }\n\n  return output.join('');\n}\n\nexport function decodeAddress(value: string): Uint8Array {\n  if (value.length !== 46) {\n    throw new Error('Invalid address length');\n  }\n  if (!value.startsWith('ta')) {\n    throw new Error('Address must start with \"ta\"');\n  }\n\n  const output = new Uint8Array(32);\n  let checksum = 0;\n  let inIdx = 2;\n  let remaining = 40;\n  let outIdx = 0;\n\n  while (remaining >= 4) {\n    const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n    const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n    const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n    const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n    if (a < 0 || b < 0 || c < 0 || d < 0) {\n      throw new Error('Invalid address encoding');\n    }\n    const triple = (a << 18) | (b << 12) | (c << 6) | d;\n    const byte1 = (triple >> 16) & 0xff;\n    const byte2 = (triple >> 8) & 0xff;\n    const byte3 = triple & 0xff;\n    checksum += byte1;\n    checksum += byte2;\n    checksum += byte3;\n    output[outIdx++] = byte1;\n    output[outIdx++] = byte2;\n    output[outIdx++] = byte3;\n    inIdx += 4;\n    remaining -= 4;\n  }\n\n  const a = BASE64_URL_MAP[value.charCodeAt(inIdx)];\n  const b = BASE64_URL_MAP[value.charCodeAt(inIdx + 1)];\n  const c = BASE64_URL_MAP[value.charCodeAt(inIdx + 2)];\n  const d = BASE64_URL_MAP[value.charCodeAt(inIdx + 3)];\n  if (a < 0 || b < 0 || c < 0 || d < 0) {\n    throw new Error('Invalid address encoding');\n  }\n  const triple = (a << 18) | (b << 12) | (c << 6) | d;\n  const byte1 = (triple >> 16) & 0xff;\n  const byte2 = (triple >> 8) & 0xff;\n  const incomingChecksum = triple & 0xff;\n\n  checksum += byte1;\n  checksum += byte2;\n  output[outIdx++] = byte1;\n  output[outIdx++] = byte2;\n\n  checksum &= 0xff;\n  if (checksum !== incomingChecksum) {\n    throw new Error('Address checksum mismatch');\n  }\n\n  return output;\n}\n\nfunction maskForBits(bits: number): number {\n  return bits === 0 ? 0 : (1 << bits) - 1;\n}\n","import { encodeAddress } from '@thru/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  try {\n    let finalizedSeen = false;\n\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/passkey-manager';\nimport type { AccountContext } from '@thru/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  PasskeySignaturePayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const validateIx = encodeValidateInstruction({\n      walletAccountIdx: opts.accountCtx.walletAccountIdx,\n      authIdx: 0,\n      signatureR: hexToBytes(opts.signatureR),\n      signatureS: hexToBytes(opts.signatureS),\n      authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),\n      clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),\n    });\n\n    const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData,\n      accounts: {\n        readWrite: opts.accountCtx.readWriteAddresses,\n        readOnly: opts.accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: string;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACVA,IAAM,sBAAsB;AAEnC,IAAM,UAAU,IAAI,WAAW,GAAG,EAAE,KAAK,EAAE;AAC3C,SAAS,IAAI,GAAG,IAAI,oBAAoB,QAAQ,KAAK;AACjD,UAAQ,oBAAoB,WAAW,CAAC,CAAC,IAAI;AACjD;;;ACHO,SAAS,cAAc,OAA2B;AACvD,MAAI,MAAM,WAAW,IAAI;AACvB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,MAAI,gBAAgB;AACpB,QAAM,SAAmB,CAAC,KAAK,GAAG;AAElC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,OAAO,MAAM,CAAC;AACpB,gBAAY;AACZ,mBAAgB,eAAe,IAAK,UAAU;AAC9C,qBAAiB;AACjB,WAAO,iBAAiB,GAAG;AACzB,YAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,aAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,uBAAiB;AACjB,qBAAe,YAAY,aAAa;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,aAAa,MAAM,EAAE;AAC3B,cAAY;AACZ,iBAAgB,eAAe,IAAK,gBAAgB;AACpD,mBAAiB;AAEjB,QAAM,OAAO,MAAM,EAAE;AACrB,cAAY;AACZ,iBAAgB,eAAe,IAAK,UAAU;AAC9C,mBAAiB;AAEjB,iBAAgB,eAAe,IAAM,WAAW,SAAW;AAC3D,mBAAiB;AAEjB,SAAO,iBAAiB,GAAG;AACzB,UAAM,QAAS,eAAgB,gBAAgB,IAAM;AACrD,WAAO,KAAK,oBAAoB,KAAK,CAAC;AACtC,qBAAiB;AACjB,mBAAe,YAAY,aAAa;AAAA,EAC1C;AAEA,SAAO,OAAO,KAAK,EAAE;AACvB;AA+DA,SAAS,YAAY,MAAsB;AACzC,SAAO,SAAS,IAAI,KAAK,KAAK,QAAQ;AACxC;;;AC5GA,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI;AACF,QAAI,gBAAgB;AAEpB,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;AH3GA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,MAAM,iBAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,MAAM,oBAAoB,MAAM,+BAA+B;AACnF,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,aAAa,oBAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,wBAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,CAAC,aAAa;AAAA,QACzB,UAAU,CAAC;AAAA,MACb;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,oBAAoB,iBAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,MAAM;AAAA,MAC/B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,MAAM,2BAA2B,mBAAmB,UAAU;AAC/E,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,aAAa,oBAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,aAAa,oCAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,CAAC,eAAe,aAAa;AAAA,YACxC,UAAU,CAAC;AAAA,UACb;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SAAY,iBAAiB,OAAO,SAAS,MAAM,EAC1E;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AIhKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,MAAM,iBAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,WAAW,iBAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA;AAAA,EACE,mCAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,OACK;AASP,eAAsB,yBAAyB,MAOU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,aAAa,0BAA0B;AAAA,MAC3C,kBAAkB,KAAK,WAAW;AAAA,MAClC,SAAS;AAAA,MACT,YAAYC,YAAW,KAAK,UAAU;AAAA,MACtC,YAAYA,YAAW,KAAK,UAAU;AAAA,MACtC,mBAAmB,OAAO,KAAK,KAAK,mBAAmB,QAAQ;AAAA,MAC/D,gBAAgB,OAAO,KAAK,KAAK,gBAAgB,QAAQ;AAAA,IAC3D,CAAC;AAED,UAAM,kBAAkB,wBAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAASC;AAAA,MACT;AAAA,MACA,UAAU;AAAA,QACR,WAAW,KAAK,WAAW;AAAA,QAC3B,UAAU,KAAK,WAAW;AAAA,MAC5B;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACvCO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["PASSKEY_MANAGER_PROGRAM_ADDRESS","hexToBytes","hexToBytes","PASSKEY_MANAGER_PROGRAM_ADDRESS"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thru/passkey",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -38,7 +38,7 @@
     }
   },
   "dependencies": {
-    "@thru/passkey-manager": "0.2.14"
+    "@thru/passkey-manager": "0.2.16"
   },
   "peerDependencies": {
     "expo-secure-store": "*",
@@ -62,11 +62,15 @@
   },
   "devDependencies": {
     "tsup": "^8.5.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
   },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:run": "vitest run",
+    "test:watch": "vitest watch",
     "clean": "rm -rf dist"
   }
 }

