passkey-kit 0.11.3 → 0.12.1

package/.claude/settings.local.json

@@ -1,9 +1,20 @@
 {
   "permissions": {
     "allow": [
-      "WebSearch"
+      "WebSearch",
+      "mcp__context7__resolve-library-id",
+      "Bash(tree:*)",
+      "mcp__deepwiki__read_wiki_structure",
+      "mcp__context7__query-docs",
+      "mcp__deepwiki__read_wiki_contents",
+      "Bash(curl:*)",
+      "Bash(pnpm install:*)",
+      "Bash(pnpm run build:*)",
+      "mcp__github__get_file_contents",
+      "mcp__perplexity__perplexity_ask",
+      "mcp__perplexity__perplexity_search"
     ],
     "deny": [],
     "ask": []
   }
-}
+}

package/PROPOSAL.md

@@ -6,7 +6,7 @@ Over the past months I've been hard at work designing a solid first stab at a v1
 
 All the best work can reviewed in my [passkey-kit](https://github.com/kalepail/passkey-kit) repo. This repo includes the factory and wallet contracts, a demo client interface, a `passkey-kit` SDK tool to make interacting with the contract interface simple and painless and finally a [Mercury Zephyr](https://www.mercurydata.app/products/zephyr-vm) program for indexing contract events in order to make the wallet more usable client side.
 
-This repo also makes use of a new [Launchtube service](https://github.com/kalepail/launchtube) which makes submitting Soroban transactions simple by handling the concerns of both transaction fees and sequence numbers.
+This repo also makes use of the [OpenZeppelin Relayer service](https://docs.openzeppelin.com/relayer/1.3.x/guides/stellar-channels-guide) which makes submitting Soroban transactions simple by handling the concerns of both transaction fees and sequence numbers.
 
 The primary interest of this proposal is to detail the contract interface itself but many of the design decisions are informed by complexities and available solutions external to the interface. A well rounded understandings of all that's involved to make passkey powered smart wallets on Stellar actually work is necessary in order to arrive at a truly viable contract interface.
 

package/README.md

@@ -1,106 +1,339 @@
 # Passkey Kit
 
-> [!WARNING]  
+> [!TIP]
+> **Looking for the latest smart wallet SDK?**
+>
+> This package is the **legacy precursor** to [OpenZeppelin Smart Accounts](https://docs.openzeppelin.com/stellar-contracts/accounts/smart-account). For new projects, use **[smart-account-kit](https://github.com/kalepail/smart-account-kit)** — a comprehensive SDK built on top of the audited [OpenZeppelin stellar-contracts](https://github.com/OpenZeppelin/stellar-contracts) library.
+>
+> Smart Account Kit includes:
+> - Context rules with fine-grained authorization scopes
+> - Policy support (threshold multisig, spending limits, custom policies)
+> - Session management with automatic credential persistence
+> - External wallet adapter support
+> - Built-in indexer for contract discovery
+>
+> See the [OpenZeppelin Smart Account package](https://github.com/OpenZeppelin/stellar-contracts/tree/main/packages/accounts) and [multisig example](https://github.com/OpenZeppelin/stellar-contracts/tree/main/examples/multisig-smart-account/account) for more details.
+
+> [!WARNING]
 > Code in this repo is demo material only. It has not been audited. Do not use to hold, protect, or secure anything.
 
-Passkey kit is a basic TypeScript SDK for creating and managing Stellar smart wallets. It's intended to be used in tandem with [Launchtube](https://github.com/stellar/launchtube) for submitting passkey signed transactions onchain however this is not a requirement. This is both a client and a server side library. `PasskeyKit` on the client and `PasskeyServer` on the server.
+A TypeScript SDK for creating and managing Stellar smart wallets using passkeys. Works with [OpenZeppelin Relayer](https://docs.openzeppelin.com/relayer/1.3.x/guides/stellar-channels-guide) for submitting passkey-signed transactions onchain.
 
-Demo site: [passkey-kit-demo.pages.dev](https://passkey-kit-demo.pages.dev/)
+**Demo:** [passkey-kit-demo.pages.dev](https://passkey-kit-demo.pages.dev/)
 
