@thru/passkey 0.2.22 → 0.2.23

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/create-wallet.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/programs/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from \"./utils\";\nimport type { ThruClient } from \"./types\";\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? \"default\";\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(\n    seed,\n    PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  );\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: accountCtx.readWriteAddresses,\n        readOnly: accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== \"finalized\") {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined\n            ? ` (error code: ${result.errorCode})`\n            : \"\"\n        }`,\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: accountCtx.readWriteAddresses,\n            readOnly: accountCtx.readOnlyAddresses,\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(\n          transaction.toWire(),\n        );\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== \"finalized\") {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined\n                ? ` (error code: ${result.errorCode})`\n                : \"\"\n            }`,\n          );\n        }\n      });\n    } catch (error) {\n      console.warn(\"Credential registration failed (non-fatal):\", error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","import { encodeAddress } from '@thru/sdk/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  let finalizedSeen = false;\n\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  fetchWalletNonce,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.invokeIx\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  concatenateInstructions,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  BuiltPasskeyTransaction,\n  PasskeySignaturePayload,\n  PasskeyTransactionHeaderOverrides,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nfunction base64ToBytes(base64: string): Uint8Array {\n  type BufferLike = {\n    from(value: string, encoding: 'base64'): Uint8Array;\n  };\n  const globalBuffer = (globalThis as { Buffer?: BufferLike }).Buffer;\n  if (globalBuffer) {\n    return globalBuffer.from(base64, 'base64');\n  }\n\n  if (typeof atob === 'function') {\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  }\n\n  throw new Error('Base64 decoding is not supported in this environment');\n}\n\n/**\n * Builds and signs a passkey-manager transaction without submitting it.\n *\n * Callers that override the transaction nonce are responsible for coordinating\n * fee-payer nonce allocation before calling this helper. Use\n * `submitPasskeyTransaction` for the serialized one-off submit path.\n */\nexport async function buildPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction> {\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: 0,\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: base64ToBytes(opts.authenticatorData),\n    clientDataJSON: base64ToBytes(opts.clientDataJSON),\n  });\n\n  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: {\n      fee: 0n,\n      ...opts.header,\n    },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  return {\n    transaction,\n    rawTransaction: transaction.toWire(),\n  };\n}\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  invokeIx: Uint8Array;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const { rawTransaction } = await buildPasskeyTransaction(opts);\n    const signature = await opts.client.transactions.send(rawTransaction);\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        invokeIx: context.invokeIx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        invokeIx: pending.context.invokeIx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACVP,SAAS,qBAAqB;AAG9B,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI,gBAAgB;AAEpB,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;ADlHA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,MAAM,iBAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,aAAa,oBAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,wBAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,WAAW;AAAA,QACtB,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,oBAAoB,iBAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,MAAM;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,MAAM,2BAA2B,iBAAiB;AACnE,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,aAAa,oBAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,aAAa,oCAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,WAAW;AAAA,YACtB,UAAU,WAAW;AAAA,UACvB;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa;AAAA,UAC/C,YAAY,OAAO;AAAA,QACrB;AACA,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AExKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,eAAsB,uBAAuB,MAKT;AAClC,QAAM,QAAQ,MAAM,iBAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,WAAW,iBAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACzBA;AAAA,EACE,mCAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,cAAc,QAA4B;AAIjD,QAAM,eAAgB,WAAuC;AAC7D,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,QAAQ,QAAQ;AAAA,EAC3C;AAEA,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,MAAM;AAC1B,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI,MAAM,sDAAsD;AACxE;AASA,eAAsB,wBAAwB,MAQiB;AAC7D,QAAM,aAAa,0BAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS;AAAA,IACT,YAAY,WAAW,KAAK,UAAU;AAAA,IACtC,YAAY,WAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,cAAc,KAAK,iBAAiB;AAAA,IACvD,gBAAgB,cAAc,KAAK,cAAc;AAAA,EACnD,CAAC;AAED,QAAM,kBAAkB,wBAAwB,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3E,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAASC;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ;AAAA,MACN,KAAK;AAAA,MACL,GAAG,KAAK;AAAA,IACV;AAAA,EACF,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,YAAY,OAAO;AAAA,EACrC;AACF;AAEA,eAAsB,yBAAyB,MAQU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,EAAE,eAAe,IAAI,MAAM,wBAAwB,IAAI;AAC7D,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,cAAc;AACpE,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACzFO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,UAAU,QAAQ,QAAQ;AAAA,QAC1B,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["PASSKEY_MANAGER_PROGRAM_ADDRESS","PASSKEY_MANAGER_PROGRAM_ADDRESS"]}
+{"version":3,"sources":["../src/server/create-wallet.ts","../src/server/utils.ts","../src/server/challenge.ts","../src/server/submit.ts","../src/server/handlers.ts"],"sourcesContent":["import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  base64UrlToBytes,\n  buildAccountContext,\n  createCredentialLookupSeed,\n  createWalletSeed,\n  deriveCredentialLookupAddress,\n  deriveWalletAddress,\n  encodeCreateInstruction,\n  encodeRegisterCredentialInstruction,\n} from '@thru/programs/passkey-manager';\nimport {\n  toThruAddress,\n  getStateProof,\n  trackTransaction,\n  withSerializedFeePayer,\n} from \"./utils\";\nimport type { ThruClient } from \"./types\";\n\nexport async function createPasskeyWallet(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  adminAddress: string;\n  pubkeyX: Uint8Array;\n  pubkeyY: Uint8Array;\n  credentialId?: string;\n  walletName?: string;\n}): Promise<{ walletAddress: string; credentialLookupAddress?: string }> {\n  const walletName = opts.walletName ?? \"default\";\n  const seed = await createWalletSeed(walletName, opts.pubkeyX, opts.pubkeyY);\n  const walletBytes = await deriveWalletAddress(\n    seed,\n    PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  );\n  const walletAddress = toThruAddress(walletBytes);\n\n  await withSerializedFeePayer(opts.adminPublicKey, async () => {\n    let walletExists = false;\n    try {\n      await opts.client.accounts.get(walletAddress);\n      walletExists = true;\n    } catch {\n      walletExists = false;\n    }\n\n    if (walletExists) return;\n\n    const stateProof = await getStateProof(opts.client, walletAddress);\n    const accountCtx = buildAccountContext({\n      walletAddress,\n      readWriteAccounts: [],\n      readOnlyAccounts: [],\n      feePayerAddress: opts.adminAddress,\n      programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    });\n\n    const createIx = encodeCreateInstruction({\n      walletAccountIdx: accountCtx.walletAccountIdx,\n      authority: {\n        tag: 1,\n        pubkeyX: opts.pubkeyX,\n        pubkeyY: opts.pubkeyY,\n      },\n      seed,\n      stateProof,\n    });\n\n    const transaction = await opts.client.transactions.build({\n      feePayer: { publicKey: opts.adminPublicKey },\n      program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n      instructionData: createIx,\n      accounts: {\n        readWrite: accountCtx.readWriteAddresses,\n        readOnly: accountCtx.readOnlyAddresses,\n      },\n      header: { fee: 0n },\n    });\n\n    await transaction.sign(opts.adminPrivateKey);\n    const signature = await opts.client.transactions.send(transaction.toWire());\n    const result = await trackTransaction(opts.client, signature, 60000);\n    if (result.status !== \"finalized\") {\n      throw new Error(\n        `Wallet creation failed with status: ${result.status}${\n          result.errorCode !== undefined\n            ? ` (error code: ${result.errorCode})`\n            : \"\"\n        }`,\n      );\n    }\n  });\n\n  let credentialLookupAddress: string | undefined;\n  if (opts.credentialId) {\n    const credentialIdBytes = base64UrlToBytes(opts.credentialId);\n    const lookupAddressBytes = await deriveCredentialLookupAddress(\n      credentialIdBytes,\n      PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    );\n    const lookupAddress = toThruAddress(lookupAddressBytes);\n\n    credentialLookupAddress = lookupAddress;\n\n    try {\n      await withSerializedFeePayer(opts.adminPublicKey, async () => {\n        let lookupExists = false;\n        try {\n          await opts.client.accounts.get(lookupAddress);\n          lookupExists = true;\n        } catch {\n          lookupExists = false;\n        }\n\n        if (lookupExists) return;\n\n        const credSeed = await createCredentialLookupSeed(credentialIdBytes);\n        const stateProof = await getStateProof(opts.client, lookupAddress);\n        const accountCtx = buildAccountContext({\n          walletAddress,\n          readWriteAccounts: [lookupAddressBytes],\n          readOnlyAccounts: [],\n          feePayerAddress: opts.adminAddress,\n          programAddress: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n        });\n\n        const registerIx = encodeRegisterCredentialInstruction({\n          walletAccountIdx: accountCtx.walletAccountIdx,\n          lookupAccountIdx: accountCtx.getAccountIndex(lookupAddressBytes),\n          seed: credSeed,\n          stateProof,\n        });\n\n        const transaction = await opts.client.transactions.build({\n          feePayer: { publicKey: opts.adminPublicKey },\n          program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n          instructionData: registerIx,\n          accounts: {\n            readWrite: accountCtx.readWriteAddresses,\n            readOnly: accountCtx.readOnlyAddresses,\n          },\n          header: { fee: 0n },\n        });\n\n        await transaction.sign(opts.adminPrivateKey);\n        const signature = await opts.client.transactions.send(\n          transaction.toWire(),\n        );\n        const result = await trackTransaction(opts.client, signature, 60000);\n        if (result.status !== \"finalized\") {\n          throw new Error(\n            `Credential registration failed with status: ${result.status}${\n              result.errorCode !== undefined\n                ? ` (error code: ${result.errorCode})`\n                : \"\"\n            }`,\n          );\n        }\n      });\n    } catch (error) {\n      console.warn(\"Credential registration failed (non-fatal):\", error);\n    }\n  }\n\n  return {\n    walletAddress,\n    credentialLookupAddress,\n  };\n}\n","import { encodeAddress } from '@thru/sdk/helpers';\nimport type { ThruClient, TransactionResult } from './types';\n\nconst feePayerQueueSymbol = Symbol.for('thru.sharedFeePayerQueues');\n\nfunction getFeePayerQueues(): Map<string, Promise<void>> {\n  const globalQueues = globalThis as typeof globalThis & {\n    [feePayerQueueSymbol]?: Map<string, Promise<void>>;\n  };\n\n  if (!globalQueues[feePayerQueueSymbol]) {\n    globalQueues[feePayerQueueSymbol] = new Map<string, Promise<void>>();\n  }\n\n  return globalQueues[feePayerQueueSymbol];\n}\n\nexport async function getStateProof(\n  client: ThruClient,\n  address: string,\n  proofType: number = 1,\n  targetSlot?: bigint\n): Promise<Uint8Array> {\n  const proofRequest: {\n    address: string;\n    proofType: number;\n    targetSlot?: bigint;\n  } = {\n    address,\n    proofType,\n  };\n\n  if (targetSlot !== undefined) {\n    proofRequest.targetSlot = targetSlot;\n  }\n\n  const proof = await client.proofs.generate(proofRequest);\n\n  if (!proof.proof || proof.proof.length === 0) {\n    throw new Error(`No state proof returned for ${address}`);\n  }\n\n  return proof.proof;\n}\n\nexport async function trackTransaction(\n  client: ThruClient,\n  signature: string,\n  timeoutMs: number = 5000\n): Promise<TransactionResult> {\n  let finalizedSeen = false;\n\n  try {\n    for await (const update of client.transactions.track(signature, { timeoutMs })) {\n      if (update.executionResult) {\n        const vmError =\n          update.executionResult.vmError !== undefined && update.executionResult.vmError !== null\n            ? BigInt(update.executionResult.vmError)\n            : 0n;\n        const userErrorCode = update.executionResult.userErrorCode;\n        const executionError =\n          update.executionResult.executionResult !== undefined &&\n          update.executionResult.executionResult !== null\n            ? BigInt(update.executionResult.executionResult)\n            : 0n;\n        const success = vmError === 0n && executionError === 0n && userErrorCode === 0n;\n\n        return {\n          signature,\n          status: success ? 'finalized' : 'failed',\n          errorCode: vmError !== 0n ? vmError : executionError !