@thru/programs 0.2.22

package/dist/passkey-manager/index.d.cts

@@ -0,0 +1,319 @@
+export { decodeAddress, encodeAddress } from '@thru/sdk/helpers';
+
+declare const PASSKEY_MANAGER_PROGRAM_ADDRESS = "taUDdQyFxvM5i0HFRkEK3W45kWLyblAHSnMg4zplgUnz6Z";
+declare const INSTRUCTION_CREATE = 0;
+declare const INSTRUCTION_VALIDATE = 1;
+declare const INSTRUCTION_TRANSFER = 2;
+declare const INSTRUCTION_INVOKE = 3;
+declare const INSTRUCTION_ADD_AUTHORITY = 4;
+declare const INSTRUCTION_REMOVE_AUTHORITY = 5;
+declare const INSTRUCTION_REGISTER_CREDENTIAL = 6;
+declare const AUTHORITY_TAG_PASSKEY = 1;
+declare const AUTHORITY_TAG_PUBKEY = 2;
+
+/**
+ * Result of passkey registration (credential creation).
+ */
+interface PasskeyRegistrationResult {
+    credentialId: string;
+    publicKeyX: string;
+    publicKeyY: string;
+    rpId: string;
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+}
+/**
+ * Result of passkey signing (assertion).
+ */
+interface PasskeySigningResult {
+    signature: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    signatureR: Uint8Array;
+    signatureS: Uint8Array;
+    /** WebAuthn authenticator attachment, if surfaced by the browser:
+     *  - 'platform': built-in / passkey on this device
+     *  - 'cross-platform': e.g. signed in via QR using another device
+     *  Used by the wallet to decide whether to offer "add this device". */
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+}
+/**
+ * Signing result with discoverable credential info.
+ */
+interface PasskeyDiscoverableSigningResult extends PasskeySigningResult {
+    credentialId: string;
+    rpId: string;
+}
+/**
+ * Passkey metadata stored locally (the actual private key lives in the device's secure enclave).
+ */
+interface PasskeyMetadata {
+    credentialId: string;
+    publicKeyX: string;
+    publicKeyY: string;
+    rpId: string;
+    /** On-chain passkey authority index for this wallet account.
+     *  Omitted for the primary authority, which defaults to index 0. */
+    authIdx?: number;
+    label?: string;
+    deviceName?: string;
+    devicePlatform?: string;
+    browserName?: string;
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+    createdAt: string;
+    lastUsedAt: string;
+}
+type Authority = {
+    tag: 1;
+    pubkeyX: Uint8Array;
+    pubkeyY: Uint8Array;
+} | {
+    tag: 2;
+    pubkey: Uint8Array;
+};
+interface CreateInstructionParams {
+    walletAccountIdx: number;
+    authority: Authority;
+    seed: Uint8Array;
+    stateProof: Uint8Array;
+}
+interface TransferInstructionParams {
+    walletAccountIdx: number;
+    toAccountIdx: number;
+    amount: bigint;
+}
+interface ValidateInstructionParams {
+    walletAccountIdx: number;
+    authIdx: number;
+    signatureR: Uint8Array;
+    signatureS: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+}
+interface AccountContext {
+    readWriteAddresses: string[];
+    readOnlyAddresses: string[];
+    accountAddresses: string[];
+    walletAccountIdx: number;
+    getAccountIndex: (pubkey: Uint8Array) => number;
+}
+interface RegisterCredentialInstructionParams {
+    walletAccountIdx: number;
+    lookupAccountIdx: number;
+    seed: Uint8Array;
+    stateProof: Uint8Array;
+}
+type WalletSigner = {
+    signTransaction: (payloadBase64: string) => Promise<string>;
+};
+type TransactionExecutionSummary = {
+    executionResult?: bigint | number | null;
+    userErrorCode?: bigint | number | null;
+    vmError?: number | string | bigint | null;
+};
+
+declare function encodeCreateInstruction(params: CreateInstructionParams): Uint8Array;
+
+declare function encodeValidateInstruction(params: ValidateInstructionParams): Uint8Array;
+
+declare function encodeTransferInstruction(params: TransferInstructionParams): Uint8Array;
+
+declare function encodeInvokeInstruction(programPubkey: Uint8Array, instruction: Uint8Array): Uint8Array;
+
+declare function encodeAddAuthorityInstruction(params: {
+    authority: Authority;
+}): Uint8Array;
+
+declare function encodeRemoveAuthorityInstruction(params: {
+    authIdx: number;
+}): Uint8Array;
+
+declare function encodeRegisterCredentialInstruction(params: RegisterCredentialInstructionParams): Uint8Array;
+
+declare function concatenateInstructions(instructions: Uint8Array[]): Uint8Array;
+
+/**
+ * Create challenge for VALIDATE instruction.
