[dependabot]

Bumps @pollar/react from 0.11.2 to 0.11.5.

Changelog

Sourced from @​pollar/react's changelog.

0.11.5

@pollar/core, @pollar/react, @pollar/react-native and @pollar/solana-wallet-standard-adapter. No candidate was published for 0.11.5.

Turnkey co-signed wallets. A mainnet app whose dashboard sets wallet custody to COSIGNED gives each user a 2-of-2 quorum: this device's key and Pollar's approver key. This release is the device's half, and by default it is invisible to the app: the device verifies each request against Turnkey and votes on its own, so a signing call ends the same way as for a custodial wallet. A new confirmation policy lets an app show the user every signature first, whatever the custody. Also: Solana wallets the user signs with send through build and submit, payments reach Polygon, the ramp widget follows the chain a ramp settles on, and the Send modal takes a Stellar memo. This needs an sdk-api that serves the /cosign routes. See UPGRADE.md.

Co-signed wallets and the confirmation policy

@pollar/core

• config.confirmation: 'auto' (default) or 'prompt'. Under 'auto' a custodial wallet signs on the server, a co-signed one has the device verify and vote without a prompt, and an external one shows only its own wallet's popup: signTx returns signed and signAndSubmitTx / buildAndSignAndSubmitTx return success, as for a custodial wallet. A payload Turnkey disagrees with is rejected and the call ends in an error. Under 'prompt' every signature waits for the user first; onConfirmationRequest() and getPendingConfirmations() expose what is waiting, each with confirm() and reject().
• config.cosignManual keeps the raw flow: signing calls on a co-signed wallet answer { status: 'cosign_pending', request } (as do setTrustline and the transaction state, with awaiting_cosign), and the app approves through client.cosign.* and its own UI.
• Setup Pollar opens on its own (account creation, trustlines, an account on a new chain) is approved without a prompt only when the device decodes the request and it names this wallet: recognizedSetupRequest() reads the XDR field by field (createAccount, changeTrust, sponsorship) and refuses anything else. What it does not recognize reaches the pending list and the prompt.
• The device key is a second P-256 key under the cosign namespace (KeyManagerOptions.namespace, or your own config.cosignKeyManager), so logging out, which resets the DPoP key, leaves the user's vote in place. The login and createWallet() send its public key.
• client.cosign (CosignManager): pending(), get(), cancel(), devices(), verify(), approve(), reject(), refresh(), inspectQuorum() and revokeDevice(). getCosignState() and onCosignStateChange() expose the pending requests. pending() shares one in-flight read, and a request already seen in a final state never reopens.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)