Types

// Signatures of ed25519, session and secp256r1, exported by '@lazorkit/sdk-legacy':
import type { Commitment, PublicKey } from '@solana/web3.js';
import type {
  Ed25519SignerConfig,
  Secp256r1Signer,
  Secp256r1SignerConfig,
  SessionSignerConfig,
} from '@lazorkit/sdk-legacy';

declare function ed25519(publicKey: PublicKey, authorityPda?: PublicKey): Ed25519SignerConfig;
declare function session(sessionPda: PublicKey, sessionKeyPubkey: PublicKey): SessionSignerConfig;
declare function secp256r1(
  signer: Secp256r1Signer,          // { publicKeyBytes, credentialIdHash, rpId, sign(challenge) }
  opts?: { authorityPda?: PublicKey; slotOverride?: bigint; minContextSlot?: number; commitment?: Commitment },
): Secp256r1SignerConfig;

import type { Commitment, PublicKey } from '@solana/web3.js';

interface Secp256r1Params {
  /** 32-byte SHA-256 of the WebAuthn credential ID. */
  credentialIdHash: Uint8Array;
  /** 33-byte compressed pubkey. Read from the on-chain authority if omitted. */
  publicKeyBytes?: Uint8Array;
  /** Pre-derived authority PDA. Derived from credentialIdHash if omitted. */
  authorityPda?: PublicKey;
  /** Override slot (read from the connection if omitted). */
  slotOverride?: bigint;
  /** 1.3.0+: read the counter, key and slot from a node at or past this slot. */
  minContextSlot?: number;
  /** 1.3.0+: commitment for those reads. Default 'confirmed'. */
  commitment?: Commitment;
}

import type { PublicKey } from '@solana/web3.js';

// client.createWallet({ payer, userSeed, owner })
interface CreateWalletParams {
  payer: PublicKey;
  userSeed: Uint8Array;                                    // 32 bytes, unique per wallet
  owner: CreateWalletOwner;
}

type CreateWalletOwner = CreateWalletEd25519 | CreateWalletSecp256r1; // exported

interface CreateWalletEd25519 {                                       // exported
  type: 'ed25519';
  publicKey: PublicKey;
}

interface CreateWalletSecp256r1 {                                     // exported
  type: 'secp256r1';
  credentialIdHash: Uint8Array;                           // SHA-256 of the credential ID
  compressedPubkey: Uint8Array;                           // 33 bytes: the passkey's own key
  rpId: string;
}

interface WebAuthnResponse {
  signature: Uint8Array;           // 64-byte r||s, low-S — not the DER the browser returns
  authenticatorData: Uint8Array;   // WebAuthn authenticator data
  clientDataJsonHash: Uint8Array;  // SHA-256 of clientDataJSON
  clientDataJson: Uint8Array;      // raw clientDataJSON bytes
}

enum SessionActionType {
  SolLimit = 1, SolRecurringLimit = 2, SolMaxPerTx = 3,
  TokenLimit = 4, TokenRecurringLimit = 5, TokenMaxPerTx = 6,
  ProgramWhitelist = 10, ProgramBlacklist = 11,
}

type SessionAction =
  | { type: SessionActionType.SolLimit; remaining: bigint; expiresAt?: bigint }
  | { type: SessionActionType.SolRecurringLimit; limit: bigint; window: bigint; expiresAt?: bigint }
  | { type: SessionActionType.SolMaxPerTx; max: bigint; expiresAt?: bigint }
  | { type: SessionActionType.TokenLimit; mint: PublicKey; remaining: bigint; expiresAt?: bigint }
  | { type: SessionActionType.TokenRecurringLimit; mint: PublicKey; limit: bigint; window: bigint; expiresAt?: bigint }
  | { type: SessionActionType.TokenMaxPerTx; mint: PublicKey; max: bigint; expiresAt?: bigint }
  | { type: SessionActionType.ProgramWhitelist; programId: PublicKey; expiresAt?: bigint }
  | { type: SessionActionType.ProgramBlacklist; programId: PublicKey; expiresAt?: bigint };

import { Actions, serializeActions } from '@lazorkit/sdk-legacy';
import { PublicKey, SystemProgram } from '@solana/web3.js';

const mint = new PublicKey('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v');
const actions = [
  Actions.solLimit(10_000_000_000n),                          // (remaining, expiresAt?)
  Actions.solRecurringLimit({ limit: 1_000_000_000n, window: 216_000n }),
  Actions.solMaxPerTx(500_000_000n),                          // (max, expiresAt?)
  Actions.tokenLimit({ mint, remaining: 100_000_000n }),
  Actions.tokenRecurringLimit({ mint, limit: 10_000_000n, window: 216_000n }),
  Actions.tokenMaxPerTx({ mint, max: 5_000_000n }),
  Actions.programWhitelist(SystemProgram.programId),          // (programId, expiresAt?)
];
const policy = serializeActions(actions);                     // a Delegate's policy bytes

interface WalletAuthorityRecord {
  walletPda: PublicKey;
  authorityPda: PublicKey;
  vaultPda: PublicKey;                       // ← the address funds live at
  role: number;                              // 0=Owner, 1=Admin, 2=Delegate
  authorityType: number;                     // 0=Ed25519, 1=Secp256r1
}

