@thru/passkey 0.2.22 → 0.2.23

package/dist/{chunk-QAQNRQ7G.js → chunk-KASTJBBY.js}

@@ -1,15 +1,19 @@
 // src/auth/add-device.ts
 import {
   buildAccountContext,
-  concatenateInstructions,
   createValidateChallenge,
   createCredentialLookupSeed,
+  decodeAddress,
   deriveWalletAddress,
   encodeAddAuthorityInstruction,
   encodeRegisterCredentialInstruction,
   encodeValidateInstruction,
   parseWalletAuthorities
 } from "@thru/programs/passkey-manager";
+import {
+  MULTICALL_PROGRAM_PUBKEY,
+  buildMulticallInstruction
+} from "@thru/programs/multicall";
 async function addDeviceToAccount(params) {
   const status = params.onStatus ?? (() => {
   });
@@ -29,14 +33,13 @@ async function addDeviceToAccount(params) {
     );
   }
   const newAuthorityIdx = parsed.authorities.length;
-  const addAuthorityInstruction = encodeAddAuthorityInstruction({
-    authority: params.newAuthority
-  });
-  let trailingInstructionData = addAuthorityInstruction;
   let readWriteAccounts = [];
+  let lookupSeed;
+  let lookupAddressBytes;
+  let lookupProof;
   if (params.credentialId) {
-    const lookupSeed = await createCredentialLookupSeed(params.credentialId);
-    const lookupAddressBytes = await deriveWalletAddress(
+    lookupSeed = await createCredentialLookupSeed(params.credentialId);
+    lookupAddressBytes = await deriveWalletAddress(
       lookupSeed,
       params.programAddress
     );
@@ -45,55 +48,76 @@ async function addDeviceToAccount(params) {
       proofType: 1,
       address: lookupAddressBytes
     });
-    const ctx2 = buildAccountContext({
-      walletAddress: params.walletAddress,
-      readWriteAccounts: [lookupAddressBytes],
-      readOnlyAccounts: []
-    });
-    const registerCredentialInstruction = encodeRegisterCredentialInstruction({
-      walletAccountIdx: ctx2.walletAccountIdx,
-      lookupAccountIdx: ctx2.getAccountIndex(lookupAddressBytes),
-      seed: lookupSeed,
-      stateProof: proofResult.proof
-    });
-    trailingInstructionData = concatenateInstructions([
-      addAuthorityInstruction,
-      registerCredentialInstruction
-    ]);
+    lookupProof = proofResult.proof;
     readWriteAccounts = [lookupAddressBytes];
   }
   const ctx = buildAccountContext({
     walletAddress: params.walletAddress,
     readWriteAccounts,
-    readOnlyAccounts: []
+    readOnlyAccounts: params.credentialId ? [MULTICALL_PROGRAM_PUBKEY] : [],
+    programAddress: params.programAddress
   });
+  const passkeyProgramPubkey = decodeAddress(params.programAddress);
+  const addAuthorityInstruction = encodeAddAuthorityInstruction({
+    walletAccountIdx: ctx.walletAccountIdx,
+    authority: params.newAuthority
+  });
+  let targetProgramIdx = ctx.getAccountIndex(passkeyProgramPubkey);
+  let targetInstructionData = addAuthorityInstruction;
+  if (params.credentialId) {
+    if (!lookupSeed || !lookupAddressBytes || !lookupProof) {
+      throw new Error("Credential lookup proof data missing");
+    }
+    const registerCredentialInstruction = encodeRegisterCredentialInstruction({
+      walletAccountIdx: ctx.walletAccountIdx,
+      lookupAccountIdx: ctx.getAccountIndex(lookupAddressBytes),
+      seed: lookupSeed,
+      stateProof: lookupProof
+    });
+    targetProgramIdx = ctx.getAccountIndex(MULTICALL_PROGRAM_PUBKEY);
+    targetInstructionData = buildMulticallInstruction([
+      {
+        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),
+        instructionData: addAuthorityInstruction
+      },
+      {
+        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),
+        instructionData: registerCredentialInstruction
+      }
+    ]);
+  }
   const challenge = await createValidateChallenge(
     parsed.nonce,
     ctx.accountAddresses,
-    trailingInstructionData
+    ctx.walletAccountIdx,
+    params.authIdx,
+    {
+      programIdx: targetProgramIdx,
+      instructionData: targetInstructionData
+    }
   );
   status("Waiting for passkey approval...");
   const signature = await params.passkey.signChallenge(challenge);
   const validateInstruction = encodeValidateInstruction({
     walletAccountIdx: ctx.walletAccountIdx,
     authIdx: params.authIdx,
+    targetInstruction: {
+      programIdx: targetProgramIdx,
+      instructionData: targetInstructionData
+    },
     signatureR: signature.signatureR,
     signatureS: signature.signatureS,
     authenticatorData: signature.authenticatorData,
     clientDataJSON: signature.clientDataJSON
   });
-  const instructionData = concatenateInstructions([
-    validateInstruction,
-    trailingInstructionData
-  ]);
   status("Sending transaction...");
   const result = await params.executor({
     thru: params.thru,
     walletSigner: params.walletSigner,
-    instructionData,
+    instructionData: validateInstruction,
     readWriteAddresses: ctx.readWriteAddresses,
     readOnlyAddresses: ctx.readOnlyAddresses,
-    label: params.credentialId ? "VALIDATE + ADD_AUTHORITY + REGISTER_CREDENTIAL" : "VALIDATE + ADD_AUTHORITY"
+    label: params.credentialId ? "VALIDATE -> MULTICALL(ADD_AUTHORITY, REGISTER_CREDENTIAL)" : "VALIDATE -> ADD_AUTHORITY"
   });
   return { ...result, newAuthorityIdx };
 }
@@ -101,4 +125,4 @@ async function addDeviceToAccount(params) {
 export {
   addDeviceToAccount
 };
-//# sourceMappingURL=chunk-QAQNRQ7G.js.map
+//# sourceMappingURL=chunk-KASTJBBY.js.map