== 0n ? executionError : userErrorCode,\n        };\n      }\n\n      if (update.statusCode === 3) {\n        finalizedSeen = true;\n      }\n    }\n\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n  } catch {\n    if (finalizedSeen) {\n      return {\n        signature,\n        status: 'finalized_without_execution',\n      };\n    }\n\n    return {\n      signature,\n      status: 'timeout',\n    };\n  }\n\n  return {\n    signature,\n    status: 'timeout',\n  };\n}\n\nexport function toThruAddress(bytes: Uint8Array): string {\n  return encodeAddress(bytes);\n}\n\nexport async function withSerializedFeePayer<T>(\n  feePayerPublicKey: Uint8Array,\n  work: () => Promise<T>\n): Promise<T> {\n  const queueKey = toThruAddress(feePayerPublicKey);\n  const feePayerQueues = getFeePayerQueues();\n  const previous = feePayerQueues.get(queueKey) ?? Promise.resolve();\n  let release!: () => void;\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  const tail = previous.then(() => current);\n  feePayerQueues.set(queueKey, tail);\n\n  await previous;\n\n  try {\n    return await work();\n  } finally {\n    release();\n    if (feePayerQueues.get(queueKey) === tail) {\n      feePayerQueues.delete(queueKey);\n    }\n  }\n}\n","import {\n  bytesToBase64Url,\n  createValidateChallenge,\n  decodeAddress,\n  fetchWalletNonce,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport type { PasskeyChallengeResult, ThruClient } from './types';\n\nexport async function createPasskeyChallenge(opts: {\n  client: ThruClient;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n}): Promise<PasskeyChallengeResult> {\n  const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);\n  const targetProgramIdx = opts.accountCtx.getAccountIndex(\n    decodeAddress(opts.targetProgramAddress)\n  );\n  const challenge = await createValidateChallenge(\n    nonce,\n    opts.accountCtx.accountAddresses,\n    opts.accountCtx.walletAccountIdx,\n    opts.authIdx ?? 0,\n    {\n      programIdx: targetProgramIdx,\n      instructionData: opts.instructionData,\n    }\n  );\n\n  return {\n    challenge: bytesToBase64Url(challenge),\n    nonce: nonce.toString(),\n  };\n}\n","import {\n  PASSKEY_MANAGER_PROGRAM_ADDRESS,\n  decodeAddress,\n  encodeValidateInstruction,\n  hexToBytes,\n} from '@thru/programs/passkey-manager';\nimport type { AccountContext } from '@thru/programs/passkey-manager';\nimport { trackTransaction, withSerializedFeePayer } from './utils';\nimport type {\n  BuiltPasskeyTransaction,\n  PasskeySignaturePayload,\n  PasskeyTransactionHeaderOverrides,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nfunction base64ToBytes(base64: string): Uint8Array {\n  type BufferLike = {\n    from(value: string, encoding: 'base64'): Uint8Array;\n  };\n  const globalBuffer = (globalThis as { Buffer?: BufferLike }).Buffer;\n  if (globalBuffer) {\n    return globalBuffer.from(base64, 'base64');\n  }\n\n  if (typeof atob === 'function') {\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes;\n  }\n\n  throw new Error('Base64 decoding is not supported in this environment');\n}\n\n/**\n * Builds and signs a passkey-manager transaction without submitting it.\n *\n * Callers that override the transaction nonce are responsible for coordinating\n * fee-payer nonce allocation before calling this helper. Use\n * `submitPasskeyTransaction` for the serialized one-off submit path.\n */\nexport async function buildPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction> {\n  const targetProgramIdx = opts.accountCtx.getAccountIndex(\n    decodeAddress(opts.targetProgramAddress)\n  );\n  const validateIx = encodeValidateInstruction({\n    walletAccountIdx: opts.accountCtx.walletAccountIdx,\n    authIdx: opts.authIdx ?? 0,\n    targetInstruction: {\n      programIdx: targetProgramIdx,\n      instructionData: opts.instructionData,\n    },\n    signatureR: hexToBytes(opts.signatureR),\n    signatureS: hexToBytes(opts.signatureS),\n    authenticatorData: base64ToBytes(opts.authenticatorData),\n    clientDataJSON: base64ToBytes(opts.clientDataJSON),\n  });\n\n  const transaction = await opts.client.transactions.build({\n    feePayer: { publicKey: opts.adminPublicKey },\n    program: PASSKEY_MANAGER_PROGRAM_ADDRESS,\n    instructionData: validateIx,\n    accounts: {\n      readWrite: opts.accountCtx.readWriteAddresses,\n      readOnly: opts.accountCtx.readOnlyAddresses,\n    },\n    header: {\n      fee: 0n,\n      ...opts.header,\n    },\n  });\n\n  await transaction.sign(opts.adminPrivateKey);\n  return {\n    transaction,\n    rawTransaction: transaction.toWire(),\n  };\n}\n\nexport async function submitPasskeyTransaction(opts: {\n  client: ThruClient;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  walletAddress: string;\n  accountCtx: AccountContext;\n  targetProgramAddress: string;\n  instructionData: Uint8Array;\n  authIdx?: number;\n  header?: PasskeyTransactionHeaderOverrides;\n} & PasskeySignaturePayload): Promise<TransactionResult> {\n  return withSerializedFeePayer(opts.adminPublicKey, async () => {\n    const { rawTransaction } = await buildPasskeyTransaction(opts);\n    const signature = await opts.client.transactions.send(rawTransaction);\n    return trackTransaction(opts.client, signature);\n  });\n}\n","import type { PasskeyContextResult } from './types';\nimport { createPasskeyChallenge } from './challenge';\nimport { submitPasskeyTransaction } from './submit';\nimport type {\n  PasskeyChallengeSubmitPayload,\n  ThruClient,\n  TransactionResult,\n} from './types';\n\nexport function createPasskeyHandlers<P>(opts: {\n  buildContext: (params: P) => Promise<PasskeyContextResult>;\n  adminPublicKey: Uint8Array;\n  adminPrivateKey: Uint8Array;\n  client: ThruClient;\n  challengeTtlMs?: number;\n}) {\n  const pendingContexts = new Map<\n    string,\n    { context: PasskeyContextResult; createdAt: number }\n  >();\n  const challengeTtlMs = opts.challengeTtlMs ?? 5 * 60_000;\n\n  function createPendingContextKey(\n    walletAddress: string,\n    nonce: string,\n    challenge: string\n  ): string {\n    return `${walletAddress}:${nonce}:${challenge}`;\n  }\n\n  function prunePendingContexts(now = Date.now()): void {\n    for (const [nonce, entry] of pendingContexts.entries()) {\n      if (now - entry.createdAt > challengeTtlMs) {\n        pendingContexts.delete(nonce);\n      }\n    }\n  }\n\n  return {\n    challenge: async (walletAddress: string, params: P) => {\n      prunePendingContexts();\n\n      const context = await opts.buildContext(params);\n      const challenge = await createPasskeyChallenge({\n        client: opts.client,\n        walletAddress,\n        accountCtx: context.accountCtx,\n        targetProgramAddress: context.targetProgramAddress,\n        instructionData: context.instructionData,\n        authIdx: context.authIdx,\n      });\n\n      pendingContexts.set(\n        createPendingContextKey(walletAddress, challenge.nonce, challenge.challenge),\n        {\n          context,\n          createdAt: Date.now(),\n        }\n      );\n\n      return challenge;\n    },\n    submit: async (\n      walletAddress: string,\n      params: P,\n      payload: PasskeyChallengeSubmitPayload\n    ): Promise<TransactionResult> => {\n      void params;\n      prunePendingContexts();\n\n      const pendingKey = createPendingContextKey(\n        walletAddress,\n        payload.nonce,\n        payload.challenge\n      );\n      const pending = pendingContexts.get(pendingKey);\n      if (!pending) {\n        throw new Error('Missing or expired challenge nonce');\n      }\n\n      pendingContexts.delete(pendingKey);\n      const { nonce: _nonce, challenge: _challenge, ...signaturePayload } = payload;\n\n      return submitPasskeyTransaction({\n        client: opts.client,\n        adminPublicKey: opts.adminPublicKey,\n        adminPrivateKey: opts.adminPrivateKey,\n        walletAddress,\n        accountCtx: pending.context.accountCtx,\n        targetProgramAddress: pending.context.targetProgramAddress,\n        instructionData: pending.context.instructionData,\n        authIdx: pending.context.authIdx,\n        ...signaturePayload,\n      });\n    },\n  };\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACVP,SAAS,qBAAqB;AAG9B,IAAM,sBAAsB,uBAAO,IAAI,2BAA2B;AAElE,SAAS,oBAAgD;AACvD,QAAM,eAAe;AAIrB,MAAI,CAAC,aAAa,mBAAmB,GAAG;AACtC,iBAAa,mBAAmB,IAAI,oBAAI,IAA2B;AAAA,EACrE;AAEA,SAAO,aAAa,mBAAmB;AACzC;AAEA,eAAsB,cACpB,QACA,SACA,YAAoB,GACpB,YACqB;AACrB,QAAM,eAIF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,MAAI,eAAe,QAAW;AAC5B,iBAAa,aAAa;AAAA,EAC5B;AAEA,QAAM,QAAQ,MAAM,OAAO,OAAO,SAAS,YAAY;AAEvD,MAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,UAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE;AAAA,EAC1D;AAEA,SAAO,MAAM;AACf;AAEA,eAAsB,iBACpB,QACA,WACA,YAAoB,KACQ;AAC5B,MAAI,gBAAgB;AAEpB,MAAI;AACF,qBAAiB,UAAU,OAAO,aAAa,MAAM,WAAW,EAAE,UAAU,CAAC,GAAG;AAC9E,UAAI,OAAO,iBAAiB;AAC1B,cAAM,UACJ,OAAO,gBAAgB,YAAY,UAAa,OAAO,gBAAgB,YAAY,OAC/E,OAAO,OAAO,gBAAgB,OAAO,IACrC;AACN,cAAM,gBAAgB,OAAO,gBAAgB;AAC7C,cAAM,iBACJ,OAAO,gBAAgB,oBAAoB,UAC3C,OAAO,gBAAgB,oBAAoB,OACvC,OAAO,OAAO,gBAAgB,eAAe,IAC7C;AACN,cAAM,UAAU,YAAY,MAAM,mBAAmB,MAAM,kBAAkB;AAE7E,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,WAAW,YAAY,KAAK,UAAU,mBAAmB,KAAK,iBAAiB;AAAA,QACjF;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,GAAG;AAC3B,wBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,QAAQ;AACN,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,OAA2B;AACvD,SAAO,cAAc,KAAK;AAC5B;AAEA,eAAsB,uBACpB,mBACA,MACY;AACZ,QAAM,WAAW,cAAc,iBAAiB;AAChD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,QAAQ,QAAQ;AACjE,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,cAAU;AAAA,EACZ,CAAC;AACD,QAAM,OAAO,SAAS,KAAK,MAAM,OAAO;AACxC,iBAAe,IAAI,UAAU,IAAI;AAEjC,QAAM;AAEN,MAAI;AACF,WAAO,MAAM,KAAK;AAAA,EACpB,UAAE;AACA,YAAQ;AACR,QAAI,eAAe,IAAI,QAAQ,MAAM,MAAM;AACzC,qBAAe,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;;;ADlHA,eAAsB,oBAAoB,MAS+B;AACvE,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,OAAO,MAAM,iBAAiB,YAAY,KAAK,SAAS,KAAK,OAAO;AAC1E,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACA,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,QAAI,eAAe;AACnB,QAAI;AACF,YAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,qBAAe;AAAA,IACjB,QAAQ;AACN,qBAAe;AAAA,IACjB;AAEA,QAAI,aAAc;AAElB,UAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,UAAM,aAAa,oBAAoB;AAAA,MACrC;AAAA,MACA,mBAAmB,CAAC;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,WAAW,wBAAwB;AAAA,MACvC,kBAAkB,WAAW;AAAA,MAC7B,WAAW;AAAA,QACT,KAAK;AAAA,QACL,SAAS,KAAK;AAAA,QACd,SAAS,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,MACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,MAC3C,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,WAAW,WAAW;AAAA,QACtB,UAAU,WAAW;AAAA,MACvB;AAAA,MACA,QAAQ,EAAE,KAAK,GAAG;AAAA,IACpB,CAAC;AAED,UAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO,CAAC;AAC1E,UAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,uCAAuC,OAAO,MAAM,GAClD,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI,KAAK,cAAc;AACrB,UAAM,oBAAoB,iBAAiB,KAAK,YAAY;AAC5D,UAAM,qBAAqB,MAAM;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,gBAAgB,cAAc,kBAAkB;AAEtD,8BAA0B;AAE1B,QAAI;AACF,YAAM,uBAAuB,KAAK,gBAAgB,YAAY;AAC5D,YAAI,eAAe;AACnB,YAAI;AACF,gBAAM,KAAK,OAAO,SAAS,IAAI,aAAa;AAC5C,yBAAe;AAAA,QACjB,QAAQ;AACN,yBAAe;AAAA,QACjB;AAEA,YAAI,aAAc;AAElB,cAAM,WAAW,MAAM,2BAA2B,iBAAiB;AACnE,cAAM,aAAa,MAAM,cAAc,KAAK,QAAQ,aAAa;AACjE,cAAM,aAAa,oBAAoB;AAAA,UACrC;AAAA,UACA,mBAAmB,CAAC,kBAAkB;AAAA,UACtC,kBAAkB,CAAC;AAAA,UACnB,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB,CAAC;AAED,cAAM,aAAa,oCAAoC;AAAA,UACrD,kBAAkB,WAAW;AAAA,UAC7B,kBAAkB,WAAW,gBAAgB,kBAAkB;AAAA,UAC/D,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AAED,cAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,UACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,UAC3C,SAAS;AAAA,UACT,iBAAiB;AAAA,UACjB,UAAU;AAAA,YACR,WAAW,WAAW;AAAA,YACtB,UAAU,WAAW;AAAA,UACvB;AAAA,UACA,QAAQ,EAAE,KAAK,GAAG;AAAA,QACpB,CAAC;AAED,cAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,cAAM,YAAY,MAAM,KAAK,OAAO,aAAa;AAAA,UAC/C,YAAY,OAAO;AAAA,QACrB;AACA,cAAM,SAAS,MAAM,iBAAiB,KAAK,QAAQ,WAAW,GAAK;AACnE,YAAI,OAAO,WAAW,aAAa;AACjC,gBAAM,IAAI;AAAA,YACR,+CAA+C,OAAO,MAAM,GAC1D,OAAO,cAAc,SACjB,iBAAiB,OAAO,SAAS,MACjC,EACN;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,KAAK,+CAA+C,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AExKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,eAAsB,uBAAuB,MAOT;AAClC,QAAM,QAAQ,MAAM,iBAAiB,KAAK,QAAQ,KAAK,aAAa;AACpE,QAAM,mBAAmB,KAAK,WAAW;AAAA,IACvC,cAAc,KAAK,oBAAoB;AAAA,EACzC;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB;AAAA,MACE,YAAY;AAAA,MACZ,iBAAiB,KAAK;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,iBAAiB,SAAS;AAAA,IACrC,OAAO,MAAM,SAAS;AAAA,EACxB;AACF;;;ACpCA;AAAA,EACE,mCAAAA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,cAAc,QAA4B;AAIjD,QAAM,eAAgB,WAAuC;AAC7D,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,QAAQ,QAAQ;AAAA,EAC3C;AAEA,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,MAAM;AAC1B,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,IAAI,MAAM,sDAAsD;AACxE;AASA,eAAsB,wBAAwB,MAUiB;AAC7D,QAAM,mBAAmB,KAAK,WAAW;AAAA,IACvCC,eAAc,KAAK,oBAAoB;AAAA,EACzC;AACA,QAAM,aAAa,0BAA0B;AAAA,IAC3C,kBAAkB,KAAK,WAAW;AAAA,IAClC,SAAS,KAAK,WAAW;AAAA,IACzB,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,iBAAiB,KAAK;AAAA,IACxB;AAAA,IACA,YAAY,WAAW,KAAK,UAAU;AAAA,IACtC,YAAY,WAAW,KAAK,UAAU;AAAA,IACtC,mBAAmB,cAAc,KAAK,iBAAiB;AAAA,IACvD,gBAAgB,cAAc,KAAK,cAAc;AAAA,EACnD,CAAC;AAED,QAAM,cAAc,MAAM,KAAK,OAAO,aAAa,MAAM;AAAA,IACvD,UAAU,EAAE,WAAW,KAAK,eAAe;AAAA,IAC3C,SAASC;AAAA,IACT,iBAAiB;AAAA,IACjB,UAAU;AAAA,MACR,WAAW,KAAK,WAAW;AAAA,MAC3B,UAAU,KAAK,WAAW;AAAA,IAC5B;AAAA,IACA,QAAQ;AAAA,MACN,KAAK;AAAA,MACL,GAAG,KAAK;AAAA,IACV;AAAA,EACF,CAAC;AAED,QAAM,YAAY,KAAK,KAAK,eAAe;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,YAAY,OAAO;AAAA,EACrC;AACF;AAEA,eAAsB,yBAAyB,MAUU;AACvD,SAAO,uBAAuB,KAAK,gBAAgB,YAAY;AAC7D,UAAM,EAAE,eAAe,IAAI,MAAM,wBAAwB,IAAI;AAC7D,UAAM,YAAY,MAAM,KAAK,OAAO,aAAa,KAAK,cAAc;AACpE,WAAO,iBAAiB,KAAK,QAAQ,SAAS;AAAA,EAChD,CAAC;AACH;;;ACnGO,SAAS,sBAAyB,MAMtC;AACD,QAAM,kBAAkB,oBAAI,IAG1B;AACF,QAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAElD,WAAS,wBACP,eACA,OACA,WACQ;AACR,WAAO,GAAG,aAAa,IAAI,KAAK,IAAI,SAAS;AAAA,EAC/C;AAEA,WAAS,qBAAqB,MAAM,KAAK,IAAI,GAAS;AACpD,eAAW,CAAC,OAAO,KAAK,KAAK,gBAAgB,QAAQ,GAAG;AACtD,UAAI,MAAM,MAAM,YAAY,gBAAgB;AAC1C,wBAAgB,OAAO,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW,OAAO,eAAuB,WAAc;AACrD,2BAAqB;AAErB,YAAM,UAAU,MAAM,KAAK,aAAa,MAAM;AAC9C,YAAM,YAAY,MAAM,uBAAuB;AAAA,QAC7C,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,sBAAsB,QAAQ;AAAA,QAC9B,iBAAiB,QAAQ;AAAA,QACzB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,sBAAgB;AAAA,QACd,wBAAwB,eAAe,UAAU,OAAO,UAAU,SAAS;AAAA,QAC3E;AAAA,UACE;AAAA,UACA,WAAW,KAAK,IAAI;AAAA,QACtB;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,QAAQ,OACN,eACA,QACA,YAC+B;AAC/B,WAAK;AACL,2BAAqB;AAErB,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AACA,YAAM,UAAU,gBAAgB,IAAI,UAAU;AAC9C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAEA,sBAAgB,OAAO,UAAU;AACjC,YAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,iBAAiB,IAAI;AAEtE,aAAO,yBAAyB;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,YAAY,QAAQ,QAAQ;AAAA,QAC5B,sBAAsB,QAAQ,QAAQ;AAAA,QACtC,iBAAiB,QAAQ,QAAQ;AAAA,QACjC,SAAS,QAAQ,QAAQ;AAAA,QACzB,GAAG;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["PASSKEY_MANAGER_PROGRAM_ADDRESS","decodeAddress","decodeAddress","PASSKEY_MANAGER_PROGRAM_ADDRESS"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thru/passkey",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -43,8 +43,8 @@
     }
   },
   "dependencies": {
-    "@thru/programs": "0.2.22",
-    "@thru/sdk": "0.2.22"
+    "@thru/sdk": "0.2.23",
+    "@thru/programs": "0.2.23"
   },
   "peerDependencies": {
     "expo-secure-store": "*",