package/src/expo-secure-store.d.ts

@@ -0,0 +1,13 @@
+declare module 'expo-secure-store' {
+  export const WHEN_UNLOCKED_THIS_DEVICE_ONLY: string;
+
+  export function setItemAsync(
+    key: string,
+    value: string,
+    options?: Record<string, unknown>
+  ): Promise<void>;
+
+  export function getItemAsync(key: string): Promise<string | null>;
+
+  export function deleteItemAsync(key: string): Promise<void>;
+}

package/src/react-native-passkeys.d.ts

@@ -0,0 +1,25 @@
+declare module 'react-native-passkeys' {
+  export interface PasskeyCreateResponse {
+    id: string;
+    response: {
+      getPublicKey?: () => string | undefined;
+    };
+  }
+
+  export interface PasskeyGetResponse {
+    id: string;
+    response: {
+      signature: string;
+      authenticatorData: string;
+      clientDataJSON: string;
+    };
+  }
+
+  export function create(
+    request: Record<string, unknown>
+  ): Promise<PasskeyCreateResponse | null>;
+
+  export function get(
+    request: Record<string, unknown>
+  ): Promise<PasskeyGetResponse | null>;
+}

package/src/server/create-wallet.test.ts

@@ -0,0 +1,172 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { ThruClient } from './types';
+
+vi.mock('@thru/helpers', () => ({
+  encodeAddress: (bytes: Uint8Array) => {
+    const first = bytes[0];
+    if (first === 11) return 'wallet-address';
+    if (first === 22) return 'lookup-address';
+    return `address-${Array.from(bytes).join('-')}`;
+  },
+}));
+
+vi.mock('@thru/passkey-manager', () => ({
+  PASSKEY_MANAGER_PROGRAM_ADDRESS: 'passkey-program',
+  base64UrlToBytes: () => new Uint8Array([7]),
+  buildAccountContext: () => ({
+    walletAccountIdx: 0,
+    getAccountIndex: () => 1,
+  }),
+  createCredentialLookupSeed: async () => new Uint8Array([8]),
+  createWalletSeed: async () => new Uint8Array([1]),
+  deriveCredentialLookupAddress: async () => new Uint8Array([22]),
+  deriveWalletAddress: async () => new Uint8Array([11]),
+  encodeCreateInstruction: () => new Uint8Array([101]),
+  encodeRegisterCredentialInstruction: () => new Uint8Array([202]),
+}));
+
+import { createPasskeyWallet } from './create-wallet';
+
+const feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');
+
+function createDeferred<T = void>() {
+  let resolve!: (value: T | PromiseLike<T>) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+
+  return { promise, resolve };
+}
+
+function clearFeePayerQueues(): void {
+  const globalQueues = globalThis as typeof globalThis & {
+    [feePayerQueueSymbol]?: Map<string, Promise<void>>;
+  };
+
+  globalQueues[feePayerQueueSymbol]?.clear();
+  delete globalQueues[feePayerQueueSymbol];
+}
+
+describe('createPasskeyWallet', () => {
+  beforeEach(() => {
+    clearFeePayerQueues();
+  });
+
+  it('re-checks wallet and credential existence after acquiring the serialized fee-payer lock', async () => {
+    const walletTrackStarted = createDeferred<void>();
+    const walletTrackRelease = createDeferred<void>();
+    const lookupTrackStarted = createDeferred<void>();
+    const lookupTrackRelease = createDeferred<void>();
+
+    const state = {
+      walletExists: false,
+      lookupExists: false,
+      walletTrackCount: 0,
+      lookupTrackCount: 0,
+    };
+
+    const sentKinds: string[] = [];
+
+    const client = {
+      accounts: {
+        get: vi.fn(async (address: string) => {
+          if (address === 'wallet-address') {
+            if (!state.walletExists) throw new Error('missing wallet');
+            return { data: { data: new Uint8Array() } };
+          }
+
+          if (address === 'lookup-address') {
+            if (!state.lookupExists) throw new Error('missing lookup');
+            return { data: { data: new Uint8Array() } };
+          }
+
+          return { data: { data: new Uint8Array() } };
+        }),
+      },
+      proofs: {
+        generate: vi.fn(async () => ({ proof: new Uint8Array([9]) })),
+      },
+      transactions: {
+        build: vi.fn(async (params: { accounts: { readWrite: string[] } }) => {
+          const kind = params.accounts.readWrite.length === 1 ? 'wallet' : 'lookup';
+          return {
+            sign: vi.fn(async () => {}),
+            toWire: () => new TextEncoder().encode(kind),
+          };
+        }),
+        send: vi.fn(async (wire: Uint8Array) => {
+          const kind = new TextDecoder().decode(wire);
+          sentKinds.push(kind);
+          return `${kind}-sig-${sentKinds.length}`;
+        }),
+        track: vi.fn(async function* (signature: string) {
+          if (signature.startsWith('wallet-sig')) {
+            state.walletTrackCount += 1;
+            if (state.walletTrackCount === 1) {
+              walletTrackStarted.resolve();
+              await walletTrackRelease.promise;
+              state.walletExists = true;
+            }
+          } else {
+            state.lookupTrackCount += 1;
+            if (state.lookupTrackCount === 1) {
+              lookupTrackStarted.resolve();
+              await lookupTrackRelease.promise;
+              state.lookupExists = true;
+            }
+          }
+
+          yield {
+            executionResult: {
+              userErrorCode: 0n,
+              vmError: 0,
+              executionResult: 0n,
+            },
+          };
+        }),
+      },
+    } as unknown as ThruClient;
+
+    const opts = {
+      client,
+      adminPublicKey: new Uint8Array([1, 2, 3]),
+      adminPrivateKey: 'admin-private-key',
+      adminAddress: 'admin-address',
+      pubkeyX: new Uint8Array([4]),
+      pubkeyY: new Uint8Array([5]),
+      credentialId: 'credential-id',
+      walletName: 'default-wallet',
+    };
+
+    const first = createPasskeyWallet(opts);
+    await walletTrackStarted.promise;
+
+    const second = createPasskeyWallet(opts);
+    await Promise.resolve();
+
+    walletTrackRelease.resolve();
+    await lookupTrackStarted.promise;
+    await Promise.resolve();
+
+    lookupTrackRelease.resolve();
+
+    await expect(Promise.all([first, second])).resolves.toEqual([
+      {
+        walletAddress: 'wallet-address',
+        credentialLookupAddress: 'lookup-address',
+      },
+      {
+        walletAddress: 'wallet-address',
+        credentialLookupAddress: 'lookup-address',
+      },
+    ]);
+
+    expect(sentKinds).toEqual(['wallet', 'lookup']);
+    expect(state.walletTrackCount).toBe(1);
+    expect(state.lookupTrackCount).toBe(1);
+
+    const accountChecks = vi.mocked(client.accounts.get).mock.calls.map(([address]) => address);
+    expect(accountChecks.filter((address) => address === 'wallet-address')).toHaveLength(2);
+    expect(accountChecks.filter((address) => address === 'lookup-address')).toHaveLength(2);
+  });
+});