package/dist/chunk-KASTJBBY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/add-device.ts"],"sourcesContent":["/* Add-passkey-to-account transaction builder, lifted from\n   `web/wallet-auth-manager/app/page.tsx` (`runValidateThen`,\n   `handleSubmitAddPasskey`) so the wallet's `/embedded` post-connect\n   step can reuse the exact same flow.\n\n   Builds the on-chain transaction:\n     VALIDATE(existingAuthority -> ADD_AUTHORITY(newPasskey))\n     or VALIDATE(existingAuthority -> multicall[ADD_AUTHORITY, REGISTER_CREDENTIAL])\n   asks the caller's existing passkey to sign the challenge, then asks\n   the caller's wallet signer to sign the assembled transaction, sends\n   it, and returns the result. */\n\nimport {\n  type Authority,\n  buildAccountContext,\n  createValidateChallenge,\n  createCredentialLookupSeed,\n  decodeAddress,\n  deriveWalletAddress,\n  encodeAddAuthorityInstruction,\n  encodeRegisterCredentialInstruction,\n  encodeValidateInstruction,\n  parseWalletAuthorities,\n  type ParsedAuthority,\n  type WalletSigner,\n} from \"@thru/programs/passkey-manager\";\nimport {\n  MULTICALL_PROGRAM_PUBKEY,\n  buildMulticallInstruction,\n} from \"@thru/programs/multicall\";\n\n/** Minimal shape required from a passkey signer. Both web's\n    `signWithDiscoverablePasskey`/`signWithPasskey` and mobile's\n    counterparts conform. */\nexport interface PasskeyChallengeSigner {\n  signChallenge: (challenge: Uint8Array) => Promise<{\n    signatureR: Uint8Array;\n    signatureS: Uint8Array;\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n  }>;\n}\n\n/** Minimal shape required from a Thru chain client. Loosely-typed\n    because @thru/sdk's DTS emit is currently broken in this\n    repo. The caller passes the real Thru and we narrow operationally. */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type AnyThruClient = any;\n\nexport interface AddDeviceParams {\n  /** Loosely-typed Thru chain client (`@thru/sdk/client`). */\n  thru: AnyThruClient;\n  /** Wallet (the on-chain WalletAccount) to attach the passkey to. */\n  walletAddress: string;\n  /** Index of the existing authority that approves this change. Must\n      currently be a passkey authority. */\n  authIdx: number;\n  /** New passkey to attach. tag = 1 (passkey). */\n  newAuthority: Authority;\n  /** Optional credential-lookup registration so the new passkey is\n      discoverable on subsequent sign-ins. */\n  credentialId?: Uint8Array;\n  walletName?: string;\n  /** Existing-passkey challenge signer (web or mobile). */\n  passkey: PasskeyChallengeSigner;\n  /** Wallet transaction signer that returns base64(signed bytes). */\n  walletSigner: WalletSigner;\n  /** Passkey program address (base58). */\n  programAddress: string;\n  /** Sign-and-send executor (lifted from passkey-transaction.ts in the\n      wallet-auth-manager - wallet apps own this because it depends on\n      the `Thru` client's transaction builder). */\n  executor: TxExecutor;\n  /** Optional status callback so UIs can show progress. */\n  onStatus?: (message: string) => void;\n}\n\nexport interface TxExecutorParams {\n  thru: AnyThruClient;\n  walletSigner: WalletSigner;\n  instructionData: Uint8Array;\n  readWriteAddresses: string[];\n  readOnlyAddresses: string[];\n  label: string;\n}\n\nexport interface TxExecutorResult {\n  signature: string;\n  /** Loosely-typed because @thru/sdk types aren't available. */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  execution: any;\n}\n\nexport type TxExecutor = (\n  params: TxExecutorParams,\n) => Promise<TxExecutorResult>;\n\nexport interface AddDeviceResult extends TxExecutorResult {\n  /** The new passkey's authority index after the transaction lands. */\n  newAuthorityIdx: number;\n}\n\n/**\n * Run VALIDATE + ADD_AUTHORITY [+ REGISTER_CREDENTIAL] to attach a new\n * passkey to an on-chain WalletAccount.