package/src/auth/add-device.ts

@@ -4,7 +4,8 @@
    step can reuse the exact same flow.
 
    Builds the on-chain transaction:
-     VALIDATE(existingAuthority) + ADD_AUTHORITY(newPasskey) [+ REGISTER_CREDENTIAL]
+     VALIDATE(existingAuthority -> ADD_AUTHORITY(newPasskey))
+     or VALIDATE(existingAuthority -> multicall[ADD_AUTHORITY, REGISTER_CREDENTIAL])
    asks the caller's existing passkey to sign the challenge, then asks
    the caller's wallet signer to sign the assembled transaction, sends
    it, and returns the result. */
@@ -12,9 +13,9 @@
 import {
   type Authority,
   buildAccountContext,
-  concatenateInstructions,
   createValidateChallenge,
   createCredentialLookupSeed,
+  decodeAddress,
   deriveWalletAddress,
   encodeAddAuthorityInstruction,
   encodeRegisterCredentialInstruction,
@@ -23,6 +24,10 @@ import {
   type ParsedAuthority,
   type WalletSigner,
 } from "@thru/programs/passkey-manager";
+import {
+  MULTICALL_PROGRAM_PUBKEY,
+  buildMulticallInstruction,
+} from "@thru/programs/multicall";
 
 /** Minimal shape required from a passkey signer. Both web's
     `signWithDiscoverablePasskey`/`signWithPasskey` and mobile's
@@ -125,17 +130,14 @@ export async function addDeviceToAccount(
   /* The new authority will land at the next free slot. */
   const newAuthorityIdx = parsed.authorities.length;
 
-  /* Build the instruction sequence after the VALIDATE. */
-  const addAuthorityInstruction = encodeAddAuthorityInstruction({
-    authority: params.newAuthority,
-  });
-
-  let trailingInstructionData = addAuthorityInstruction;
   let readWriteAccounts: Uint8Array[] = [];
+  let lookupSeed: Uint8Array | undefined;
+  let lookupAddressBytes: Uint8Array | undefined;
+  let lookupProof: Uint8Array | undefined;
 
   if (params.credentialId) {
-    const lookupSeed = await createCredentialLookupSeed(params.credentialId);
-    const lookupAddressBytes = await deriveWalletAddress(
+    lookupSeed = await createCredentialLookupSeed(params.credentialId);
+    lookupAddressBytes = await deriveWalletAddress(
       lookupSeed,
       params.programAddress,
     );
@@ -145,39 +147,61 @@ export async function addDeviceToAccount(
       proofType: 1 /* StateProofType.CREATING */,
       address: lookupAddressBytes,
     });
+    lookupProof = proofResult.proof;
+    readWriteAccounts = [lookupAddressBytes];
+  }
 
-    const ctx = buildAccountContext({
-      walletAddress: params.walletAddress,
-      readWriteAccounts: [lookupAddressBytes],
-      readOnlyAccounts: [],
-    });
+  const ctx = buildAccountContext({
+    walletAddress: params.walletAddress,
+    readWriteAccounts,
+    readOnlyAccounts: params.credentialId ? [MULTICALL_PROGRAM_PUBKEY] : [],
+    programAddress: params.programAddress,
+  });
+
+  const passkeyProgramPubkey = decodeAddress(params.programAddress);
+  const addAuthorityInstruction = encodeAddAuthorityInstruction({
+    walletAccountIdx: ctx.walletAccountIdx,
+    authority: params.newAuthority,
+  });
+
+  let targetProgramIdx = ctx.getAccountIndex(passkeyProgramPubkey);
+  let targetInstructionData = addAuthorityInstruction;
+
+  if (params.credentialId) {
+    if (!lookupSeed || !lookupAddressBytes || !lookupProof) {
+      throw new Error("Credential lookup proof data missing");
+    }
 
     const registerCredentialInstruction = encodeRegisterCredentialInstruction({
       walletAccountIdx: ctx.walletAccountIdx,
       lookupAccountIdx: ctx.getAccountIndex(lookupAddressBytes),
       seed: lookupSeed,
-      stateProof: proofResult.proof,
+      stateProof: lookupProof,
     });
 