-To get started first install the package:
-```
+## Installation
+
+```bash
 pnpm i passkey-kit
 ```
 
-On the client:
+## Exports
+
+```ts
+import {
+    PasskeyKit,      // Client-side wallet management
+    PasskeyServer,   // Server-side utilities
+    SACClient,       // Stellar Asset Contract helper
+    PasskeyClient,   // Low-level contract client (from passkey-kit-sdk)
+    SignerKey,       // Signer key type constructor
+    SignerStore,     // Storage type enum
+    type Signer,     // Signer type
+    type SignerLimits // Signer limits type
+} from 'passkey-kit'
+```
+
+---
+
+## PasskeyKit (Client)
+
+Handles wallet creation, connection, and transaction signing.
+
+### Constructor
+
 ```ts
 const account = new PasskeyKit({
-    rpcUrl: env.PUBLIC_rpcUrl,
-    networkPassphrase: env.PUBLIC_networkPassphrase,
-    factoryContractId: env.PUBLIC_factoryContractId,
-});
+    rpcUrl: string,              // Stellar RPC URL
+    networkPassphrase: string,   // Network passphrase
+    walletWasmHash: string,      // Smart wallet WASM hash
+    timeoutInSeconds?: number,   // Transaction timeout (default: 30)
+    WebAuthn?: {                 // Optional WebAuthn override
+        startRegistration,
+        startAuthentication
+    }
+})
 ```
 
-On the server:
+### Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `keyId` | `string \| undefined` | Current passkey ID (base64url) |
+| `wallet` | `PasskeyClient \| undefined` | Connected wallet client |
+| `networkPassphrase` | `string` | Network passphrase |
+
+### Methods
+
+#### `createWallet(app, user, settings?)`
+Creates a new passkey and deploys a smart wallet.
+
+```ts
+const { rawResponse, keyId, keyIdBase64, contractId, signedTx } = await account.createWallet(
+    'My App',           // App name shown in passkey prompt
+    'user@example.com', // User identifier
+    {
+        rpId?: string,  // Relying party ID
+        authenticatorSelection?: AuthenticatorSelectionCriteria
+    }
+)
+```
+
+#### `createKey(app, user, settings?)`
+Creates a new passkey without deploying a wallet.
+
 ```ts
-const account = new PasskeyServer({
-    rpcUrl: env.PUBLIC_rpcUrl,
-    launchtubeUrl: env.PUBLIC_launchtubeUrl,
-    launchtubeJwt: env.PRIVATE_launchtubeJwt,
-    mercuryUrl: env.PUBLIC_mercuryUrl,
-    mercuryJwt: env.PRIVATE_mercuryJwt,
-});
+const { rawResponse, keyId, keyIdBase64, publicKey } = await account.createKey(
+    'My App',
+    'user@example.com',
+    { rpId?: string, authenticatorSelection?: AuthenticatorSelectionCriteria }
+)
 ```
 
-This is a fully typed library so docs aren't provided, however there's a full example showcasing all the core public methods in the `./demo` directory. I also recommend reviewing the [Super Peach](https://github.com/kalepail/superpeach) repo for an example of how you could implement both the client and server side in a more real-world scenario.
+#### `connectWallet(opts?)`
+Connects to an existing wallet using a passkey.
 
-Good luck, have fun, and change the world!
+```ts
+const { rawResponse, keyId, keyIdBase64, contractId } = await account.connectWallet({
+    rpId?: string,
+    keyId?: string | Uint8Array,           // Skip passkey prompt if provided
+    getContractId?: (keyId: string) => Promise<string | undefined>,  // Lookup function
+    walletPublicKey?: string               // For backwards compatibility
+})
+```
 
-For any questions or to showcase your progress please join the `#passkeys` channel on our [Discord](https://discord.gg/stellardev).
+#### `sign(txn, options?)`
+Signs all auth entries for the connected wallet in a transaction.
 
-## Deploy the event indexer
+```ts
+const signedTxn = await account.sign(
+    txn,  // AssembledTransaction | Tx | string (XDR)
+    {
+        rpId?: string,
+        keyId?: 'any' | string | Uint8Array,  // 'any' allows any passkey
+        keypair?: Keypair,                     // Sign with Ed25519 instead
+        policy?: string,                       // Sign with policy instead
+        expiration?: number                    // Ledger expiration
+    }
+)
+```
 
-In order to utilize the Mercury Zephyr indexing service to track available signers and reverse lookup smart wallet contract addresses from passkey ids you'll need to deploy the Zephyr program from inside the `./zephyr` directory.
+#### `signAuthEntry(entry, options?)`
+Signs a single authorization entry. Same options as `sign()`.
+
+```ts
+const signedEntry = await account.signAuthEntry(entry, options)
+```
+
+#### Signer Management
+
+Add, update, or remove signers from the wallet.
+
+```ts
+// Add signers
+await account.addSecp256r1(keyId, publicKey, limits, store, expiration?)
+await account.addEd25519(publicKey, limits, store, expiration?)
+await account.addPolicy(policy, limits, store, expiration?)
+
+// Update signers
+await account.updateSecp256r1(keyId, publicKey, limits, store, expiration?)
+await account.updateEd25519(publicKey, limits, store, expiration?)
+await account.updatePolicy(policy, limits, store, expiration?)
+
+// Remove signer
+await account.remove(signerKey)
+```
+
+**Parameters:**
+- `keyId` - Passkey ID (string or Uint8Array)
+- `publicKey` - Public key (string or Uint8Array for Secp256r1, Stellar public key for Ed25519)
+- `policy` - Policy contract address
+- `limits` - `SignerLimits` (see Types below)
+- `store` - `SignerStore.Persistent` or `SignerStore.Temporary`
+- `expiration` - Optional ledger expiration
+
+---
+
+## PasskeyServer (Server)
+
+Server-side utilities for Mercury indexing and OpenZeppelin Relayer.
+
+### Constructor
+
+```ts
+const server = new PasskeyServer({
+    rpcUrl?: string,
+    relayerUrl?: string,         // OpenZeppelin Relayer URL
+    relayerApiKey?: string,      // Relayer API key
+    mercuryProjectName?: string, // Mercury project name
+    mercuryUrl?: string,         // Mercury URL
+    mercuryJwt?: string,         // Mercury JWT (use either JWT or Key)
+    mercuryKey?: string          // Mercury API key
+})
+```
+
+### Methods
+
+#### `getSigners(contractId)`
+Get all signers for a wallet from Mercury.
+
+```ts
+const signers: Signer[] = await server.getSigners('C...')
+```
+
+#### `getContractId(options, index?)`
+Reverse lookup a wallet address from a signer.
+
+```ts
+const contractId = await server.getContractId({
+    keyId?: string,     // Passkey ID (Secp256r1)
+    publicKey?: string, // Ed25519 public key
+    policy?: string     // Policy address
+}, index)  // If multiple wallets, select by index (default: 0)
+```
+
+#### `send(txn)`
+Submit a transaction via OpenZeppelin Relayer.
+
+```ts
+const result = await server.send(txn)  // AssembledTransaction | Tx | string
+```
+
+---
+
+## SACClient
+
+Helper for interacting with Stellar Asset Contracts.
+
+```ts
+const sac = new SACClient({
+    networkPassphrase: string,
+    rpcUrl: string
+})
+
+const tokenClient = sac.getSACClient('C...')  // SAC contract ID
+```
+
+---
+
+## Types
+
+### SignerKey
+
+```ts
+SignerKey.Policy(contractAddress)    // Policy signer
+SignerKey.Ed25519(publicKey)         // Ed25519 signer
+SignerKey.Secp256r1(keyId)           // Passkey signer
+```
+
+### SignerLimits
+
+```ts
+type SignerLimits = Map<string, SignerKey[] | undefined> | undefined
+
+// Example: Limit signer to specific contract, requires co-signer
+const limits = new Map([
+    ['C...contractAddress', [SignerKey.Ed25519('G...')]]
+])
+```
+
+### SignerStore
+
+```ts
+enum SignerStore {
+    Persistent = 'Persistent',  // Permanent storage
+    Temporary = 'Temporary'     // Expires, cheaper
+}
+```
+
+### Signer
+
+```ts
+type Signer = {
+    kind: string       // 'Secp256r1' | 'Ed25519' | 'Policy'
+    key: string        // Signer identifier
+    val: string        // Public key or empty
+    expiration: number | null
+    storage: 'Persistent' | 'Temporary'
+    limits: string     // JSON stringified limits
+    evicted?: boolean  // True if temporary signer was evicted
+}
+```
+
+---
+
+## Deploy the Mercury Indexer
+
+To track signers and reverse lookup wallet addresses, deploy the Zephyr program:
 