\n */\nexport async function addDeviceToAccount(\n  params: AddDeviceParams,\n): Promise<AddDeviceResult> {\n  const status = params.onStatus ?? (() => {});\n\n  const walletAccount = await params.thru.accounts.get(params.walletAddress);\n  const walletData: Uint8Array | undefined = walletAccount?.data?.data;\n  if (!walletData) {\n    throw new Error(\"Wallet account data missing\");\n  }\n\n  const parsed = parseWalletAuthorities(walletData);\n  const authorizing: ParsedAuthority | undefined =\n    parsed.authorities[params.authIdx];\n  if (!authorizing) {\n    throw new Error(\"Authorization index out of bounds\");\n  }\n  if (authorizing.kind !== \"passkey\") {\n    throw new Error(\n      \"addDeviceToAccount currently requires a passkey authority for VALIDATE\",\n    );\n  }\n\n  /* The new authority will land at the next free slot. */\n  const newAuthorityIdx = parsed.authorities.length;\n\n  let readWriteAccounts: Uint8Array[] = [];\n  let lookupSeed: Uint8Array | undefined;\n  let lookupAddressBytes: Uint8Array | undefined;\n  let lookupProof: Uint8Array | undefined;\n\n  if (params.credentialId) {\n    lookupSeed = await createCredentialLookupSeed(params.credentialId);\n    lookupAddressBytes = await deriveWalletAddress(\n      lookupSeed,\n      params.programAddress,\n    );\n\n    status(\"Fetching state proof for credential lookup...\");\n    const proofResult = await params.thru.proofs.generate({\n      proofType: 1 /* StateProofType.CREATING */,\n      address: lookupAddressBytes,\n    });\n    lookupProof = proofResult.proof;\n    readWriteAccounts = [lookupAddressBytes];\n  }\n\n  const ctx = buildAccountContext({\n    walletAddress: params.walletAddress,\n    readWriteAccounts,\n    readOnlyAccounts: params.credentialId ? [MULTICALL_PROGRAM_PUBKEY] : [],\n    programAddress: params.programAddress,\n  });\n\n  const passkeyProgramPubkey = decodeAddress(params.programAddress);\n  const addAuthorityInstruction = encodeAddAuthorityInstruction({\n    walletAccountIdx: ctx.walletAccountIdx,\n    authority: params.newAuthority,\n  });\n\n  let targetProgramIdx = ctx.getAccountIndex(passkeyProgramPubkey);\n  let targetInstructionData = addAuthorityInstruction;\n\n  if (params.credentialId) {\n    if (!lookupSeed || !lookupAddressBytes || !lookupProof) {\n      throw new Error(\"Credential lookup proof data missing\");\n    }\n\n    const registerCredentialInstruction = encodeRegisterCredentialInstruction({\n      walletAccountIdx: ctx.walletAccountIdx,\n      lookupAccountIdx: ctx.getAccountIndex(lookupAddressBytes),\n      seed: lookupSeed,\n      stateProof: lookupProof,\n    });\n\n    targetProgramIdx = ctx.getAccountIndex(MULTICALL_PROGRAM_PUBKEY);\n    targetInstructionData = buildMulticallInstruction([\n      {\n        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),\n        instructionData: addAuthorityInstruction,\n      },\n      {\n        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),\n        instructionData: registerCredentialInstruction,\n      },\n    ]);\n  }\n\n  /* Build the VALIDATE challenge over the target CPI and ask the caller's passkey to sign. */\n  const challenge = await createValidateChallenge(\n    parsed.nonce,\n    ctx.accountAddresses,\n    ctx.walletAccountIdx,\n    params.authIdx,\n    {\n      programIdx: targetProgramIdx,\n      instructionData: targetInstructionData,\n    },\n  );\n\n  status(\"Waiting for passkey approval...