+ * SHA256(nonce || account_0 || account_1 || ... || trailing_instruction_bytes)
+ */
+declare function createValidateChallenge(nonce: bigint, accountAddresses: string[], trailingInstructionData: Uint8Array): Promise<Uint8Array>;
+
+/**
+ * Create a 32-byte seed from wallet name and passkey coordinates.
+ * SHA-256(walletName || pubkey_x || pubkey_y)
+ */
+declare function createWalletSeed(walletName: string, pubkeyX: Uint8Array, pubkeyY: Uint8Array): Promise<Uint8Array>;
+/**
+ * Derive wallet account address from seed using proper PDA derivation.
+ * SHA256(program_address || is_ephemeral || seed)
+ */
+declare function deriveWalletAddress(seed: Uint8Array, programAddress: string): Promise<Uint8Array>;
+/**
+ * Create a 32-byte seed for a credential lookup PDA.
+ * SHA-256(credentialId)
+ */
+declare function createCredentialLookupSeed(credentialId: Uint8Array): Promise<Uint8Array>;
+/**
+ * Derive credential lookup PDA address from a credential ID.
+ * Convenience wrapper: deriveWalletAddress(SHA-256(credentialId), programAddress)
+ */
+declare function deriveCredentialLookupAddress(credentialId: Uint8Array, programAddress: string): Promise<Uint8Array>;
+
+/**
+ * Default fee payer address (manager profile).
+ */
+declare const FEE_PAYER_ADDRESS = "taVcZv3wB2m-euBpMHm2rF9fQRY_fO_g7WdOjs70CxDh_S";
+/**
+ * Build account context for passkey manager transactions.
+ * Handles account deduplication, sorting, and index lookup.
+ */
+declare function buildAccountContext(params: {
+    walletAddress: string;
+    readWriteAccounts: Uint8Array[];
+    readOnlyAccounts: Uint8Array[];
+    feePayerAddress?: string;
+    programAddress?: string;
+}): AccountContext;
+/**
+ * Build read-write accounts list for passkey manager transactions (simpler wallet-only version).
+ */
+declare function buildPasskeyReadWriteAccounts(userAccounts: Uint8Array[], feePayerPublicKey: Uint8Array, programAddress: Uint8Array): {
+    readWriteAddresses: string[];
+    findAccountIndex: (target: Uint8Array) => number;
+};
+
+/**
+ * Parse wallet account data to extract nonce.
+ */
+declare function parseWalletNonce(data: Uint8Array): bigint;
+/**
+ * Fetch wallet nonce from the chain.
+ * Takes an SDK-like object with accounts.get() method.
+ */
+declare function fetchWalletNonce(sdk: {
+    accounts: {
+        get: (address: string) => Promise<{
+            data?: {
+                data?: Uint8Array;
+            };
+        }>;
+    };
+}, walletAddress: string): Promise<bigint>;
+type ParsedAuthority = {
+    idx: number;
+    kind: 'passkey';
+    x: Uint8Array;
+    y: Uint8Array;
+} | {
+    idx: number;
+    kind: 'pubkey';
+    pubkey: Uint8Array;
+} | {
+    idx: number;
+    kind: 'unknown';
+    tag: number;
+    data: Uint8Array;
+};
+interface WalletAuthorities {
+    nonce: bigint;
+    authorities: ParsedAuthority[];
+}
+/**
+ * Parse the on-chain WalletAccount data buffer into its nonce and full
+ * authority list. The on-chain layout is:
+ *
+ *   num_auth: u8
+ *   nonce:    u64 LE
+ *   authorities[num_auth + 1]: { tag: u8, data: [u8; 64] }
+ *
+ * (`num_auth + 1` because num_auth stores the count minus one.)