-    trailingInstructionData = concatenateInstructions([
-      addAuthorityInstruction,
-      registerCredentialInstruction,
+    targetProgramIdx = ctx.getAccountIndex(MULTICALL_PROGRAM_PUBKEY);
+    targetInstructionData = buildMulticallInstruction([
+      {
+        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),
+        instructionData: addAuthorityInstruction,
+      },
+      {
+        programIdx: ctx.getAccountIndex(passkeyProgramPubkey),
+        instructionData: registerCredentialInstruction,
+      },
     ]);
-    readWriteAccounts = [lookupAddressBytes];
   }
 
-  /* Build the VALIDATE challenge over (nonce, account_addresses,
-     trailing_instruction_data) and ask the caller's passkey to sign. */
-  const ctx = buildAccountContext({
-    walletAddress: params.walletAddress,
-    readWriteAccounts,
-    readOnlyAccounts: [],
-  });
-
+  /* Build the VALIDATE challenge over the target CPI and ask the caller's passkey to sign. */
   const challenge = await createValidateChallenge(
     parsed.nonce,
     ctx.accountAddresses,
-    trailingInstructionData,
+    ctx.walletAccountIdx,
+    params.authIdx,
+    {
+      programIdx: targetProgramIdx,
+      instructionData: targetInstructionData,
+    },
   );
 
   status("Waiting for passkey approval...");
@@ -186,27 +210,26 @@ export async function addDeviceToAccount(
   const validateInstruction = encodeValidateInstruction({
     walletAccountIdx: ctx.walletAccountIdx,
     authIdx: params.authIdx,
+    targetInstruction: {
+      programIdx: targetProgramIdx,
+      instructionData: targetInstructionData,
+    },
     signatureR: signature.signatureR,
     signatureS: signature.signatureS,
     authenticatorData: signature.authenticatorData,
     clientDataJSON: signature.clientDataJSON,
   });
 
-  const instructionData = concatenateInstructions([
-    validateInstruction,
-    trailingInstructionData,
-  ]);
-
   status("Sending transaction...");
   const result = await params.executor({
     thru: params.thru,
     walletSigner: params.walletSigner,
-    instructionData,
+    instructionData: validateInstruction,
     readWriteAddresses: ctx.readWriteAddresses,
     readOnlyAddresses: ctx.readOnlyAddresses,
     label: params.credentialId
-      ? "VALIDATE + ADD_AUTHORITY + REGISTER_CREDENTIAL"
-      : "VALIDATE + ADD_AUTHORITY",
+      ? "VALIDATE -> MULTICALL(ADD_AUTHORITY, REGISTER_CREDENTIAL)"
+      : "VALIDATE -> ADD_AUTHORITY",
   });
 
   return { ...result, newAuthorityIdx };

package/src/server/challenge.ts

@@ -1,6 +1,7 @@
 import {
   bytesToBase64Url,
   createValidateChallenge,
+  decodeAddress,
   fetchWalletNonce,
 } from '@thru/programs/passkey-manager';
 import type { AccountContext } from '@thru/programs/passkey-manager';
@@ -10,13 +11,23 @@ export async function createPasskeyChallenge(opts: {
   client: ThruClient;
   walletAddress: string;
   accountCtx: AccountContext;
-  invokeIx: Uint8Array;
+  targetProgramAddress: string;
+  instructionData: Uint8Array;
+  authIdx?: number;
 }): Promise<PasskeyChallengeResult> {
   const nonce = await fetchWalletNonce(opts.client, opts.walletAddress);
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    decodeAddress(opts.targetProgramAddress)
+  );
   const challenge = await createValidateChallenge(
     nonce,
     opts.accountCtx.accountAddresses,
-    opts.invokeIx
+    opts.accountCtx.walletAccountIdx,
+    opts.authIdx ?? 0,
+    {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData,
+    }
   );
 
   return {

package/src/server/handlers.ts

@@ -45,7 +45,9 @@ export function createPasskeyHandlers<P>(opts: {
         client: opts.client,
         walletAddress,
         accountCtx: context.accountCtx,
-        invokeIx: context.invokeIx,
+        targetProgramAddress: context.targetProgramAddress,
+        instructionData: context.instructionData,
+        authIdx: context.authIdx,
       });
 
       pendingContexts.set(
@@ -85,7 +87,9 @@ export function createPasskeyHandlers<P>(opts: {
         adminPrivateKey: opts.adminPrivateKey,
         walletAddress,
         accountCtx: pending.context.accountCtx,
-        invokeIx: pending.context.invokeIx,
+        targetProgramAddress: pending.context.targetProgramAddress,
+        instructionData: pending.context.instructionData,
+        authIdx: pending.context.authIdx,
         ...signaturePayload,
       });
     },

package/src/server/submit.test.ts

@@ -2,19 +2,23 @@ import { describe, expect, it, vi } from 'vitest';
 import type { AccountContext } from '@thru/programs/passkey-manager';
 import type { ThruClient } from './types';
 
-vi.mock('@thru/programs/passkey-manager', () => ({
+const passkeyManagerMocks = vi.hoisted(() => ({
   PASSKEY_MANAGER_PROGRAM_ADDRESS: 'passkey-program',
-  concatenateInstructions: (instructions: Uint8Array[]) => new Uint8Array(instructions.flatMap((ix) => Array.from(ix))),
-  encodeValidateInstruction: () => new Uint8Array([1, 2]),
+  decodeAddress: vi.fn(() => new Uint8Array(32).fill(7)),
+  encodeValidateInstruction: vi.fn(() => new Uint8Array([1, 2])),
   hexToBytes: (value: string) => new Uint8Array(Buffer.from(value, 'hex')),
 }));
 
+vi.mock('@thru/programs/passkey-manager', () => passkeyManagerMocks);
+
 import { buildPasskeyTransaction, submitPasskeyTransaction } from './submit';
 
 const accountCtx = {
   walletAccountIdx: 3,
+  accountAddresses: ['fee-payer', 'passkey-program', 'wallet-address', 'readonly-address'],
   readWriteAddresses: ['lookup-address', 'wallet-address'],
   readOnlyAddresses: ['readonly-address'],
+  getAccountIndex: vi.fn(() => 4),
 } as AccountContext;
 
 const signaturePayload = {
@@ -58,7 +62,8 @@ describe('passkey submit', () => {
       adminPrivateKey: new Uint8Array(32).fill(2),
       walletAddress: 'wallet-address',
       accountCtx,
-      invokeIx: new Uint8Array([3, 4]),
+      targetProgramAddress: 'target-program',
+      instructionData: new Uint8Array([3, 4]),
       header: {
         fee: 0n,
         nonce: 42n,
@@ -76,7 +81,19 @@ describe('passkey submit', () => {
         fee: 0n,
         nonce: 42n,
       },
+      instructionData: new Uint8Array([1, 2]),
     }));
+    expect(passkeyManagerMocks.decodeAddress).toHaveBeenCalledWith('target-program');
+    expect(passkeyManagerMocks.encodeValidateInstruction).toHaveBeenCalledWith(
+      expect.objectContaining({
+        walletAccountIdx: 3,
+        authIdx: 0,
+        targetInstruction: {
+          programIdx: 4,
+          instructionData: new Uint8Array([3, 4]),
+        },
+      })
+    );
     expect(transaction.sign).toHaveBeenCalledWith(new Uint8Array(32).fill(2));
     expect(result.rawTransaction).toEqual(new Uint8Array([9, 9, 9]));
   });
@@ -90,7 +107,8 @@ describe('passkey submit', () => {
       adminPrivateKey: new Uint8Array(32).fill(2),
       walletAddress: 'wallet-address',
       accountCtx,
-      invokeIx: new Uint8Array([3, 4]),
+      targetProgramAddress: 'target-program',
+      instructionData: new Uint8Array([3, 4]),
       ...signaturePayload,
     })).resolves.toEqual({
       signature: 'tx-signature',