\");\n  const signature = await params.passkey.signChallenge(challenge);\n\n  const validateInstruction = encodeValidateInstruction({\n    walletAccountIdx: ctx.walletAccountIdx,\n    authIdx: params.authIdx,\n    targetInstruction: {\n      programIdx: targetProgramIdx,\n      instructionData: targetInstructionData,\n    },\n    signatureR: signature.signatureR,\n    signatureS: signature.signatureS,\n    authenticatorData: signature.authenticatorData,\n    clientDataJSON: signature.clientDataJSON,\n  });\n\n  status(\"Sending transaction...\");\n  const result = await params.executor({\n    thru: params.thru,\n    walletSigner: params.walletSigner,\n    instructionData: validateInstruction,\n    readWriteAddresses: ctx.readWriteAddresses,\n    readOnlyAddresses: ctx.readOnlyAddresses,\n    label: params.credentialId\n      ? \"VALIDATE -> MULTICALL(ADD_AUTHORITY, REGISTER_CREDENTIAL)\"\n      : \"VALIDATE -> ADD_AUTHORITY\",\n  });\n\n  return { ...result, newAuthorityIdx };\n}\n"],"mappings":";AAYA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA6EP,eAAsB,mBACpB,QAC0B;AAC1B,QAAM,SAAS,OAAO,aAAa,MAAM;AAAA,EAAC;AAE1C,QAAM,gBAAgB,MAAM,OAAO,KAAK,SAAS,IAAI,OAAO,aAAa;AACzE,QAAM,aAAqC,eAAe,MAAM;AAChE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,QAAM,SAAS,uBAAuB,UAAU;AAChD,QAAM,cACJ,OAAO,YAAY,OAAO,OAAO;AACnC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,MAAI,YAAY,SAAS,WAAW;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,kBAAkB,OAAO,YAAY;AAE3C,MAAI,oBAAkC,CAAC;AACvC,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,OAAO,cAAc;AACvB,iBAAa,MAAM,2BAA2B,OAAO,YAAY;AACjE,yBAAqB,MAAM;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,IACT;AAEA,WAAO,+CAA+C;AACtD,UAAM,cAAc,MAAM,OAAO,KAAK,OAAO,SAAS;AAAA,MACpD,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AACD,kBAAc,YAAY;AAC1B,wBAAoB,CAAC,kBAAkB;AAAA,EACzC;AAEA,QAAM,MAAM,oBAAoB;AAAA,IAC9B,eAAe,OAAO;AAAA,IACtB;AAAA,IACA,kBAAkB,OAAO,eAAe,CAAC,wBAAwB,IAAI,CAAC;AAAA,IACtE,gBAAgB,OAAO;AAAA,EACzB,CAAC;AAED,QAAM,uBAAuB,cAAc,OAAO,cAAc;AAChE,QAAM,0BAA0B,8BAA8B;AAAA,IAC5D,kBAAkB,IAAI;AAAA,IACtB,WAAW,OAAO;AAAA,EACpB,CAAC;AAED,MAAI,mBAAmB,IAAI,gBAAgB,oBAAoB;AAC/D,MAAI,wBAAwB;AAE5B,MAAI,OAAO,cAAc;AACvB,QAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,aAAa;AACtD,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,UAAM,gCAAgC,oCAAoC;AAAA,MACxE,kBAAkB,IAAI;AAAA,MACtB,kBAAkB,IAAI,gBAAgB,kBAAkB;AAAA,MACxD,MAAM;AAAA,MACN,YAAY;AAAA,IACd,CAAC;AAED,uBAAmB,IAAI,gBAAgB,wBAAwB;AAC/D,4BAAwB,0BAA0B;AAAA,MAChD;AAAA,QACE,YAAY,IAAI,gBAAgB,oBAAoB;AAAA,QACpD,iBAAiB;AAAA,MACnB;AAAA,MACA;AAAA,QACE,YAAY,IAAI,gBAAgB,oBAAoB;AAAA,QACpD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AAGA,QAAM,YAAY,MAAM;AAAA,IACtB,OAAO;AAAA,IACP,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,SAAO,iCAAiC;AACxC,QAAM,YAAY,MAAM,OAAO,QAAQ,cAAc,SAAS;AAE9D,QAAM,sBAAsB,0BAA0B;AAAA,IACpD,kBAAkB,IAAI;AAAA,IACtB,SAAS,OAAO;AAAA,IAChB,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AAAA,IACA,YAAY,UAAU;AAAA,IACtB,YAAY,UAAU;AAAA,IACtB,mBAAmB,UAAU;AAAA,IAC7B,gBAAgB,UAAU;AAAA,EAC5B,CAAC;AAED,SAAO,wBAAwB;AAC/B,QAAM,SAAS,MAAM,OAAO,SAAS;AAAA,IACnC,MAAM,OAAO;AAAA,IACb,cAAc,OAAO;AAAA,IACrB,iBAAiB;AAAA,IACjB,oBAAoB,IAAI;AAAA,IACxB,mBAAmB,IAAI;AAAA,IACvB,OAAO,OAAO,eACV,8DACA;AAAA,EACN,CAAC;AAED,SAAO,EAAE,GAAG,QAAQ,gBAAgB;AACtC;","names":[]}

