From 09eb1d71b83c4dd245a331affbb73d5c054f86f6 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Mon, 12 Jan 2026 22:18:10 -0800
Subject: [PATCH 1/8] feat: scripts and address for main net deploy

still needs front-end config
---
 .github/workflows/deploy-dawn-mainnet.yml  | 181 +++++++++++++++++++++
 scripts/check-dawn-deployment-readiness.sh | 160 ++++++++++++++++++
 scripts/deploy-dawn-mainnet.sh             | 101 ++++++++++++
 3 files changed, 442 insertions(+)
 create mode 100644 .github/workflows/deploy-dawn-mainnet.yml
 create mode 100755 scripts/check-dawn-deployment-readiness.sh
 create mode 100755 scripts/deploy-dawn-mainnet.sh

diff --git a/.github/workflows/deploy-dawn-mainnet.yml b/.github/workflows/deploy-dawn-mainnet.yml
new file mode 100644
index 00000000..7feabd97
--- /dev/null
+++ b/.github/workflows/deploy-dawn-mainnet.yml
@@ -0,0 +1,181 @@
+name: "Deploy Dawn Mainnet Contracts"
+
+on:
+    workflow_dispatch:
+        inputs:
+            fund_amount:
+                description: "Amount of ETH to fund the paymaster (e.g., 0.1)"
+                required: false
+                default: "0"
+            deploy_bundler:
+                description: "Deploy bundler service"
+                type: boolean
+                required: false
+                default: false
+            deploy_auth_server:
+                description: "Deploy auth server"
+                type: boolean
+                required: false
+                default: false
+
+env:
+    HUSKY: 0
+    CI: true
+
+jobs:
+    deploy-contracts:
+        runs-on: ubuntu-latest
+        outputs:
+            contracts: ${{ steps.deploy.outputs.contracts }}
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  submodules: recursive
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  version: 9.11.0
+
+            - name: Use Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: lts/Iron
+                  cache: "pnpm"
+
+            - name: Install dependencies
+              run: pnpm install -r --frozen-lockfile
+
+            - name: Install contract dependencies
+              run: pnpm install -r --frozen-lockfile
+              working-directory: packages/contracts
+
+            - name: Build contracts
+              run: pnpm build
+              working-directory: packages/contracts
+
+            - name: Deploy contracts to Dawn Mainnet
+              id: deploy
+              env:
+                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
+                  KEY_REGISTRY_OWNER_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
+              run: |
+                  # Deploy all contracts
+                  pnpm hardhat deploy \
+                    --network dawnMainnet \
+                    --file ../auth-server/stores/dawn-mainnet.json \
+                    --fund ${{ github.event.inputs.fund_amount }} \
+                    --keyregistryowner $KEY_REGISTRY_OWNER_PRIVATE_KEY
+
+                  # Read the deployed contracts
+                  echo "contracts=$(cat ../auth-server/stores/dawn-mainnet.json)" >> $GITHUB_OUTPUT
+              working-directory: packages/contracts
+
+            - name: Initialize OIDC Key Registry with Google keys
+              env:
+                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
+              run: |
+                  pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
+              working-directory: packages/contracts
+
+            - name: Verify deployment
+              env:
+                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
+              run: |
+                  node verify-dawn-deployment.js
+              working-directory: packages/contracts
+
+            - name: Upload deployment artifacts
+              uses: actions/upload-artifact@v4
+              with:
+                  name: dawn-mainnet-deployment
+                  path: packages/auth-server/stores/dawn-mainnet.json
+                  retention-days: 90
+
+            - name: Comment deployment info on commit
+              uses: actions/github-script@v7
+              with:
+                  script: |
+                      const contracts = JSON.parse('${{ steps.deploy.outputs.contracts }}');
+                      const comment = `
+                      ## 🚀 Dawn Mainnet Deployment Complete
+
+                      **Network:** Dawn Mainnet (Chain ID: 30715)
+                      **RPC URL:** https://zksync-os-mainnet-dawn.zksync.io
+                      **Block Explorer:** https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev
+
+                      ### Deployed Contracts
+
+                      | Contract | Address |
+                      |----------|---------|
+                      | Factory | \`${contracts.accountFactory}\` |