+ */
+declare function parseWalletAuthorities(data: Uint8Array): WalletAuthorities;
+/**
+ * Encode a 32-byte pubkey to its base58 wallet address representation.
+ */
+declare function formatAuthorityPubkey(pubkey: Uint8Array): string;
+/**
+ * Parse a CredentialLookup account and return the wallet account pubkey
+ * stored inside it.
+ */
+declare function parseCredentialLookupWallet(data: Uint8Array): Uint8Array | null;
+
+interface PasskeyAuthorityIdentity {
+    publicKeyX?: string | null;
+    publicKeyY?: string | null;
+}
+interface CheckablePasskeyAuthorityIdentity {
+    publicKeyX: string;
+    publicKeyY: string;
+}
+interface AccountLike {
+    data?: {
+        data?: Uint8Array;
+    };
+}
+interface ThruAccountClient {
+    accounts: {
+        get(address: string): Promise<AccountLike>;
+    };
+}
+interface PasskeyAuthorityTarget<T> {
+    account: T;
+    walletAddress: string;
+    authIdx: number;
+    authorities: ParsedAuthority[];
+}
+interface PreparePasskeyAuthorityTargetsOptions<T> {
+    accounts: T[];
+    passkey?: PasskeyAuthorityIdentity | null;
+    thru: ThruAccountClient;
+    getWalletAddress: (account: T) => string;
+    concurrency?: number;
+}
+declare function isPasskeyAuthorityCheckable(passkey: PasskeyAuthorityIdentity | null | undefined): passkey is CheckablePasskeyAuthorityIdentity;
+declare function findPasskeyAuthorityIndexForIdentity(authorities: ParsedAuthority[], passkey: PasskeyAuthorityIdentity | null | undefined): number | null;
+declare function findPasskeyAuthorityIndexInWalletData(walletData: Uint8Array, passkey: PasskeyAuthorityIdentity | null | undefined): {
+    authIdx: number;
+    authorities: ParsedAuthority[];
+} | null;
+declare function resolvePasskeyAuthorityIndex(params: {
+    thru: ThruAccountClient;
+    walletAddress: string;
+    passkey?: PasskeyAuthorityIdentity | null;
+}): Promise<number | null>;
+declare function preparePasskeyAuthorityTargets<T>({ accounts, passkey, thru, getWalletAddress, concurrency, }: PreparePasskeyAuthorityTargetsOptions<T>): Promise<PasskeyAuthorityTarget<T>[]>;
+
+/**
+ * P-256 curve order and half-order for low-S normalization.
+ */
+declare const P256_N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+declare const P256_HALF_N: bigint;
+/**
+ * Parse DER-encoded ECDSA signature to get r and s components.
+ */
+declare function parseDerSignature(der: Uint8Array): {
+    r: Uint8Array;
+    s: Uint8Array;
+};
+/**
+ * Ensure S is in the lower half of the curve order (BIP-62 / SEC1 compliance).
+ */
+declare function normalizeLowS(s: Uint8Array): Uint8Array;
+/**
+ * Normalize signature component to exactly 32 bytes.