 ```bash
 cd ./zephyr
 cargo install mercury-cli
-# Get a JWT from Mercury https://test.mercurydata.app
+# Get a JWT from https://test.mercurydata.app
 export MERCURY_JWT="<YOUR.MERCURY.JWT>"
-# Make sure you're on Rust version 1.79.0 or newer
+# Requires Rust 1.79.0+
 mercury-cli --jwt $MERCURY_JWT --local false --mainnet false deploy
 ```
 
-## TypeScript gotchas
+---
+
+## TypeScript Configuration
 
-This is a TypeScript library and the npm package doesn't export a JavaScript version. The `@stellar/stellar-sdk` library is enormous and I really don't wan't folks bundling it up twice. Therefore you'll need to ensure you're transpiling this library into your project and that goes for either a TS project or a JS one. For many of you this will "just work" but for others you'll need to do some fiddling.
+This library exports TypeScript only to avoid bundling `@stellar/stellar-sdk` twice. Configure your bundler to transpile it.
 
-For example if you're using NextJS this will mean modifying your `next.config.mjs` file to include the following packages in the `transpilePackages` key:
+**Next.js** (`next.config.mjs`):
 ```mjs
 /** @type {import('next').NextConfig} */
 const nextConfig = {
     transpilePackages: [
-        'passkey-kit', 
-        'passkey-factory-sdk', 
+        'passkey-kit',
+        'passkey-factory-sdk',
         'passkey-kit-sdk',
         'sac-sdk',
     ]
-};
+}
 
-export default nextConfig;
+export default nextConfig
 ```
-If someone smarter than me knows how to include an optional JS build from a TS library please submit a PR. I just don't want to deploy a compiled version of this and wind up having folks doubling up on an already gargantuan dependency.
 
-## Contributing 
+---
 
-Passkey kit consists of three primary directories:
-- `./src` - Contains the TypeScript files for the actual TS SDK library.
-- `./demo` - Contains a basic demo of the SDK in action.
-- `./contracts` - Contains the Rust Soroban smart contracts of the smart wallet implementation.
-- `./zephyr` - Contains the [Zephyr](https://www.mercurydata.app/products/zephyr-vm) program for processing smart wallet events.
-
-To install dependencies:
+## Contributing
 
 ```bash
+# Install dependencies
 pnpm i
-```
-
-To build:
 
-```bash
+# Build
 pnpm run build
-```
-
-To run the demo:
 