package/src/server/create-wallet.ts

@@ -9,7 +9,12 @@ import {
   encodeCreateInstruction,
   encodeRegisterCredentialInstruction,
 } from '@thru/passkey-manager';
-import { toThruAddress, getStateProof, trackTransaction } from './utils';
+import {
+  toThruAddress,
+  getStateProof,
+  trackTransaction,
+  withSerializedFeePayer,
+} from './utils';
 import type { ThruClient } from './types';
 
 export async function createPasskeyWallet(opts: {
@@ -27,15 +32,17 @@ export async function createPasskeyWallet(opts: {
   const walletBytes = await deriveWalletAddress(seed, PASSKEY_MANAGER_PROGRAM_ADDRESS);
   const walletAddress = toThruAddress(walletBytes);
 
-  let walletExists = false;
-  try {
-    await opts.client.accounts.get(walletAddress);
-    walletExists = true;
-  } catch {
-    walletExists = false;
-  }
+  await withSerializedFeePayer(opts.adminPublicKey, async () => {
+    let walletExists = false;
+    try {
+      await opts.client.accounts.get(walletAddress);
+      walletExists = true;
+    } catch {
+      walletExists = false;
+    }
+
+    if (walletExists) return;
 
-  if (!walletExists) {
     const stateProof = await getStateProof(opts.client, walletAddress);
     const accountCtx = buildAccountContext({
       walletAddress,
@@ -72,10 +79,12 @@ export async function createPasskeyWallet(opts: {
     const result = await trackTransaction(opts.client, signature, 60000);
     if (result.status !== 'finalized') {
       throw new Error(
-        `Wallet creation failed with error code: ${result.errorCode ?? 'unknown'}`
+        `Wallet creation failed with status: ${result.status}${
+          result.errorCode !== undefined ? ` (error code: ${result.errorCode})` : ''
+        }`
       );
     }
-  }
+  });
 
   let credentialLookupAddress: string | undefined;
   if (opts.credentialId) {
@@ -85,21 +94,24 @@ export async function createPasskeyWallet(opts: {
       walletName,
       PASSKEY_MANAGER_PROGRAM_ADDRESS
     );
+    const lookupAddress = toThruAddress(lookupAddressBytes);
 
-    credentialLookupAddress = toThruAddress(lookupAddressBytes);
+    credentialLookupAddress = lookupAddress;
 