+ */
+declare function normalizeSignatureComponent(component: Uint8Array): Uint8Array;
+declare function bytesToBigIntBE(bytes: Uint8Array): bigint;
+declare function bigIntToBytesBE(value: bigint, length: number): Uint8Array;
+
+declare function arrayBufferToBase64Url(buffer: ArrayBuffer | SharedArrayBuffer): string;
+declare function base64UrlToArrayBuffer(base64Url: string): ArrayBuffer;
+declare function bytesToBase64Url(bytes: Uint8Array): string;
+declare function bytesToBase64(bytes: Uint8Array): string;
+declare function base64UrlToBytes(base64Url: string): Uint8Array;
+declare function bytesToHex(bytes: Uint8Array): string;
+declare function hexToBytes(hex: string): Uint8Array;
+declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+declare function compareBytes(a: Uint8Array, b: Uint8Array): number;
+declare function uniqueAccounts(accounts: Uint8Array[]): Uint8Array[];
+
+export { AUTHORITY_TAG_PASSKEY, AUTHORITY_TAG_PUBKEY, type AccountContext, type Authority, type CheckablePasskeyAuthorityIdentity, type CreateInstructionParams, FEE_PAYER_ADDRESS, INSTRUCTION_ADD_AUTHORITY, INSTRUCTION_CREATE, INSTRUCTION_INVOKE, INSTRUCTION_REGISTER_CREDENTIAL, INSTRUCTION_REMOVE_AUTHORITY, INSTRUCTION_TRANSFER, INSTRUCTION_VALIDATE, P256_HALF_N, P256_N, PASSKEY_MANAGER_PROGRAM_ADDRESS, type ParsedAuthority, type PasskeyAuthorityIdentity, type PasskeyAuthorityTarget, type PasskeyDiscoverableSigningResult, type PasskeyMetadata, type PasskeyRegistrationResult, type PasskeySigningResult, type PreparePasskeyAuthorityTargetsOptions, type RegisterCredentialInstructionParams, type TransactionExecutionSummary, type TransferInstructionParams, type ValidateInstructionParams, type WalletAuthorities, type WalletSigner, arrayBufferToBase64Url, base64UrlToArrayBuffer, base64UrlToBytes, bigIntToBytesBE, buildAccountContext, buildPasskeyReadWriteAccounts, bytesEqual, bytesToBase64, bytesToBase64Url, bytesToBigIntBE, bytesToHex, compareBytes, concatenateInstructions, createCredentialLookupSeed, createValidateChallenge, createWalletSeed, deriveCredentialLookupAddress, deriveWalletAddress, encodeAddAuthorityInstruction, encodeCreateInstruction, encodeInvokeInstruction, encodeRegisterCredentialInstruction, encodeRemoveAuthorityInstruction, encodeTransferInstruction, encodeValidateInstruction, fetchWalletNonce, findPasskeyAuthorityIndexForIdentity, findPasskeyAuthorityIndexInWalletData, formatAuthorityPubkey, hexToBytes, isPasskeyAuthorityCheckable, normalizeLowS, normalizeSignatureComponent, parseCredentialLookupWallet, parseDerSignature, parseWalletAuthorities, parseWalletNonce, preparePasskeyAuthorityTargets, resolvePasskeyAuthorityIndex, uniqueAccounts };

package/dist/passkey-manager/index.d.ts

@@ -0,0 +1,319 @@
+export { decodeAddress, encodeAddress } from '@thru/sdk/helpers';
+
+declare const PASSKEY_MANAGER_PROGRAM_ADDRESS = "taUDdQyFxvM5i0HFRkEK3W45kWLyblAHSnMg4zplgUnz6Z";
+declare const INSTRUCTION_CREATE = 0;
+declare const INSTRUCTION_VALIDATE = 1;
+declare const INSTRUCTION_TRANSFER = 2;
+declare const INSTRUCTION_INVOKE = 3;
+declare const INSTRUCTION_ADD_AUTHORITY = 4;
+declare const INSTRUCTION_REMOVE_AUTHORITY = 5;
+declare const INSTRUCTION_REGISTER_CREDENTIAL = 6;
+declare const AUTHORITY_TAG_PASSKEY = 1;
+declare const AUTHORITY_TAG_PUBKEY = 2;
+
+/**
+ * Result of passkey registration (credential creation).
+ */
+interface PasskeyRegistrationResult {
+    credentialId: string;
+    publicKeyX: string;
+    publicKeyY: string;
+    rpId: string;
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+}
+/**
+ * Result of passkey signing (assertion).
+ */
+interface PasskeySigningResult {
+    signature: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    signatureR: Uint8Array;
+    signatureS: Uint8Array;
+    /** WebAuthn authenticator attachment, if surfaced by the browser:
+     *  - 'platform': built-in / passkey on this device
+     *  - 'cross-platform': e.g. signed in via QR using another device
+     *  Used by the wallet to decide whether to offer "add this device". */
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+}
+/**
+ * Signing result with discoverable credential info.
+ */
+interface PasskeyDiscoverableSigningResult extends PasskeySigningResult {
+    credentialId: string;
+    rpId: string;
+}
+/**
+ * Passkey metadata stored locally (the actual private key lives in the device's secure enclave).
+ */
+interface PasskeyMetadata {
+    credentialId: string;
+    publicKeyX: string;
+    publicKeyY: string;
+    rpId: string;
+    /** On-chain passkey authority index for this wallet account.