-```bash
-cd ./demo
-pnpm i
-pnpm run start
+# Run demo
+cd ./demo && pnpm i && pnpm run start
 ```
 
+**Directory structure:**
+- `./src` - TypeScript SDK source
+- `./demo` - Demo application
+- `./contracts` - Rust Soroban smart contracts
+- `./zephyr` - Mercury Zephyr indexer program
+
 > [!IMPORTANT]
-> If you fiddle with contracts in `./contracts` you'll need to run the make commands. Just remember to update the `SMART_WALLET_FACTORY` and `SMART_WALLET_WASM` values from the `make deploy` command before running `make init`.
+> If modifying contracts in `./contracts`, run the make commands. Update `SMART_WALLET_FACTORY` and `SMART_WALLET_WASM` values from `make deploy` before running `make init`.
 
 > [!IMPORTANT]
-> Keep in mind the bindings here in `./packages` have been _heavily_ modified. Be careful when rebuilding and updating. Likely you'll only want to update the `src/index.ts` files in each respective package vs swapping out entire directories.
+> The bindings in `./packages` have been heavily modified. When rebuilding, prefer updating only the `src/index.ts` files in each package.
+
+---
+
+## Resources
+
+- [Super Peach](https://github.com/kalepail/superpeach) - Real-world implementation example
+- [Discord #passkeys](https://discord.gg/stellardev) - Questions and showcase

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.11.3",
+  "version": "0.12.1",
   "description": "A helper library for creating and using smart wallet accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven",
   "license": "MIT",
@@ -8,12 +8,13 @@
   "main": "src/index.ts",
   "types": "types/index.d.ts",
   "dependencies": {
+    "@openzeppelin/relayer-plugin-channels": "^0.5.0",
     "@simplewebauthn/browser": "^13.2.0",
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "base64url": "^3.0.1",
     "buffer": "^6.0.3",
-    "sac-sdk": "0.4.2",
-    "passkey-kit-sdk": "0.7.2"
+    "passkey-kit-sdk": "0.7.3",
+    "sac-sdk": "0.4.3"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
@@ -22,8 +23,8 @@
   "workspaces": [
     "packages/*"
   ],
-  "engine": {
-    "node": ">=20"
+  "engines": {
+    "node": ">=22.18.0"
   },
   "repository": {
     "type": "git",
@@ -50,6 +51,7 @@
     "build:demo": "cd demo && pnpm --ignore-workspace install && pnpm run build",
     "deploy:demo": "npx wrangler pages deploy",
     "deploy:demo:prod": "npx wrangler pages deploy --env production",
+    "test:p27-auth": "bun bun_tests/9.index.ts",
     "build:sac": "pnpm --filter=sac-sdk run build",
     "build:pks": "pnpm --filter=passkey-kit-sdk run build",
     "build": "pnpm run build:sac && pnpm run build:pks && tsc",

package/packages/passkey-kit-sdk/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.2",
+  "version": "0.7.3",
   "name": "passkey-kit-sdk",
   "type": "module",
   "main": "src/index.ts",
@@ -9,10 +9,13 @@
     "build": "tsc"
   },
   "dependencies": {
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "buffer": "^6.0.3"
   },
   "devDependencies": {
     "typescript": "^5.9.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
   }
 }

package/packages/passkey-kit-sdk/src/index.ts

@@ -5,11 +5,11 @@ import {
   ClientOptions as ContractClientOptions,
   MethodOptions,
   Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 import type {
   u32,
   Option,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 
 if (typeof window !== 'undefined') {
   //@ts-ignore Buffer exists

package/packages/passkey-kit-sdk/types/index.d.ts

@@ -1,6 +1,6 @@
 import { Buffer } from "buffer";
-import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/minimal/contract';
-import type { u32, Option } from '@stellar/stellar-sdk/minimal/contract';
+import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/contract';
+import type { u32, Option } from '@stellar/stellar-sdk/contract';
 export declare const Errors: {
     1: {
         message: string;

package/packages/sac-sdk/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.2",
+  "version": "0.4.3",
   "name": "sac-sdk",
   "type": "module",
   "main": "src/index.ts",
@@ -9,10 +9,13 @@
     "build": "tsc"
   },
   "dependencies": {
-    "@stellar/stellar-sdk": "^14.2.0",
+    "@stellar/stellar-sdk": "16.0.0-rc.1",
     "buffer": "^6.0.3"
   },
   "devDependencies": {
     "typescript": "^5.9.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
   }
 }

package/packages/sac-sdk/src/index.ts

@@ -5,11 +5,11 @@ import {
   ClientOptions as ContractClientOptions,
   MethodOptions,
   Spec as ContractSpec,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 import type {
   u32,
   i128,
-} from '@stellar/stellar-sdk/minimal/contract';
+} from '@stellar/stellar-sdk/contract';
 
 if (typeof window !== 'undefined') {
   //@ts-ignore Buffer exists

package/packages/sac-sdk/types/index.d.ts

@@ -1,6 +1,6 @@
 import { Buffer } from "buffer";
-import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/minimal/contract';
-import type { u32, i128 } from '@stellar/stellar-sdk/minimal/contract';
+import { AssembledTransaction, Client as ContractClient, ClientOptions as ContractClientOptions, MethodOptions } from '@stellar/stellar-sdk/contract';
+import type { u32, i128 } from '@stellar/stellar-sdk/contract';
 export interface Client {
     /**