// Find, prove, describe and decide in one call.
client.findOwnPasskeyWallet(params: {
  credentialIdHash: Uint8Array;
  rpId: string;
  proof: OwnershipProof;
  trustedKeys?: (PublicKey | string)[];      // your own Ed25519 keys on users' wallets
  watchMints?: (PublicKey | string)[];       // SPL Token mints your app receives
  includeV1?: boolean;                       // also scan the paired v1 deployment (default true)
}): Promise<{
  adopt: WalletFacts | null;                 // use it
  needsConfirmation: WalletFacts[];          // let the user choose, by vault address
  unproven: number;                          // found, but the proof did not verify: ignored
}>;

// The steps on their own.
client.findPasskeyWalletCandidates(params: {
  credentialIdHash: Uint8Array;
  rpId: string;
  includeV1?: boolean;
}): Promise<PasskeyWalletCandidate[]>;      // Owner-rank, under rpId — not proven yet

client.describeWalletCandidates(
  candidates: PasskeyWalletCandidate[],
  options?: { trustedKeys?: (PublicKey | string)[]; watchMints?: (PublicKey | string)[] },
): Promise<WalletFacts[]>;                   // a wallet whose account is gone is left out

import {
  OWNERSHIP_PROOF_DOMAIN,
  createTaggedOwnershipChallenge,
  createOwnershipChallenge,
  verifyOwnershipProof,
  pickOwnWallet,
  selectWalletByAddress,
} from '@lazorkit/sdk-legacy';

// OWNERSHIP_PROOF_DOMAIN = 'LazorKit ownership proof v1' (1.4.0+)

// 1.4.0+. OWNERSHIP_PROOF_DOMAIN (UTF-8) followed by 32 random bytes: 59 bytes, the same
// form as the wallet packages' createOwnershipChallenge. Fresh for every proof; never reuse one.
createTaggedOwnershipChallenge(): Uint8Array;

// 32 random bytes, unchanged. @deprecated as a passkey challenge (1.4.0): those bytes look
// like a transaction challenge. Use createTaggedOwnershipChallenge for every new proof.
createOwnershipChallenge(): Uint8Array;

// Pure. The candidates whose stored key produced the proof: a `webauthn.get` over exactly
// `proof.challenge` (either form, at least 16 bytes), under `rpId`, with the user present.
// [] on any failure; never throws.
verifyOwnershipProof<T extends { publicKey: Uint8Array }>(
  candidates: T[], proof: OwnershipProof, rpId: string,
): T[];

// Pure. The rule: adopt only the one wallet with signatureCount > 0, when it is
// controlledAlone. Otherwise every wallet goes to needsConfirmation, ordered signed-for
// first, then v1 before v2, then the fuller vault, then the wallet address.
pickOwnWallet(facts: WalletFacts[]): {
  adopt: WalletFacts | null;
  needsConfirmation: WalletFacts[];
};

// Pure. The candidate whose vault OR wallet PDA equals `address`, else null.
selectWalletByAddress<T extends { walletPda: PublicKey; vaultPda: PublicKey }>(
  candidates: T[], address: string | PublicKey,
): T | null;

/** A WebAuthn assertion over a challenge the caller chose. */
interface OwnershipProof {
  challenge: Uint8Array;           // >= 16 bytes; use createTaggedOwnershipChallenge()
  signature: Uint8Array;           // DER or 64-byte r||s
  authenticatorData: Uint8Array;
  clientDataJson: Uint8Array;
}

interface PasskeyWalletCandidate {
  version: 1 | 2;                  // 1 = pre-v2 wallet on the paired v1 deployment
  programId: PublicKey;
  walletPda: PublicKey;
  vaultPda: PublicKey;
  authorityPda: PublicKey;         // this passkey's authority on the wallet
  publicKey: Uint8Array;           // the 33-byte compressed P-256 key stored there
}

type AuthorityRoleName = 'owner' | 'admin' | 'spender' | 'unknown'; // 'spender' = Delegate