+     *  Omitted for the primary authority, which defaults to index 0. */
+    authIdx?: number;
+    label?: string;
+    deviceName?: string;
+    devicePlatform?: string;
+    browserName?: string;
+    authenticatorAttachment?: 'platform' | 'cross-platform' | null;
+    createdAt: string;
+    lastUsedAt: string;
+}
+type Authority = {
+    tag: 1;
+    pubkeyX: Uint8Array;
+    pubkeyY: Uint8Array;
+} | {
+    tag: 2;
+    pubkey: Uint8Array;
+};
+interface CreateInstructionParams {
+    walletAccountIdx: number;
+    authority: Authority;
+    seed: Uint8Array;
+    stateProof: Uint8Array;
+}
+interface TransferInstructionParams {
+    walletAccountIdx: number;
+    toAccountIdx: number;
+    amount: bigint;
+}
+interface ValidateInstructionParams {
+    walletAccountIdx: number;
+    authIdx: number;
+    signatureR: Uint8Array;
+    signatureS: Uint8Array;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+}
+interface AccountContext {
+    readWriteAddresses: string[];
+    readOnlyAddresses: string[];
+    accountAddresses: string[];
+    walletAccountIdx: number;
+    getAccountIndex: (pubkey: Uint8Array) => number;
+}
+interface RegisterCredentialInstructionParams {
+    walletAccountIdx: number;
+    lookupAccountIdx: number;
+    seed: Uint8Array;
+    stateProof: Uint8Array;
+}
+type WalletSigner = {
+    signTransaction: (payloadBase64: string) => Promise<string>;
+};
+type TransactionExecutionSummary = {
+    executionResult?: bigint | number | null;
+    userErrorCode?: bigint | number | null;
+    vmError?: number | string | bigint | null;
+};
+
+declare function encodeCreateInstruction(params: CreateInstructionParams): Uint8Array;
+
+declare function encodeValidateInstruction(params: ValidateInstructionParams): Uint8Array;
+
+declare function encodeTransferInstruction(params: TransferInstructionParams): Uint8Array;
+
+declare function encodeInvokeInstruction(programPubkey: Uint8Array, instruction: Uint8Array): Uint8Array;
+
+declare function encodeAddAuthorityInstruction(params: {
+    authority: Authority;
+}): Uint8Array;
+
+declare function encodeRemoveAuthorityInstruction(params: {
+    authIdx: number;
+}): Uint8Array;
+
+declare function encodeRegisterCredentialInstruction(params: RegisterCredentialInstructionParams): Uint8Array;
+
+declare function concatenateInstructions(instructions: Uint8Array[]): Uint8Array;
+
+/**
+ * Create challenge for VALIDATE instruction.
+ * SHA256(nonce || account_0 || account_1 || ... || trailing_instruction_bytes)
+ */
+declare function createValidateChallenge(nonce: bigint, accountAddresses: string[], trailingInstructionData: Uint8Array): Promise<Uint8Array>;
+
+/**
+ * Create a 32-byte seed from wallet name and passkey coordinates.
+ * SHA-256(walletName || pubkey_x || pubkey_y)
+ */
+declare function createWalletSeed(walletName: string, pubkeyX: Uint8Array, pubkeyY: Uint8Array): Promise<Uint8Array>;
+/**
+ * Derive wallet account address from seed using proper PDA derivation.
+ * SHA256(program_address || is_ephemeral || seed)
+ */
+declare function deriveWalletAddress(seed: Uint8Array, programAddress: string): Promise<Uint8Array>;
+/**
+ * Create a 32-byte seed for a credential lookup PDA.
+ * SHA-256(credentialId)
+ */
+declare function createCredentialLookupSeed(credentialId: Uint8Array): Promise<Uint8Array>;
+/**
+ * Derive credential lookup PDA address from a credential ID.
+ * Convenience wrapper: deriveWalletAddress(SHA-256(credentialId), programAddress)
+ */
+declare function deriveCredentialLookupAddress(credentialId: Uint8Array, programAddress: string): Promise<Uint8Array>;
+
+/**
+ * Default fee payer address (manager profile).
+ */
+declare const FEE_PAYER_ADDRESS = "taVcZv3wB2m-euBpMHm2rF9fQRY_fO_g7WdOjs70CxDh_S";
+/**
+ * Build account context for passkey manager transactions.