      * Construct and simulate a allowance transaction. Returns an `AssembledTransaction` object which will have a `result` field containing the result of the simulation. If this transaction changes contract state, you will need to call `signAndSend()` on the returned object.

package/src/base.ts

@@ -1,4 +1,4 @@
-import { Server } from "@stellar/stellar-sdk/minimal/rpc"
+import { Server } from "@stellar/stellar-sdk/rpc"
 
 // TODO consider adding support for a signAuthEntry method that conforms to the ed25519 signature scheme of this passkey interface
 // once we do that we can clean the code a little with the `xdr.HashIdPreimage.envelopeTypeSorobanAuthorization` stuff

package/src/kit.ts

@@ -1,12 +1,138 @@
 import { Client as PasskeyClient, type Signature, type SignerKey as SDKSignerKey, type SignerLimits as SDKSignerLimits } from 'passkey-kit-sdk'
-import { StrKey, hash, xdr, Keypair, Address, TransactionBuilder, Operation } from '@stellar/stellar-sdk/minimal'
+import * as StellarSdk from '@stellar/stellar-sdk'
+import { StrKey, hash, xdr, Keypair, Address, TransactionBuilder, Operation } from '@stellar/stellar-sdk'
 import { startRegistration, startAuthentication, type AuthenticationResponseJSON, type AuthenticatorAttestationResponseJSON, type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser"
 import { Buffer } from 'buffer'
 import base64url from 'base64url'
 import type { SignerKey, SignerLimits, SignerStore } from './types'
 import { PasskeyBase } from './base'
-import { AssembledTransaction, basicNodeSigner, type AssembledTransactionOptions, type Tx } from '@stellar/stellar-sdk/minimal/contract'
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc'
+import { AssembledTransaction, basicNodeSigner, type AssembledTransactionOptions, type Spec as ContractSpec, type Tx } from '@stellar/stellar-sdk/contract'
+import type { Server } from '@stellar/stellar-sdk/rpc'
+
+type P27HashIdPreimage = typeof xdr.HashIdPreimage & {
+    envelopeTypeSorobanAuthorizationWithAddress?: (value: unknown) => xdr.HashIdPreimage
+}
+
+type P27Xdr = typeof xdr & {
+    HashIdPreimageSorobanAuthorizationWithAddress?: new (fields: {
+        networkId: Buffer
+        nonce: xdr.Int64
+        signatureExpirationLedger: number
+        invocation: xdr.SorobanAuthorizedInvocation
+        address: xdr.ScAddress
+    }) => unknown
+}
+
+type P27AuthSdk = typeof StellarSdk & {
+    buildAuthorizationEntryPreimage?: (
+        entry: xdr.SorobanAuthorizationEntry,
+        validUntilLedgerSeq: number,
+        networkPassphrase: string
+    ) => xdr.HashIdPreimage
+}
+
+type PasskeyClientWithSpec = PasskeyClient & {
+    spec: ContractSpec
+}
+
+export function getAddressCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanAddressCredentials {
+    const typedCredentials = credentials as unknown as {
+        address: () => xdr.SorobanAddressCredentials
+        addressV2?: () => xdr.SorobanAddressCredentials
+        addressWithDelegates?: () => {
+            addressCredentials: () => xdr.SorobanAddressCredentials
+        }
+    }
+
+    switch (credentials.switch().name as string) {
+        case 'sorobanCredentialsAddress':
+            return typedCredentials.address()
+        case 'sorobanCredentialsAddressV2':
+            if (!typedCredentials.addressV2) {
+                throw new Error(
+                    'ADDRESS_V2 credentials require an SDK with Protocol 27 credential support'
+                )
+            }
+            return typedCredentials.addressV2()
+        case 'sorobanCredentialsAddressWithDelegates':
+            if (!typedCredentials.addressWithDelegates) {
+                throw new Error(
+                    'ADDRESS_WITH_DELEGATES credentials require an SDK with Protocol 27 credential support'
+                )
+            }
+            return typedCredentials.addressWithDelegates().addressCredentials()
+    }
+
+    throw new Error(`Soroban credentials do not contain address credentials: ${credentials.switch().name}`)
+}
+
+export function usesAddressBoundPayload(credentials: xdr.SorobanCredentials): boolean {
+    const credentialType = credentials.switch().name as string
+    return credentialType === 'sorobanCredentialsAddressV2'
+        || credentialType === 'sorobanCredentialsAddressWithDelegates'
+}
+
+export function assertSignatureExpirationLedger(expiration: number): void {
+    if (!Number.isInteger(expiration) || expiration < 0 || expiration > 0xffffffff) {
+        throw new Error('Soroban signature expiration ledger must be a uint32 integer')
+    }
+}
+
+export function buildSignaturePayload(
+    networkPassphrase: string,
+    entry: xdr.SorobanAuthorizationEntry,
+    expiration: number
+): Buffer {
+    assertSignatureExpirationLedger(expiration)
+
+    const credentials = getAddressCredentials(entry.credentials())
+    const sdkAuth = StellarSdk as P27AuthSdk
+
+    if (sdkAuth.buildAuthorizationEntryPreimage) {
+        credentials.signatureExpirationLedger(expiration)
+        return hash(sdkAuth.buildAuthorizationEntryPreimage(
+            entry,
+            expiration,
+            networkPassphrase
+        ).toXDR())
+    }
+
+    if (usesAddressBoundPayload(entry.credentials())) {
+        const hashIdPreimage = xdr.HashIdPreimage as P27HashIdPreimage