interface WalletFacts extends PasskeyWalletCandidate {
  lamports: number;                // vault balance
  slot: bigint;                    // slot the reads were made at
  otherAuthorities: {              // every authority except this passkey's
    authorityPda: PublicKey;
    type: 'ed25519' | 'secp256r1';
    role: AuthorityRoleName;
    publicKey?: PublicKey;         // Ed25519 only
    sameRelyingParty?: boolean;    // Secp256r1 only: created under the same rpId
    trusted: boolean;              // Ed25519 key in trustedKeys; a passkey never is
  }[];
  liveSessions: {                  // expiry at or after `slot`
    sessionPda: PublicKey;
    sessionKey: PublicKey;
    expiresAtSlot: bigint;
    trusted: boolean;
  }[];
  pendingDeferred: {               // expiry at or after `slot`
    deferredPda: PublicKey;
    authorizedBy: PublicKey;       // the authority PDA that authorized it
    expiresAtSlot: bigint;
    trusted: boolean;              // always false
  }[];
  vaultIsSystemAccount: boolean;   // false: the vault was handed to another program
  tokenGrants: {                   // rights over the vault's token accounts
    tokenAccount: PublicKey;
    tokenProgram: PublicKey;
    mint: PublicKey | null;        // null when too short to read
    kind: 'delegate' | 'closeAuthority' | 'owner' | 'unreadable';
    grantee: PublicKey | null;
    trusted: boolean;              // grantee is in trustedKeys
  }[];
  controlledAlone: boolean;        // nothing but this passkey and trusted keys can spend
  signatureCount: number;          // times this passkey has signed for it; 0 = never
}

import { SIGNED_MESSAGE_DOMAIN, signedMessageChallenge, type SignedMessageInput } from '@lazorkit/sdk-legacy';

// SIGNED_MESSAGE_DOMAIN = 'LazorKit signed message v1'
// SignedMessageInput = string | Uint8Array: a string is signed as its UTF-8 bytes

// tag || SHA-256(tag || message), tag = SIGNED_MESSAGE_DOMAIN: 58 bytes. Throws a
// TypeError for anything but a string or a typed array. The same bytes as the wallet
// packages' signedMessageChallenge.
signedMessageChallenge(message: SignedMessageInput): Uint8Array;

import {
  PROGRAM_ID_DEVNET,
  findWalletPda,
  findVaultPda,
  findAuthorityPda,
  findSessionPda,
  findDeferredExecPda,
} from '@lazorkit/sdk-legacy';
import type { PublicKey } from '@solana/web3.js';

declare const sessionKey: PublicKey, counter: number;
const programId = PROGRAM_ID_DEVNET;               // required: the helpers take the program id

const [walletPda]       = findWalletPda(userSeed, programId);
const [vaultPda]        = findVaultPda(walletPda, programId);
const [authorityPda]    = findAuthorityPda(walletPda, credentialIdHash, programId);
const [sessionPda]      = findSessionPda(walletPda, sessionKey.toBytes(), programId);
const [deferredExecPda] = findDeferredExecPda(walletPda, authorityPda, counter, programId);

import { AuthorityAccount, SessionAccount } from '@lazorkit/sdk-legacy';

declare const sessionPda: import('@solana/web3.js').PublicKey;

const authority = await AuthorityAccount.fromAccountAddress(connection, authorityPda);
console.log(authority.role, authority.counter, authority.policyLen, authority.wallet.toBase58());

const session = await SessionAccount.fromAccountAddress(connection, sessionPda);
console.log(session.sessionKey.toBase58(), session.expiresAt);

// Every authority on a wallet, with rank, counter and policy:
const authorities = await client.findAuthoritiesByWallet(walletPda);
// Whether the wallet has an Owner left to manage it:
const { ownerCount, isRecoverable } = await client.getRecoveryStatus(walletPda);

export const ROLE_OWNER   = 0;   // manages every authority, including other Owners
export const ROLE_ADMIN   = 1;   // manages Delegates and sessions
export const ROLE_SPENDER = 2;   // a Delegate: must carry a policy

export const AUTH_TYPE_ED25519   = 0;
export const AUTH_TYPE_SECP256R1 = 1;

import { ERROR_NAMES, MinContextSlotNotReachedError, errorFromCode, extractErrorCode } from '@lazorkit/sdk-legacy';

// From a thrown SendTransactionError (reads the error's text):
const code = extractErrorCode(err);          // e.g. 3024, or null
const name = errorFromCode(3024);            // 'ActionSolLimitExceeded'
console.log(code, name, ERROR_NAMES[3006]);

if (err instanceof MinContextSlotNotReachedError) {
  console.log(err.minContextSlot, err.waitedMs, err.commitment);
}