package/dist/server.cjs

@@ -245,10 +245,18 @@ async function createPasskeyWallet(opts) {
 var import_passkey_manager2 = require("@thru/programs/passkey-manager");
 async function createPasskeyChallenge(opts) {
   const nonce = await (0, import_passkey_manager2.fetchWalletNonce)(opts.client, opts.walletAddress);
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    (0, import_passkey_manager2.decodeAddress)(opts.targetProgramAddress)
+  );
   const challenge = await (0, import_passkey_manager2.createValidateChallenge)(
     nonce,
     opts.accountCtx.accountAddresses,
-    opts.invokeIx
+    opts.accountCtx.walletAccountIdx,
+    opts.authIdx ?? 0,
+    {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData
+    }
   );
   return {
     challenge: (0, import_passkey_manager2.bytesToBase64Url)(challenge),
@@ -274,19 +282,25 @@ function base64ToBytes(base64) {
   throw new Error("Base64 decoding is not supported in this environment");
 }
 async function buildPasskeyTransaction(opts) {
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    (0, import_passkey_manager3.decodeAddress)(opts.targetProgramAddress)
+  );
   const validateIx = (0, import_passkey_manager3.encodeValidateInstruction)({
     walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
+    authIdx: opts.authIdx ?? 0,
+    targetInstruction: {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData
+    },
     signatureR: (0, import_passkey_manager3.hexToBytes)(opts.signatureR),
     signatureS: (0, import_passkey_manager3.hexToBytes)(opts.signatureS),
     authenticatorData: base64ToBytes(opts.authenticatorData),
     clientDataJSON: base64ToBytes(opts.clientDataJSON)
   });
-  const instructionData = (0, import_passkey_manager3.concatenateInstructions)([validateIx, opts.invokeIx]);
   const transaction = await opts.client.transactions.build({
     feePayer: { publicKey: opts.adminPublicKey },
     program: import_passkey_manager3.PASSKEY_MANAGER_PROGRAM_ADDRESS,
-    instructionData,
+    instructionData: validateIx,
     accounts: {
       readWrite: opts.accountCtx.readWriteAddresses,
       readOnly: opts.accountCtx.readOnlyAddresses
@@ -332,7 +346,9 @@ function createPasskeyHandlers(opts) {
         client: opts.client,
         walletAddress,
         accountCtx: context.accountCtx,
-        invokeIx: context.invokeIx
+        targetProgramAddress: context.targetProgramAddress,
+        instructionData: context.instructionData,
+        authIdx: context.authIdx
       });
       pendingContexts.set(
         createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),
@@ -363,7 +379,9 @@ function createPasskeyHandlers(opts) {
         adminPrivateKey: opts.adminPrivateKey,
         walletAddress,
         accountCtx: pending.context.accountCtx,
-        invokeIx: pending.context.invokeIx,
+        targetProgramAddress: pending.context.targetProgramAddress,
+        instructionData: pending.context.instructionData,
+        authIdx: pending.context.authIdx,
         ...signaturePayload
       });
     }