-    let lookupExists = false;
     try {
-      await opts.client.accounts.get(credentialLookupAddress);
-      lookupExists = true;
-    } catch {
-      lookupExists = false;
-    }
+      await withSerializedFeePayer(opts.adminPublicKey, async () => {
+        let lookupExists = false;
+        try {
+          await opts.client.accounts.get(lookupAddress);
+          lookupExists = true;
+        } catch {
+          lookupExists = false;
+        }
+
+        if (lookupExists) return;
 
-    if (!lookupExists) {
-      try {
         const credSeed = await createCredentialLookupSeed(credentialIdBytes, walletName);
-        const stateProof = await getStateProof(opts.client, credentialLookupAddress);
+        const stateProof = await getStateProof(opts.client, lookupAddress);
         const accountCtx = buildAccountContext({
           walletAddress,
           readWriteAccounts: [lookupAddressBytes],
@@ -120,7 +132,7 @@ export async function createPasskeyWallet(opts: {
           program: PASSKEY_MANAGER_PROGRAM_ADDRESS,
           instructionData: registerIx,
           accounts: {
-            readWrite: [walletAddress, credentialLookupAddress],
+            readWrite: [walletAddress, lookupAddress],
             readOnly: [],
           },
           header: { fee: 0n },
@@ -136,9 +148,9 @@ export async function createPasskeyWallet(opts: {
             }`
           );
         }
-      } catch (error) {
-        console.warn('Credential registration failed (non-fatal):', error);
-      }
+      });
+    } catch (error) {
+      console.warn('Credential registration failed (non-fatal):', error);
     }
   }
 

package/src/server/submit.ts

@@ -5,7 +5,7 @@ import {
   hexToBytes,
 } from '@thru/passkey-manager';
 import type { AccountContext } from '@thru/passkey-manager';
-import { trackTransaction } from './utils';
+import { trackTransaction, withSerializedFeePayer } from './utils';
 import type {
   PasskeySignaturePayload,
   ThruClient,
@@ -20,28 +20,30 @@ export async function submitPasskeyTransaction(opts: {
   accountCtx: AccountContext;
   invokeIx: Uint8Array;
 } & PasskeySignaturePayload): Promise<TransactionResult> {
-  const validateIx = encodeValidateInstruction({
-    walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
-    signatureR: hexToBytes(opts.signatureR),
-    signatureS: hexToBytes(opts.signatureS),
-    authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),
-    clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),
-  });
+  return withSerializedFeePayer(opts.adminPublicKey, async () => {
+    const validateIx = encodeValidateInstruction({
+      walletAccountIdx: opts.accountCtx.walletAccountIdx,
+      authIdx: 0,
+      signatureR: hexToBytes(opts.signatureR),
+      signatureS: hexToBytes(opts.signatureS),
+      authenticatorData: Buffer.from(opts.authenticatorData, 'base64'),
+      clientDataJSON: Buffer.from(opts.clientDataJSON, 'base64'),
+    });
 
-  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
-  const transaction = await opts.client.transactions.build({
-    feePayer: { publicKey: opts.adminPublicKey },
-    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,
-    instructionData,
-    accounts: {
-      readWrite: opts.accountCtx.readWriteAddresses,
-      readOnly: opts.accountCtx.readOnlyAddresses,
-    },
-    header: { fee: 0n },
-  });
+    const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
+    const transaction = await opts.client.transactions.build({
+      feePayer: { publicKey: opts.adminPublicKey },
+      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,
+      instructionData,
+      accounts: {
+        readWrite: opts.accountCtx.readWriteAddresses,
+        readOnly: opts.accountCtx.readOnlyAddresses,
+      },
+      header: { fee: 0n },
+    });
 