+        const WithAddressPreimage = (xdr as P27Xdr).HashIdPreimageSorobanAuthorizationWithAddress
+
+        if (!hashIdPreimage.envelopeTypeSorobanAuthorizationWithAddress || !WithAddressPreimage) {
+            throw new Error(
+                'Address-bound Soroban auth credentials require an SDK with Protocol 27 auth preimage support'
+            )
+        }
+
+        credentials.signatureExpirationLedger(expiration)
+        const preimage = hashIdPreimage.envelopeTypeSorobanAuthorizationWithAddress(
+            new WithAddressPreimage({
+                networkId: hash(Buffer.from(networkPassphrase)),
+                nonce: credentials.nonce(),
+                signatureExpirationLedger: expiration,
+                invocation: entry.rootInvocation(),
+                address: credentials.address(),
+            })
+        )
+
+        return hash(preimage.toXDR())
+    }
+
+    credentials.signatureExpirationLedger(expiration)
+    const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+        new xdr.HashIdPreimageSorobanAuthorization({
+            networkId: hash(Buffer.from(networkPassphrase)),
+            nonce: credentials.nonce(),
+            signatureExpirationLedger: expiration,
+            invocation: entry.rootInvocation()
+        })
+    )
+
+    return hash(preimage.toXDR())
+}
 
 // TODO we should allow setting the rpId in the constructor so we don't have to keep setting it for every call
 // e.g. if you want to sign with a smol.xyz key on next.smol.xyz key you have to set rpId over and over again
@@ -28,6 +154,10 @@ export class PasskeyKit extends PasskeyBase {
     public networkPassphrase: string
     public wallet: PasskeyClient | undefined
 
+    private get walletSpec(): ContractSpec {
+        return (this.wallet as PasskeyClientWithSpec).spec
+    }
+
     constructor(options: {
         rpcUrl: string,
         networkPassphrase: string,
@@ -51,7 +181,7 @@ export class PasskeyKit extends PasskeyBase {
         this.walletKeypair = Keypair.fromRawEd25519Seed(hash(Buffer.from('kalepail')));
         this.walletPublicKey = this.walletKeypair.publicKey()
         this.walletWasmHash = walletWasmHash
-        this.timeoutInSeconds = options.timeoutInSeconds || 30 // Launchtube requires <= 30 second timeout so let's default to that
+        this.timeoutInSeconds = options.timeoutInSeconds || 30 // OpenZeppelin Relayer requires <= 30 second timeout so let's default to that
         this.WebAuthn = WebAuthn || { startRegistration, startAuthentication }
     }
 
@@ -247,7 +377,12 @@ export class PasskeyKit extends PasskeyBase {
         if ([keyId, keypair, policy].filter((arg) => !!arg).length > 1)
             throw new Error('Exactly one of `options.keyId`, `options.keypair`, or `options.policy` must be provided.');
 
-        const credentials = entry.credentials().address();
+        const credentialType = entry.credentials().switch().name as string
+        if (credentialType === 'sorobanCredentialsAddressWithDelegates') {
+            throw new Error('ADDRESS_WITH_DELEGATES auth entries are not supported by passkey signing yet')
+        }
+
+        const credentials = getAddressCredentials(entry.credentials());
 
         if (!expiration) {
             expiration = credentials.signatureExpirationLedger()
@@ -255,21 +390,11 @@ export class PasskeyKit extends PasskeyBase {
             if (!expiration) {
                 const { sequence } = await this.rpc.getLatestLedger()
                 expiration = sequence + this.timeoutInSeconds / 5; // assumes 5 second ledger time
+                expiration = Math.ceil(expiration)
             }
         }
 
-        credentials.signatureExpirationLedger(expiration)
-
-        const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
-            new xdr.HashIdPreimageSorobanAuthorization({
-                networkId: hash(Buffer.from(this.networkPassphrase)),
-                nonce: credentials.nonce(),
-                signatureExpirationLedger: credentials.signatureExpirationLedger(),
-                invocation: entry.rootInvocation()
-            })
-        )
-
-        const payload = hash(preimage.toXDR())
+        const payload = buildSignaturePayload(this.networkPassphrase, entry, expiration)
 
         // let signatures: Signatures
         let key: SDKSignerKey
@@ -367,8 +492,8 @@ export class PasskeyKit extends PasskeyBase {
         const scValType = xdr.ScSpecTypeDef.scSpecTypeUdt(
             new xdr.ScSpecTypeUdt({ name: "Signature" }),
         );
-        const scKey = this.wallet!.spec.nativeToScVal(key, scKeyType);
-        const scVal = val ? this.wallet!.spec.nativeToScVal(val, scValType) : xdr.ScVal.scvVoid();
+        const scKey = this.walletSpec.nativeToScVal(key, scKeyType);
+        const scVal = val ? this.walletSpec.nativeToScVal(val, scValType) : xdr.ScVal.scvVoid();
         const scEntry = new xdr.ScMapEntry({
             key: scKey,
             val: scVal,
@@ -434,7 +559,7 @@ export class PasskeyKit extends PasskeyBase {
     ) {
         if (!(txn instanceof AssembledTransaction)) {
             try {
-                txn = AssembledTransaction.fromXDR(this.wallet!.options, typeof txn === 'string' ? txn : txn.toXDR(), this.wallet!.spec);