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/index.ts","../src/server/create-wallet.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["export type {\n  ThruClient,\n  PasskeySignaturePayload,\n  PasskeyChallengeSubmitPayload,\n  PasskeyTransactionHeaderOverrides,\n  BuiltPasskeyTransaction,\n  TransactionResult,\n  PasskeyChallengeResult,\n  PasskeyContextResult,\n} from './types';\n\nexport { createPasskeyWallet } from './create-wallet';\nexport { createPasskeyChallenge } from './challenge';\nexport { buildPasskeyTransaction, submitPasskeyTransaction } from './submit';\nexport { createPasskeyHandlers } from './handlers';\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/programs/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from \"./utils\";\nimport type { ThruClient } from \"./types\";\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? \"default\";\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(\n    seed,\n    PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  );\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: accountCtx.readWriteAddresses,\n        readOnly: accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== \"finalized\") {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined\n            ? ` (error code: ${result.errorCode})`\n            : \"\"\n        }`,\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: accountCtx.readWriteAddresses,\n            readOnly: accountCtx.readOnlyAddresses,\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(\n          transaction.toWire(),\n        );\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== \"finalized\") {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined\n                ? ` (error code: ${result.errorCode})`\n                : \"\"\n            }`,\n          );\n        }\n      });\n    } catch (error) {\n      console.warn(\"Credential registration failed (non-fatal):\", error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","import { encodeAddress } from '@thru/sdk/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  let finalizedSeen = false;\n\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  BuiltPasskeyTransaction,\n  PasskeySignaturePayload,\n  PasskeyTransactionHeaderOverrides,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nfunction base64ToBytes(base64: string): Uint8Array {\n  type BufferLike = {\n    from(value: string, encoding: 'base64'): Uint8Array;\n  };\n  const globalBuffer = (globalThis as { Buffer?: BufferLike }).Buffer;\n  if (globalBuffer) {\n    return globalBuffer.from(base64, 'base64');\n  }\n\n  if (typeof atob === 'function') {\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  }\n\n  throw new Error('Base64 decoding is not supported in this environment');\n}\n\n/**\n * Builds and signs a passkey-manager transaction without submitting it.\n *\n * Callers that override the transaction nonce are responsible for coordinating\n * fee-payer nonce allocation before calling this helper. Use\n * `submitPasskeyTransaction` for the serialized one-off submit path.\n */\nexport async function buildPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction> {\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: 0,\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: base64ToBytes(opts.authenticatorData),\n    clientDataJSON: base64ToBytes(opts.clientDataJSON),\n  });\n\n  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: {\n      fee: 0n,\n      ...opts.header,\n    },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  return {\n    transaction,\n    rawTransaction: transaction.toWire(),\n  };\n}\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const { rawTransaction } = await buildPasskeyTransaction(opts);\n    const signature = await opts.client.transactions.send(rawTransaction);\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,6BAUO;;;ACVP,qBAA8B;AAG9B,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI,gBAAgB;AAEpB,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,aAAO,8BAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;ADlHA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,UAAM,yCAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,UAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,iBAAa,4CAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,eAAW,gDAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,WAAW;AAAA,QACtB,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,wBAAoB,yCAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,UAAM;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,UAAM,mDAA2B,iBAAiB;AACnE,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,iBAAa,4CAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,iBAAa,4DAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,WAAW;AAAA,YACtB,UAAU,WAAW;AAAA,UACvB;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa;AAAA,UAC/C,YAAY,OAAO;AAAA,QACrB;AACA,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AExKA,IAAAA,0BAIO;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,UAAM,0CAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,UAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,eAAW,0CAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA,IAAAC,0BAKO;AAWP,SAAS,cAAc,QAA4B;AAIjD,QAAM,eAAgB,WAAuC;AAC7D,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,QAAQ,QAAQ;AAAA,EAC3C;AAEA,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,MAAM;AAC1B,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI,MAAM,sDAAsD;AACxE;AASA,eAAsB,wBAAwB,MAQiB;AAC7D,QAAM,iBAAa,mDAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS;AAAA,IACT,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,cAAc,KAAK,iBAAiB;AAAA,IACvD,gBAAgB,cAAc,KAAK,cAAc;AAAA,EACnD,CAAC;AAED,QAAM,sBAAkB,iDAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAAS;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ;AAAA,MACN,KAAK;AAAA,MACL,GAAG,KAAK;AAAA,IACV;AAAA,EACF,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,YAAY,OAAO;AAAA,EACrC;AACF;AAEA,eAAsB,yBAAyB,MAQU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,EAAE,eAAe,IAAI,MAAM,wBAAwB,IAAI;AAC7D,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,cAAc;AACpE,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACzFO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["import_passkey_manager","import_passkey_manager"]}