-  await transaction.sign(opts.adminPrivateKey);
-  const signature = await opts.client.transactions.send(transaction.toWire());
-  return trackTransaction(opts.client, signature);
+    await transaction.sign(opts.adminPrivateKey);
+    const signature = await opts.client.transactions.send(transaction.toWire());
+    return trackTransaction(opts.client, signature);
+  });
 }

package/src/server/types.ts

@@ -35,6 +35,8 @@ export interface ThruClient {
     ) => AsyncIterable<{
       executionResult?: {
         userErrorCode: bigint;
+        vmError?: bigint | number | null;
+        executionResult?: bigint | number | null;
       };
       statusCode?: number;
     }>;
@@ -55,7 +57,7 @@ export interface PasskeyChallengeSubmitPayload extends PasskeySignaturePayload {
 
 export interface TransactionResult {
   signature: string;
-  status: 'finalized' | 'failed' | 'timeout';
+  status: 'finalized' | 'failed' | 'timeout' | 'finalized_without_execution';
   errorCode?: bigint;
 }
 

package/src/server/utils.test.ts

@@ -0,0 +1,35 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import type { ThruClient } from './types';
+import { trackTransaction } from './utils';
+
+const feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');
+
+function clearFeePayerQueues(): void {
+  const globalQueues = globalThis as typeof globalThis & {
+    [feePayerQueueSymbol]?: Map<string, Promise<void>>;
+  };
+
+  globalQueues[feePayerQueueSymbol]?.clear();
+  delete globalQueues[feePayerQueueSymbol];
+}
+
+describe('trackTransaction', () => {
+  beforeEach(() => {
+    clearFeePayerQueues();
+  });
+
+  it('returns a distinct status when finalized arrives without an execution payload', async () => {
+    const client = {
+      transactions: {
+        track: async function* () {
+          yield { statusCode: 3 };
+        },
+      },
+    } as ThruClient;
+
+    await expect(trackTransaction(client, 'sig-1')).resolves.toEqual({
+      signature: 'sig-1',
+      status: 'finalized_without_execution',
+    });
+  });
+});

package/src/server/utils.ts

@@ -1,6 +1,20 @@
 import { encodeAddress } from '@thru/helpers';
 import type { ThruClient, TransactionResult } from './types';
 
+const feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');
+
+function getFeePayerQueues(): Map<string, Promise<void>> {
+  const globalQueues = globalThis as typeof globalThis & {
+    [feePayerQueueSymbol]?: Map<string, Promise<void>>;
+  };
+
+  if (!globalQueues[feePayerQueueSymbol]) {
+    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();
+  }
+
+  return globalQueues[feePayerQueueSymbol];
+}
+
 export async function getStateProof(
   client: ThruClient,
   address: string,
@@ -35,22 +49,40 @@ export async function trackTransaction(
   timeoutMs: number = 5000
 ): Promise<TransactionResult> {
   try {
+    let finalizedSeen = false;
+
     for await (const update of client.transactions.track(signature, { timeoutMs })) {
       if (update.executionResult) {
+        const vmError =
+          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null
+            ? BigInt(update.executionResult.vmError)
+            : 0n;
+        const userErrorCode = update.executionResult.userErrorCode;
+        const executionError =
+          update.executionResult.executionResult !== undefined &&
+          update.executionResult.executionResult !== null
+            ? BigInt(update.executionResult.executionResult)
+            : 0n;
+        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;
+
         return {
           signature,
-          status: update.executionResult.userErrorCode === 0n ? 'finalized' : 'failed',
-          errorCode: update.executionResult.userErrorCode,
+          status: success ? 'finalized' : 'failed',
+          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,
         };
       }
 
       if (update.statusCode === 3) {
-        return {
-          signature,
-          status: 'finalized',
-        };
+        finalizedSeen = true;
       }
     }
+
+    if (finalizedSeen) {
+      return {
+        signature,
+        status: 'finalized_without_execution',
+      };
+    }
   } catch {
     return {
       signature,
@@ -67,3 +99,29 @@ export async function trackTransaction(
 export function toThruAddress(bytes: Uint8Array): string {
   return encodeAddress(bytes);
 }
+
+export async function withSerializedFeePayer<T>(
+  feePayerPublicKey: Uint8Array,
+  work: () => Promise<T>
+): Promise<T> {
+  const queueKey = toThruAddress(feePayerPublicKey);
+  const feePayerQueues = getFeePayerQueues();
+  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const tail = previous.then(() => current);
+  feePayerQueues.set(queueKey, tail);
+
+  await previous;
+
+  try {
+    return await work();
+  } finally {
+    release();
+    if (feePayerQueues.get(queueKey) === tail) {
+      feePayerQueues.delete(queueKey);
+    }
+  }
+}