+                txn = AssembledTransaction.fromXDR(this.wallet!.options, typeof txn === 'string' ? txn : txn.toXDR(), this.walletSpec);
             } catch {
                 if (!(txn instanceof AssembledTransaction)) {
                     const built = TransactionBuilder.fromXDR(typeof txn === 'string' ? txn : txn.toXDR(), this.networkPassphrase);
@@ -695,4 +820,4 @@ export class PasskeyKit extends PasskeyBase {
 
         return concatSignature;
     }
-}
+}

package/src/sac.ts

@@ -1,6 +1,6 @@
 import { Client as SacClient } from 'sac-sdk'
 import { PasskeyBase } from "./base"
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc'
+import type { Server } from '@stellar/stellar-sdk/rpc'
 
 export class SACClient extends PasskeyBase {
     declare rpc: Server

package/src/server.ts

@@ -1,29 +1,26 @@
-import { xdr } from "@stellar/stellar-sdk/minimal"
+import { xdr } from "@stellar/stellar-sdk"
 import { PasskeyBase } from "./base"
 import base64url from "base64url"
-import type { Tx } from "@stellar/stellar-sdk/minimal/contract"
+import type { Tx } from "@stellar/stellar-sdk/contract"
 import type { Signer } from "./types"
-import { AssembledTransaction } from "@stellar/stellar-sdk/minimal/contract"
-import { Durability } from "@stellar/stellar-sdk/minimal/rpc"
-import { version } from '../package.json'
-
-// TODO set default headers in constructor
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract"
+import { Durability } from "@stellar/stellar-sdk/rpc"
+import { ChannelsClient } from "@openzeppelin/relayer-plugin-channels"
 
 export class PasskeyServer extends PasskeyBase {
-    private launchtubeJwt: string | undefined
+    private relayerApiKey: string | undefined
     private mercuryJwt: string | undefined
     private mercuryKey: string | undefined
+    private channelsClient: ChannelsClient | undefined
 
-    public launchtubeUrl: string | undefined
-    public launchtubeHeaders: Record<string, string> | undefined
+    public relayerUrl: string | undefined
     public mercuryProjectName: string | undefined
     public mercuryUrl: string | undefined
 
     constructor(options: {
         rpcUrl?: string,
-        launchtubeUrl?: string,
-        launchtubeJwt?: string,
-        launchtubeHeaders?: Record<string, string>
+        relayerUrl?: string,
+        relayerApiKey?: string,
         mercuryProjectName?: string,
         mercuryUrl?: string,
         mercuryJwt?: string,
@@ -31,9 +28,8 @@ export class PasskeyServer extends PasskeyBase {
     }) {
         const {
             rpcUrl,
-            launchtubeUrl,
-            launchtubeJwt,
-            launchtubeHeaders,
+            relayerUrl,
+            relayerApiKey,
             mercuryProjectName,
             mercuryUrl,
             mercuryJwt,
@@ -42,14 +38,18 @@ export class PasskeyServer extends PasskeyBase {
 
         super(rpcUrl)
 
-        if (launchtubeUrl)
-            this.launchtubeUrl = launchtubeUrl
+        if (relayerUrl)
+            this.relayerUrl = relayerUrl
 
-        if (launchtubeJwt)
-            this.launchtubeJwt = launchtubeJwt
+        if (relayerApiKey)
+            this.relayerApiKey = relayerApiKey
 
-        if (launchtubeHeaders)
-            this.launchtubeHeaders = launchtubeHeaders
+        if (relayerUrl && relayerApiKey) {
+            this.channelsClient = new ChannelsClient({
+                baseUrl: relayerUrl,
+                apiKey: relayerApiKey,
+            })
+        }
 
         if (mercuryProjectName)
             this.mercuryProjectName = mercuryProjectName
@@ -158,42 +158,22 @@ export class PasskeyServer extends PasskeyBase {
         - Add a method for getting a paginated or filtered list of all a wallet's events
     */
 
-    public async send<T>(
-        txn: AssembledTransaction<T> | Tx | string, 
-        fee?: number,
-    ) {
-        if (!this.launchtubeUrl)
-            throw new Error('Launchtube service not configured')
+    public async send<T>(txn: AssembledTransaction<T> | Tx | string) {
+        if (!this.channelsClient)
+            throw new Error('Relayer service not configured')
 
-        const data = new FormData();
+        let txnXdr: string
 
         if (txn instanceof AssembledTransaction) {
-            txn = txn.built!.toXDR()
+            txnXdr = txn.built!.toXDR()
         } else if (typeof txn !== 'string') {
-            txn = txn.toXDR()
+            txnXdr = txn.toXDR()
+        } else {
+            txnXdr = txn
         }
 
-        data.set('xdr', txn);
-
-        if (fee)
-            data.set('fee', fee.toString());
-
-        let lt_headers = Object.assign({
-            'X-Client-Name': 'passkey-kit',
-            'X-Client-Version': version,
-        }, this.launchtubeHeaders)
-
-        if (this.launchtubeJwt)
-            lt_headers.authorization = `Bearer ${this.launchtubeJwt}`
-
-        return fetch(this.launchtubeUrl, {
-            method: 'POST',
-            headers: lt_headers,
-            body: data
-        }).then(async (res) => {
-            if (res.ok)
-            return res.json()
-            else throw await res.json()
+        return this.channelsClient.submitTransaction({
+            xdr: txnXdr,
         })
     }
-}
+}

package/types/base.d.ts

@@ -1,4 +1,4 @@