package/src/server/submit.ts

@@ -1,6 +1,6 @@
 import {
   PASSKEY_MANAGER_PROGRAM_ADDRESS,
-  concatenateInstructions,
+  decodeAddress,
   encodeValidateInstruction,
   hexToBytes,
 } from '@thru/programs/passkey-manager';
@@ -48,23 +48,31 @@ export async function buildPasskeyTransaction(opts: {
   adminPrivateKey: Uint8Array;
   walletAddress: string;
   accountCtx: AccountContext;
-  invokeIx: Uint8Array;
+  targetProgramAddress: string;
+  instructionData: Uint8Array;
+  authIdx?: number;
   header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<BuiltPasskeyTransaction> {
+  const targetProgramIdx = opts.accountCtx.getAccountIndex(
+    decodeAddress(opts.targetProgramAddress)
+  );
   const validateIx = encodeValidateInstruction({
     walletAccountIdx: opts.accountCtx.walletAccountIdx,
-    authIdx: 0,
+    authIdx: opts.authIdx ?? 0,
+    targetInstruction: {
+      programIdx: targetProgramIdx,
+      instructionData: opts.instructionData,
+    },
     signatureR: hexToBytes(opts.signatureR),
     signatureS: hexToBytes(opts.signatureS),
     authenticatorData: base64ToBytes(opts.authenticatorData),
     clientDataJSON: base64ToBytes(opts.clientDataJSON),
   });
 
-  const instructionData = concatenateInstructions([validateIx, opts.invokeIx]);
   const transaction = await opts.client.transactions.build({
     feePayer: { publicKey: opts.adminPublicKey },
     program: PASSKEY_MANAGER_PROGRAM_ADDRESS,
-    instructionData,
+    instructionData: validateIx,
     accounts: {
       readWrite: opts.accountCtx.readWriteAddresses,
       readOnly: opts.accountCtx.readOnlyAddresses,
@@ -88,7 +96,9 @@ export async function submitPasskeyTransaction(opts: {
   adminPrivateKey: Uint8Array;
   walletAddress: string;
   accountCtx: AccountContext;
-  invokeIx: Uint8Array;
+  targetProgramAddress: string;
+  instructionData: Uint8Array;
+  authIdx?: number;
   header?: PasskeyTransactionHeaderOverrides;
 } & PasskeySignaturePayload): Promise<TransactionResult> {
   return withSerializedFeePayer(opts.adminPublicKey, async () => {

package/src/server/types.ts

@@ -79,5 +79,7 @@ export interface PasskeyChallengeResult {
 
 export interface PasskeyContextResult {
   accountCtx: AccountContext;
-  invokeIx: Uint8Array;
+  targetProgramAddress: string;
+  instructionData: Uint8Array;
+  authIdx?: number;
 }