+ * Handles account deduplication, sorting, and index lookup.
+ */
+declare function buildAccountContext(params: {
+    walletAddress: string;
+    readWriteAccounts: Uint8Array[];
+    readOnlyAccounts: Uint8Array[];
+    feePayerAddress?: string;
+    programAddress?: string;
+}): AccountContext;
+/**
+ * Build read-write accounts list for passkey manager transactions (simpler wallet-only version).
+ */
+declare function buildPasskeyReadWriteAccounts(userAccounts: Uint8Array[], feePayerPublicKey: Uint8Array, programAddress: Uint8Array): {
+    readWriteAddresses: string[];
+    findAccountIndex: (target: Uint8Array) => number;
+};
+
+/**
+ * Parse wallet account data to extract nonce.
+ */
+declare function parseWalletNonce(data: Uint8Array): bigint;
+/**
+ * Fetch wallet nonce from the chain.
+ * Takes an SDK-like object with accounts.get() method.
+ */
+declare function fetchWalletNonce(sdk: {
+    accounts: {
+        get: (address: string) => Promise<{
+            data?: {
+                data?: Uint8Array;
+            };
+        }>;
+    };
+}, walletAddress: string): Promise<bigint>;
+type ParsedAuthority = {
+    idx: number;
+    kind: 'passkey';
+    x: Uint8Array;
+    y: Uint8Array;
+} | {
+    idx: number;
+    kind: 'pubkey';
+    pubkey: Uint8Array;
+} | {
+    idx: number;
+    kind: 'unknown';
+    tag: number;
+    data: Uint8Array;
+};
+interface WalletAuthorities {
+    nonce: bigint;
+    authorities: ParsedAuthority[];
+}
+/**
+ * Parse the on-chain WalletAccount data buffer into its nonce and full
+ * authority list. The on-chain layout is:
+ *
+ *   num_auth: u8
+ *   nonce:    u64 LE
+ *   authorities[num_auth + 1]: { tag: u8, data: [u8; 64] }
+ *
+ * (`num_auth + 1` because num_auth stores the count minus one.)
+ */
+declare function parseWalletAuthorities(data: Uint8Array): WalletAuthorities;
+/**
+ * Encode a 32-byte pubkey to its base58 wallet address representation.
+ */
+declare function formatAuthorityPubkey(pubkey: Uint8Array): string;
+/**
+ * Parse a CredentialLookup account and return the wallet account pubkey
+ * stored inside it.
+ */
+declare function parseCredentialLookupWallet(data: Uint8Array): Uint8Array | null;
+
+interface PasskeyAuthorityIdentity {
+    publicKeyX?: string | null;
+    publicKeyY?: string | null;
+}
+interface CheckablePasskeyAuthorityIdentity {
+    publicKeyX: string;
+    publicKeyY: string;
+}
+interface AccountLike {
+    data?: {
+        data?: Uint8Array;
+    };
+}
+interface ThruAccountClient {
+    accounts: {
+        get(address: string): Promise<AccountLike>;
+    };
+}
+interface PasskeyAuthorityTarget<T> {
+    account: T;
+    walletAddress: string;
+    authIdx: number;
+    authorities: ParsedAuthority[];
+}
+interface PreparePasskeyAuthorityTargetsOptions<T> {
+    accounts: T[];
+    passkey?: PasskeyAuthorityIdentity | null;
+    thru: ThruAccountClient;
+    getWalletAddress: (account: T) => string;
+    concurrency?: number;
+}
+declare function isPasskeyAuthorityCheckable(passkey: PasskeyAuthorityIdentity | null | undefined): passkey is CheckablePasskeyAuthorityIdentity;
+declare function findPasskeyAuthorityIndexForIdentity(authorities: ParsedAuthority[], passkey: PasskeyAuthorityIdentity | null | undefined): number | null;
+declare function findPasskeyAuthorityIndexInWalletData(walletData: Uint8Array, passkey: PasskeyAuthorityIdentity | null | undefined): {
+    authIdx: number;
+    authorities: ParsedAuthority[];
+} | null;
+declare function resolvePasskeyAuthorityIndex(params: {
+    thru: ThruAccountClient;
+    walletAddress: string;
+    passkey?: PasskeyAuthorityIdentity | null;
+}): Promise<number | null>;
+declare function preparePasskeyAuthorityTargets<T>({ accounts, passkey, thru, getWalletAddress, concurrency, }: PreparePasskeyAuthorityTargetsOptions<T>): Promise<PasskeyAuthorityTarget<T>[]>;
+
+/**
+ * P-256 curve order and half-order for low-S normalization.