+{"version":3,"sources":["../src/server/index.ts","../src/server/create-wallet.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["export type {\n  ThruClient,\n  PasskeySignaturePayload,\n  PasskeyChallengeSubmitPayload,\n  PasskeyTransactionHeaderOverrides,\n  BuiltPasskeyTransaction,\n  TransactionResult,\n  PasskeyChallengeResult,\n  PasskeyContextResult,\n} from './types';\n\nexport { createPasskeyWallet } from './create-wallet';\nexport { createPasskeyChallenge } from './challenge';\nexport { buildPasskeyTransaction, submitPasskeyTransaction } from './submit';\nexport { createPasskeyHandlers } from './handlers';\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/programs/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from \"./utils\";\nimport type { ThruClient } from \"./types\";\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? \"default\";\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(\n    seed,\n    PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  );\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: accountCtx.readWriteAddresses,\n        readOnly: accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== \"finalized\") {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined\n            ? ` (error code: ${result.errorCode})`\n            : \"\"\n        }`,\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: accountCtx.readWriteAddresses,\n            readOnly: accountCtx.readOnlyAddresses,\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(\n          transaction.toWire(),\n        );\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== \"finalized\") {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined\n                ? ` (error code: ${result.errorCode})`\n                : \"\"\n            }`,\n          );\n        }\n      });\n    } catch (error) {\n      console.warn(\"Credential registration failed (non-fatal):\", error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","import { encodeAddress } from '@thru/sdk/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  let finalizedSeen = false;\n\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  decodeAddress,\n  fetchWalletNonce,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const targetProgramIdx = opts.accountCtx.getAccountIndex(\n    decodeAddress(opts.targetProgramAddress)\n  );\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.accountCtx.walletAccountIdx,\n    opts.authIdx ?? 0,\n    {\n      programIdx: targetProgramIdx,\n      instructionData: opts.instructionData,\n    }\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  decodeAddress,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  BuiltPasskeyTransaction,\n  PasskeySignaturePayload,\n  PasskeyTransactionHeaderOverrides,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nfunction base64ToBytes(base64: string): Uint8Array {\n  type BufferLike = {\n    from(value: string, encoding: 'base64'): Uint8Array;\n  };\n  const globalBuffer = (globalThis as { Buffer?: BufferLike }).Buffer;\n  if (globalBuffer) {\n    return globalBuffer.from(base64, 'base64');\n  }\n\n  if (typeof atob === 'function') {\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  }\n\n  throw new Error('Base64 decoding is not supported in this environment');\n}\n\n/**\n * Builds and signs a passkey-manager transaction without submitting it.\n *\n * Callers that override the transaction nonce are responsible for coordinating\n * fee-payer nonce allocation before calling this helper. Use\n * `submitPasskeyTransaction` for the serialized one-off submit path.\n */\nexport async function buildPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction> {\n  const targetProgramIdx = opts.accountCtx.getAccountIndex(\n    decodeAddress(opts.targetProgramAddress)\n  );\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: opts.authIdx ?? 0,\n    targetInstruction: {\n      programIdx: targetProgramIdx,\n      instructionData: opts.instructionData,\n    },\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: base64ToBytes(opts.authenticatorData),\n    clientDataJSON: base64ToBytes(opts.clientDataJSON),\n  });\n\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData: validateIx,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: {\n      fee: 0n,\n      ...opts.header,\n    },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  return {\n    transaction,\n    rawTransaction: transaction.toWire(),\n  };\n}\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const { rawTransaction } = await buildPasskeyTransaction(opts);\n    const signature = await opts.client.transactions.send(rawTransaction);\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        targetProgramAddress: context.targetProgramAddress,\n        instructionData: context.instructionData,\n        authIdx: context.authIdx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        targetProgramAddress: pending.context.targetProgramAddress,\n        instructionData: pending.context.instructionData,\n        authIdx: pending.context.authIdx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,6BAUO;;;ACVP,qBAA8B;AAG9B,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI,gBAAgB;AAEpB,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,aAAO,8BAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;ADlHA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,UAAM,yCAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,UAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,iBAAa,4CAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,eAAW,gDAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,WAAW;AAAA,QACtB,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,wBAAoB,yCAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,UAAM;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,UAAM,mDAA2B,iBAAiB;AACnE,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,iBAAa,4CAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,iBAAa,4DAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,WAAW;AAAA,YACtB,UAAU,WAAW;AAAA,UACvB;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa;AAAA,UAC/C,YAAY,OAAO;AAAA,QACrB;AACA,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AExKA,IAAAA,0BAKO;AAIP,eAAsB,uBAAuB,MAOT;AAClC,QAAM,QAAQ,UAAM,0CAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,mBAAmB,KAAK,WAAW;AAAA,QACvC,uCAAc,KAAK,oBAAoB;AAAA,EACzC;AACA,QAAM,YAAY,UAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB;AAAA,MACE,YAAY;AAAA,MACZ,iBAAiB,KAAK;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,eAAW,0CAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACpCA,IAAAC,0BAKO;AAWP,SAAS,cAAc,QAA4B;AAIjD,QAAM,eAAgB,WAAuC;AAC7D,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,QAAQ,QAAQ;AAAA,EAC3C;AAEA,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,MAAM;AAC1B,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI,MAAM,sDAAsD;AACxE;AASA,eAAsB,wBAAwB,MAUiB;AAC7D,QAAM,mBAAmB,KAAK,WAAW;AAAA,QACvC,uCAAc,KAAK,oBAAoB;AAAA,EACzC;AACA,QAAM,iBAAa,mDAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS,KAAK,WAAW;AAAA,IACzB,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,iBAAiB,KAAK;AAAA,IACxB;AAAA,IACA,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,gBAAY,oCAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,cAAc,KAAK,iBAAiB;AAAA,IACvD,gBAAgB,cAAc,KAAK,cAAc;AAAA,EACnD,CAAC;AAED,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAAS;AAAA,IACT,iBAAiB;AAAA,IACjB,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ;AAAA,MACN,KAAK;AAAA,MACL,GAAG,KAAK;AAAA,IACV;AAAA,EACF,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,YAAY,OAAO;AAAA,EACrC;AACF;AAEA,eAAsB,yBAAyB,MAUU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,EAAE,eAAe,IAAI,MAAM,wBAAwB,IAAI;AAC7D,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,cAAc;AACpE,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACnGO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,sBAAsB,QAAQ;AAAA,QAC9B,iBAAiB,QAAQ;AAAA,QACzB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,sBAAsB,QAAQ,QAAQ;AAAA,QACtC,iBAAiB,QAAQ,QAAQ;AAAA,QACjC,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["import_passkey_manager","import_passkey_manager"]}