-import { Server } from "@stellar/stellar-sdk/minimal/rpc";
+import { Server } from "@stellar/stellar-sdk/rpc";
 export declare class PasskeyBase {
     rpcUrl: string | undefined;
     rpc: Server | undefined;

package/types/kit.d.ts

@@ -1,11 +1,16 @@
 import { Client as PasskeyClient } from 'passkey-kit-sdk';
-import { xdr, Keypair } from '@stellar/stellar-sdk/minimal';
+import * as StellarSdk from '@stellar/stellar-sdk';
+import { xdr, Keypair } from '@stellar/stellar-sdk';
 import { startRegistration, startAuthentication, type AuthenticationResponseJSON, type AuthenticatorSelectionCriteria } from "@simplewebauthn/browser";
 import { Buffer } from 'buffer';
 import type { SignerKey, SignerLimits, SignerStore } from './types';
 import { PasskeyBase } from './base';
-import { AssembledTransaction, type Tx } from '@stellar/stellar-sdk/minimal/contract';
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc';
+import { AssembledTransaction, type Tx } from '@stellar/stellar-sdk/contract';
+import type { Server } from '@stellar/stellar-sdk/rpc';
+export declare function getAddressCredentials(credentials: xdr.SorobanCredentials): xdr.SorobanAddressCredentials;
+export declare function usesAddressBoundPayload(credentials: xdr.SorobanCredentials): boolean;
+export declare function assertSignatureExpirationLedger(expiration: number): void;
+export declare function buildSignaturePayload(networkPassphrase: string, entry: xdr.SorobanAuthorizationEntry, expiration: number): Buffer;
 export declare class PasskeyKit extends PasskeyBase {
     rpc: Server;
     rpcUrl: string;
@@ -17,6 +22,7 @@ export declare class PasskeyKit extends PasskeyBase {
     keyId: string | undefined;
     networkPassphrase: string;
     wallet: PasskeyClient | undefined;
+    private get walletSpec();
     constructor(options: {
         rpcUrl: string;
         networkPassphrase: string;
@@ -35,7 +41,7 @@ export declare class PasskeyKit extends PasskeyBase {
         keyId: Buffer<ArrayBufferLike>;
         keyIdBase64: string;
         contractId: string;
-        signedTx: Tx;
+        signedTx: StellarSdk.Transaction;
     }>;
     createKey(app: string, user: string, settings?: {
         rpId?: string;
@@ -70,14 +76,14 @@ export declare class PasskeyKit extends PasskeyBase {
         keypair?: Keypair;
         policy?: string;
         expiration?: number;
-    }): Promise<AssembledTransaction<T>>;
-    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updateSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<AssembledTransaction<null>>;
-    remove(signer: SignerKey): Promise<AssembledTransaction<null>>;
+    }): Promise<StellarSdk.contract.AssembledTransaction<T>>;
+    addSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    addEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    addPolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updateSecp256r1(keyId: string | Uint8Array, publicKey: string | Uint8Array, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updateEd25519(publicKey: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    updatePolicy(policy: string, limits: SignerLimits, store: SignerStore, expiration?: number): Promise<StellarSdk.contract.AssembledTransaction<null>>;
+    remove(signer: SignerKey): Promise<StellarSdk.contract.AssembledTransaction<null>>;
     private secp256r1;
     private ed25519;
     private policy;

package/types/sac.d.ts

@@ -1,6 +1,6 @@
 import { Client as SacClient } from 'sac-sdk';
 import { PasskeyBase } from "./base";
-import type { Server } from '@stellar/stellar-sdk/minimal/rpc';
+import type { Server } from '@stellar/stellar-sdk/rpc';
 export declare class SACClient extends PasskeyBase {
     rpc: Server;
     rpcUrl: string;

package/types/server.d.ts

@@ -1,20 +1,19 @@
 import { PasskeyBase } from "./base";
-import type { Tx } from "@stellar/stellar-sdk/minimal/contract";
+import type { Tx } from "@stellar/stellar-sdk/contract";
 import type { Signer } from "./types";
-import { AssembledTransaction } from "@stellar/stellar-sdk/minimal/contract";
+import { AssembledTransaction } from "@stellar/stellar-sdk/contract";
 export declare class PasskeyServer extends PasskeyBase {
-    private launchtubeJwt;
+    private relayerApiKey;
     private mercuryJwt;
     private mercuryKey;
-    launchtubeUrl: string | undefined;
-    launchtubeHeaders: Record<string, string> | undefined;
+    private channelsClient;
+    relayerUrl: string | undefined;
     mercuryProjectName: string | undefined;
     mercuryUrl: string | undefined;
     constructor(options: {
         rpcUrl?: string;
-        launchtubeUrl?: string;
-        launchtubeJwt?: string;
-        launchtubeHeaders?: Record<string, string>;
+        relayerUrl?: string;
+        relayerApiKey?: string;
         mercuryProjectName?: string;
         mercuryUrl?: string;
         mercuryJwt?: string;
@@ -26,5 +25,5 @@ export declare class PasskeyServer extends PasskeyBase {
         publicKey?: string;
         policy?: string;
     }, index?: number): Promise<string>;
-    send<T>(txn: AssembledTransaction<T> | Tx | string, fee?: number): Promise<any>;
+    send<T>(txn: AssembledTransaction<T> | Tx | string): Promise<import("@openzeppelin/relayer-plugin-channels").ChannelsTransactionResponse>;
 }