+ */
+declare const P256_N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
+declare const P256_HALF_N: bigint;
+/**
+ * Parse DER-encoded ECDSA signature to get r and s components.
+ */
+declare function parseDerSignature(der: Uint8Array): {
+    r: Uint8Array;
+    s: Uint8Array;
+};
+/**
+ * Ensure S is in the lower half of the curve order (BIP-62 / SEC1 compliance).
+ */
+declare function normalizeLowS(s: Uint8Array): Uint8Array;
+/**
+ * Normalize signature component to exactly 32 bytes.
+ */
+declare function normalizeSignatureComponent(component: Uint8Array): Uint8Array;
+declare function bytesToBigIntBE(bytes: Uint8Array): bigint;
+declare function bigIntToBytesBE(value: bigint, length: number): Uint8Array;
+
+declare function arrayBufferToBase64Url(buffer: ArrayBuffer | SharedArrayBuffer): string;
+declare function base64UrlToArrayBuffer(base64Url: string): ArrayBuffer;
+declare function bytesToBase64Url(bytes: Uint8Array): string;
+declare function bytesToBase64(bytes: Uint8Array): string;
+declare function base64UrlToBytes(base64Url: string): Uint8Array;
+declare function bytesToHex(bytes: Uint8Array): string;
+declare function hexToBytes(hex: string): Uint8Array;
+declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+declare function compareBytes(a: Uint8Array, b: Uint8Array): number;
+declare function uniqueAccounts(accounts: Uint8Array[]): Uint8Array[];
+
+export { AUTHORITY_TAG_PASSKEY, AUTHORITY_TAG_PUBKEY, type AccountContext, type Authority, type CheckablePasskeyAuthorityIdentity, type CreateInstructionParams, FEE_PAYER_ADDRESS, INSTRUCTION_ADD_AUTHORITY, INSTRUCTION_CREATE, INSTRUCTION_INVOKE, INSTRUCTION_REGISTER_CREDENTIAL, INSTRUCTION_REMOVE_AUTHORITY, INSTRUCTION_TRANSFER, INSTRUCTION_VALIDATE, P256_HALF_N, P256_N, PASSKEY_MANAGER_PROGRAM_ADDRESS, type ParsedAuthority, type PasskeyAuthorityIdentity, type PasskeyAuthorityTarget, type PasskeyDiscoverableSigningResult, type PasskeyMetadata, type PasskeyRegistrationResult, type PasskeySigningResult, type PreparePasskeyAuthorityTargetsOptions, type RegisterCredentialInstructionParams, type TransactionExecutionSummary, type TransferInstructionParams, type ValidateInstructionParams, type WalletAuthorities, type WalletSigner, arrayBufferToBase64Url, base64UrlToArrayBuffer, base64UrlToBytes, bigIntToBytesBE, buildAccountContext, buildPasskeyReadWriteAccounts, bytesEqual, bytesToBase64, bytesToBase64Url, bytesToBigIntBE, bytesToHex, compareBytes, concatenateInstructions, createCredentialLookupSeed, createValidateChallenge, createWalletSeed, deriveCredentialLookupAddress, deriveWalletAddress, encodeAddAuthorityInstruction, encodeCreateInstruction, encodeInvokeInstruction, encodeRegisterCredentialInstruction, encodeRemoveAuthorityInstruction, encodeTransferInstruction, encodeValidateInstruction, fetchWalletNonce, findPasskeyAuthorityIndexForIdentity, findPasskeyAuthorityIndexInWalletData, formatAuthorityPubkey, hexToBytes, isPasskeyAuthorityCheckable, normalizeLowS, normalizeSignatureComponent, parseCredentialLookupWallet, parseDerSignature, parseWalletAuthorities, parseWalletNonce, preparePasskeyAuthorityTargets, resolvePasskeyAuthorityIndex, uniqueAccounts };