package/dist/server.d.cts

@@ -81,7 +81,9 @@ interface PasskeyChallengeResult {
 }
 interface PasskeyContextResult {
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
 }
 
 declare function createPasskeyWallet(opts: {
@@ -102,7 +104,9 @@ declare function createPasskeyChallenge(opts: {
     client: ThruClient;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
 }): Promise<PasskeyChallengeResult>;
 
 /**
@@ -118,7 +122,9 @@ declare function buildPasskeyTransaction(opts: {
     adminPrivateKey: Uint8Array;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
     header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction>;
 declare function submitPasskeyTransaction(opts: {
@@ -127,7 +133,9 @@ declare function submitPasskeyTransaction(opts: {
     adminPrivateKey: Uint8Array;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
     header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<TransactionResult>;
 

package/dist/server.d.ts

@@ -81,7 +81,9 @@ interface PasskeyChallengeResult {
 }
 interface PasskeyContextResult {
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
 }
 
 declare function createPasskeyWallet(opts: {
@@ -102,7 +104,9 @@ declare function createPasskeyChallenge(opts: {
     client: ThruClient;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
 }): Promise<PasskeyChallengeResult>;
 
 /**
@@ -118,7 +122,9 @@ declare function buildPasskeyTransaction(opts: {
     adminPrivateKey: Uint8Array;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
     header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction>;
 declare function submitPasskeyTransaction(opts: {
@@ -127,7 +133,9 @@ declare function submitPasskeyTransaction(opts: {
     adminPrivateKey: Uint8Array;
     walletAddress: string;
     accountCtx: AccountContext;
-    invokeIx: Uint8Array;
+    targetProgramAddress: string;
+    instructionData: Uint8Array;
+    authIdx?: number;
     header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<TransactionResult>;
 

package/dist/server.js

@@ -225,14 +225,23 @@ async function createPasskeyWallet(opts) {
 import {
   bytesToBase64Url,
   createValidateChallenge,
+  decodeAddress,
   fetchWalletNonce
 } from "@thru/programs/passkey-manager";
 async function createPasskeyChallenge(opts) {
   const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    decodeAddress(opts.targetProgramAddress)
+  );
   const challenge = await createValidateChallenge(
     nonce,
     opts.accountCtx.accountAddresses,
-    opts.invokeIx
+    opts.accountCtx.walletAccountIdx,
+    opts.authIdx ?? 0,
+    {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData
+    }
   );
   return {
     challenge: bytesToBase64Url(challenge),
@@ -243,7 +252,7 @@ async function createPasskeyChallenge(opts) {
 // src/server/submit.ts
 import {
   PASSKEY_MANAGER_PROGRAM_ADDRESS as PASSKEY_MANAGER_PROGRAM_ADDRESS2,
-  concatenateInstructions,
+  decodeAddress as decodeAddress2,
   encodeValidateInstruction,
   hexToBytes
 } from "@thru/programs/passkey-manager";
@@ -263,19 +272,25 @@ function base64ToBytes(base64) {
   throw new Error("Base64 decoding is not supported in this environment");
 }
 async function buildPasskeyTransaction(opts) {
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    decodeAddress2(opts.targetProgramAddress)
+  );
   const validateIx = encodeValidateInstruction({
     walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
+    authIdx: opts.authIdx ?? 0,
+    targetInstruction: {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData
+    },
     signatureR: hexToBytes(opts.signatureR),
     signatureS: hexToBytes(opts.signatureS),
     authenticatorData: base64ToBytes(opts.authenticatorData),
     clientDataJSON: base64ToBytes(opts.clientDataJSON)
   });
-  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
   const transaction = await opts.client.transactions.build({
     feePayer: { publicKey: opts.adminPublicKey },
     program: PASSKEY_MANAGER_PROGRAM_ADDRESS2,
-    instructionData,
+    instructionData: validateIx,
     accounts: {
       readWrite: opts.accountCtx.readWriteAddresses,
       readOnly: opts.accountCtx.readOnlyAddresses
@@ -321,7 +336,9 @@ function createPasskeyHandlers(opts) {
         client: opts.client,
         walletAddress,
         accountCtx: context.accountCtx,
-        invokeIx: context.invokeIx
+        targetProgramAddress: context.targetProgramAddress,
+        instructionData: context.instructionData,
+        authIdx: context.authIdx
       });
       pendingContexts.set(
         createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),
@@ -352,7 +369,9 @@ function createPasskeyHandlers(opts) {
         adminPrivateKey: opts.adminPrivateKey,
         walletAddress,
         accountCtx: pending.context.accountCtx,
-        invokeIx: pending.context.invokeIx,
+        targetProgramAddress: pending.context.targetProgramAddress,
+        instructionData: pending.context.instructionData,
+        authIdx: pending.context.authIdx,
         ...signaturePayload
       });
     }