package/dist/chunk-QAQNRQ7G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/add-device.ts"],"sourcesContent":["/* Add-passkey-to-account transaction builder, lifted from\n   `web/wallet-auth-manager/app/page.tsx` (`runValidateThen`,\n   `handleSubmitAddPasskey`) so the wallet's `/embedded` post-connect\n   step can reuse the exact same flow.\n\n   Builds the on-chain transaction:\n     VALIDATE(existingAuthority) + ADD_AUTHORITY(newPasskey) [+ REGISTER_CREDENTIAL]\n   asks the caller's existing passkey to sign the challenge, then asks\n   the caller's wallet signer to sign the assembled transaction, sends\n   it, and returns the result. */\n\nimport {\n  type Authority,\n  buildAccountContext,\n  concatenateInstructions,\n  createValidateChallenge,\n  createCredentialLookupSeed,\n  deriveWalletAddress,\n  encodeAddAuthorityInstruction,\n  encodeRegisterCredentialInstruction,\n  encodeValidateInstruction,\n  parseWalletAuthorities,\n  type ParsedAuthority,\n  type WalletSigner,\n} from \"@thru/programs/passkey-manager\";\n\n/** Minimal shape required from a passkey signer. Both web's\n    `signWithDiscoverablePasskey`/`signWithPasskey` and mobile's\n    counterparts conform. */\nexport interface PasskeyChallengeSigner {\n  signChallenge: (challenge: Uint8Array) => Promise<{\n    signatureR: Uint8Array;\n    signatureS: Uint8Array;\n    authenticatorData: Uint8Array;\n    clientDataJSON: Uint8Array;\n  }>;\n}\n\n/** Minimal shape required from a Thru chain client. Loosely-typed\n    because @thru/sdk's DTS emit is currently broken in this\n    repo. The caller passes the real Thru and we narrow operationally. */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type AnyThruClient = any;\n\nexport interface AddDeviceParams {\n  /** Loosely-typed Thru chain client (`@thru/sdk/client`). */\n  thru: AnyThruClient;\n  /** Wallet (the on-chain WalletAccount) to attach the passkey to. */\n  walletAddress: string;\n  /** Index of the existing authority that approves this change. Must\n      currently be a passkey authority. */\n  authIdx: number;\n  /** New passkey to attach. tag = 1 (passkey). */\n  newAuthority: Authority;\n  /** Optional credential-lookup registration so the new passkey is\n      discoverable on subsequent sign-ins. */\n  credentialId?: Uint8Array;\n  walletName?: string;\n  /** Existing-passkey challenge signer (web or mobile). */\n  passkey: PasskeyChallengeSigner;\n  /** Wallet transaction signer that returns base64(signed bytes). */\n  walletSigner: WalletSigner;\n  /** Passkey program address (base58). */\n  programAddress: string;\n  /** Sign-and-send executor (lifted from passkey-transaction.ts in the\n      wallet-auth-manager - wallet apps own this because it depends on\n      the `Thru` client's transaction builder). */\n  executor: TxExecutor;\n  /** Optional status callback so UIs can show progress. */\n  onStatus?: (message: string) => void;\n}\n\nexport interface TxExecutorParams {\n  thru: AnyThruClient;\n  walletSigner: WalletSigner;\n  instructionData: Uint8Array;\n  readWriteAddresses: string[];\n  readOnlyAddresses: string[];\n  label: string;\n}\n\nexport interface TxExecutorResult {\n  signature: string;\n  /** Loosely-typed because @thru/sdk types aren't available. */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  execution: any;\n}\n\nexport type TxExecutor = (\n  params: TxExecutorParams,\n) => Promise<TxExecutorResult>;\n\nexport interface AddDeviceResult extends TxExecutorResult {\n  /** The new passkey's authority index after the transaction lands. */\n  newAuthorityIdx: number;\n}\n\n/**\n * Run VALIDATE + ADD_AUTHORITY [+ REGISTER_CREDENTIAL] to attach a new\n * passkey to an on-chain WalletAccount.\n */\nexport async function addDeviceToAccount(\n  params: AddDeviceParams,\n): Promise<AddDeviceResult> {\n  const status = params.onStatus ?? (() => {});\n\n  const walletAccount = await params.thru.accounts.get(params.walletAddress);\n  const walletData: Uint8Array | undefined = walletAccount?.data?.data;\n  if (!walletData) {\n    throw new Error(\"Wallet account data missing\");\n  }\n\n  const parsed = parseWalletAuthorities(walletData);\n  const authorizing: ParsedAuthority | undefined =\n    parsed.authorities[params.authIdx];\n  if (!authorizing) {\n    throw new Error(\"Authorization index out of bounds\");\n  }\n  if (authorizing.kind !== \"passkey\") {\n    throw new Error(\n      \"addDeviceToAccount currently requires a passkey authority for VALIDATE\",\n    );\n  }\n\n  /* The new authority will land at the next free slot. */\n  const newAuthorityIdx = parsed.authorities.length;\n\n  /* Build the instruction sequence after the VALIDATE. */\n  const addAuthorityInstruction = encodeAddAuthorityInstruction({\n    authority: params.newAuthority,\n  });\n\n  let trailingInstructionData = addAuthorityInstruction;\n  let readWriteAccounts: Uint8Array[] = [];\n\n  if (params.credentialId) {\n    const lookupSeed = await createCredentialLookupSeed(params.credentialId);\n    const lookupAddressBytes = await deriveWalletAddress(\n      lookupSeed,\n      params.programAddress,\n    );\n\n    status(\"Fetching state proof for credential lookup...\");\n    const proofResult = await params.thru.proofs.generate({\n      proofType: 1 /* StateProofType.CREATING */,\n      address: lookupAddressBytes,\n    });\n\n    const ctx = buildAccountContext({\n      walletAddress: params.walletAddress,\n      readWriteAccounts: [lookupAddressBytes],\n      readOnlyAccounts: [],\n    });\n\n    const registerCredentialInstruction = encodeRegisterCredentialInstruction({\n      walletAccountIdx: ctx.walletAccountIdx,\n      lookupAccountIdx: ctx.getAccountIndex(lookupAddressBytes),\n      seed: lookupSeed,\n      stateProof: proofResult.proof,\n    });\n\n    trailingInstructionData = concatenateInstructions([\n      addAuthorityInstruction,\n      registerCredentialInstruction,\n    ]);\n    readWriteAccounts = [lookupAddressBytes];\n  }\n\n  /* Build the VALIDATE challenge over (nonce, account_addresses,\n     trailing_instruction_data) and ask the caller's passkey to sign. */\n  const ctx = buildAccountContext({\n    walletAddress: params.walletAddress,\n    readWriteAccounts,\n    readOnlyAccounts: [],\n  });\n\n  const challenge = await createValidateChallenge(\n    parsed.nonce,\n    ctx.accountAddresses,\n    trailingInstructionData,\n  );\n\n  status(\"Waiting for passkey approval...\");\n  const signature = await params.passkey.signChallenge(challenge);\n\n  const validateInstruction = encodeValidateInstruction({\n    walletAccountIdx: ctx.walletAccountIdx,\n    authIdx: params.authIdx,\n    signatureR: signature.signatureR,\n    signatureS: signature.signatureS,\n    authenticatorData: signature.authenticatorData,\n    clientDataJSON: signature.clientDataJSON,\n  });\n\n  const instructionData = concatenateInstructions([\n    validateInstruction,\n    trailingInstructionData,\n  ]);\n\n  status(\"Sending transaction...\");\n  const result = await params.executor({\n    thru: params.thru,\n    walletSigner: params.walletSigner,\n    instructionData,\n    readWriteAddresses: ctx.readWriteAddresses,\n    readOnlyAddresses: ctx.readOnlyAddresses,\n    label: params.credentialId\n      ? \"VALIDATE + ADD_AUTHORITY + REGISTER_CREDENTIAL\"\n      : \"VALIDATE + ADD_AUTHORITY\",\n  });\n\n  return { ...result, newAuthorityIdx };\n}\n"],"mappings":";AAWA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AA6EP,eAAsB,mBACpB,QAC0B;AAC1B,QAAM,SAAS,OAAO,aAAa,MAAM;AAAA,EAAC;AAE1C,QAAM,gBAAgB,MAAM,OAAO,KAAK,SAAS,IAAI,OAAO,aAAa;AACzE,QAAM,aAAqC,eAAe,MAAM;AAChE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,QAAM,SAAS,uBAAuB,UAAU;AAChD,QAAM,cACJ,OAAO,YAAY,OAAO,OAAO;AACnC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,MAAI,YAAY,SAAS,WAAW;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,kBAAkB,OAAO,YAAY;AAG3C,QAAM,0BAA0B,8BAA8B;AAAA,IAC5D,WAAW,OAAO;AAAA,EACpB,CAAC;AAED,MAAI,0BAA0B;AAC9B,MAAI,oBAAkC,CAAC;AAEvC,MAAI,OAAO,cAAc;AACvB,UAAM,aAAa,MAAM,2BAA2B,OAAO,YAAY;AACvE,UAAM,qBAAqB,MAAM;AAAA,MAC/B;AAAA,MACA,OAAO;AAAA,IACT;AAEA,WAAO,+CAA+C;AACtD,UAAM,cAAc,MAAM,OAAO,KAAK,OAAO,SAAS;AAAA,MACpD,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAED,UAAMA,OAAM,oBAAoB;AAAA,MAC9B,eAAe,OAAO;AAAA,MACtB,mBAAmB,CAAC,kBAAkB;AAAA,MACtC,kBAAkB,CAAC;AAAA,IACrB,CAAC;AAED,UAAM,gCAAgC,oCAAoC;AAAA,MACxE,kBAAkBA,KAAI;AAAA,MACtB,kBAAkBA,KAAI,gBAAgB,kBAAkB;AAAA,MACxD,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,IAC1B,CAAC;AAED,8BAA0B,wBAAwB;AAAA,MAChD;AAAA,MACA;AAAA,IACF,CAAC;AACD,wBAAoB,CAAC,kBAAkB;AAAA,EACzC;AAIA,QAAM,MAAM,oBAAoB;AAAA,IAC9B,eAAe,OAAO;AAAA,IACtB;AAAA,IACA,kBAAkB,CAAC;AAAA,EACrB,CAAC;AAED,QAAM,YAAY,MAAM;AAAA,IACtB,OAAO;AAAA,IACP,IAAI;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,iCAAiC;AACxC,QAAM,YAAY,MAAM,OAAO,QAAQ,cAAc,SAAS;AAE9D,QAAM,sBAAsB,0BAA0B;AAAA,IACpD,kBAAkB,IAAI;AAAA,IACtB,SAAS,OAAO;AAAA,IAChB,YAAY,UAAU;AAAA,IACtB,YAAY,UAAU;AAAA,IACtB,mBAAmB,UAAU;AAAA,IAC7B,gBAAgB,UAAU;AAAA,EAC5B,CAAC;AAED,QAAM,kBAAkB,wBAAwB;AAAA,IAC9C;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,wBAAwB;AAC/B,QAAM,SAAS,MAAM,OAAO,SAAS;AAAA,IACnC,MAAM,OAAO;AAAA,IACb,cAAc,OAAO;AAAA,IACrB;AAAA,IACA,oBAAoB,IAAI;AAAA,IACxB,mBAAmB,IAAI;AAAA,IACvB,OAAO,OAAO,eACV,mDACA;AAAA,EACN,CAAC;AAED,SAAO,EAAE,GAAG,QAAQ,gBAAgB;AACtC;","names":["ctx"]}