+                      | WebAuthn Validator | \`${contracts.passkey}\` |
+                      | Session Validator | \`${contracts.session}\` |
+                      | Beacon | \`${contracts.beacon}\` |
+                      | Guardian Recovery | \`${contracts.recovery}\` |
+                      | OIDC Recovery | \`${contracts.recoveryOidc}\` |
+                      | OIDC Key Registry | \`${contracts.oidcKeyRegistry}\` |
+                      | Paymaster | \`${contracts.accountPaymaster}\` |
+
+                      ### Next Steps
+                      1. Add these addresses to \`packages/auth-server/stores/client.ts\`
+                      2. Update bundler configuration if deploying bundler service
+                      3. Deploy auth-server if needed
+                      4. Test account creation and transactions
+                      `;
+
+                      github.rest.repos.createCommitComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        commit_sha: context.sha,
+                        body: comment
+                      });
+
+    deploy-bundler:
+        needs: deploy-contracts
+        if: ${{ github.event.inputs.deploy_bundler == 'true' }}
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Deploy Bundler Service
+              run: |
+                  echo "Bundler deployment would happen here"
+                  # TODO: Add bundler deployment steps when ready
+
+    deploy-auth-server:
+        needs: deploy-contracts
+        if: ${{ github.event.inputs.deploy_auth_server == 'true' }}
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  version: 9.11.0
+
+            - name: Use Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: lts/Iron
+                  cache: "pnpm"
+
+            - name: Download deployment artifacts
+              uses: actions/download-artifact@v4
+              with:
+                  name: dawn-mainnet-deployment
+                  path: packages/auth-server/stores/
+
+            - name: Install dependencies
+              run: pnpm install -r --frozen-lockfile
+
+            - name: Build auth server
+              run: pnpm nx build auth-server
+              env:
+                  NUXT_PUBLIC_CHAIN_ID: 30715
+
+            - name: Deploy to Firebase (or other hosting)
+              run: |
+                  echo "Auth server deployment would happen here"
+                  # TODO: Configure Firebase or other hosting for Dawn Mainnet
diff --git a/scripts/check-dawn-deployment-readiness.sh b/scripts/check-dawn-deployment-readiness.sh
new file mode 100755
index 00000000..4f5b68aa
--- /dev/null
+++ b/scripts/check-dawn-deployment-readiness.sh
@@ -0,0 +1,160 @@
+#!/bin/bash
+
+# Dawn Mainnet Pre-Deployment Checklist
+# Run this before deploying to ensure everything is ready
+
+set -e
+
+echo "🔍 Dawn Mainnet Pre-Deployment Checklist"
+echo "========================================="
+echo ""
+
+ISSUES=0
+
+# Check 1: Environment variables
+echo "1. Checking environment variables..."
+if [ -z "$WALLET_PRIVATE_KEY" ]; then
+  echo "   ❌ WALLET_PRIVATE_KEY not set"
+  ISSUES=$((ISSUES + 1))
+else
+  echo "   ✅ WALLET_PRIVATE_KEY set"
+fi
+
+if [ -z "$KEY_REGISTRY_OWNER_PRIVATE_KEY" ]; then
+  echo "   ❌ KEY_REGISTRY_OWNER_PRIVATE_KEY not set"
+  ISSUES=$((ISSUES + 1))
+else
+  echo "   ✅ KEY_REGISTRY_OWNER_PRIVATE_KEY set"
+fi
+echo ""
+
+# Check 2: Cast CLI installed
+echo "2. Checking for cast CLI..."
+if command -v cast &> /dev/null; then
+  echo "   ✅ cast installed ($(cast --version | head -n1))"
+else
+  echo "   ❌ cast not installed"
+  echo "      Install with: curl -L https://foundry.paradigm.xyz | bash && foundryup"
+  ISSUES=$((ISSUES + 1))
+fi
+echo ""
+
+# Check 3: pnpm installed
+echo "3. Checking for pnpm..."
+if command -v pnpm &> /dev/null; then
+  echo "   ✅ pnpm installed ($(pnpm --version))"
+else
+  echo "   ❌ pnpm not installed"
+  echo "      Install with: npm install -g pnpm"
+  ISSUES=$((ISSUES + 1))
+fi
+echo ""
+
+# Check 4: Network connectivity
+echo "4. Checking Dawn Mainnet connectivity..."
+if curl -s -X POST -H "Content-Type: application/json" \
+  --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' \
+  https://zksync-os-mainnet-dawn.zksync.io | grep -q "result"; then
+  echo "   ✅ Dawn Mainnet RPC accessible"
+else
+  echo "   ❌ Cannot connect to Dawn Mainnet RPC"
+  ISSUES=$((ISSUES + 1))
+fi
+echo ""
+
+# Check 5: Deployer balance
+if [ ! -z "$WALLET_PRIVATE_KEY" ]; then
+  echo "5. Checking deployer wallet balance..."
+  DEPLOYER_ADDRESS=$(cast wallet address --private-key $WALLET_PRIVATE_KEY 2>/dev/null || echo "")
+  
+  if [ ! -z "$DEPLOYER_ADDRESS" ]; then
+    echo "   📍 Deployer address: $DEPLOYER_ADDRESS"
+    
+    BALANCE=$(cast balance $DEPLOYER_ADDRESS --rpc-url https://zksync-os-mainnet-dawn.zksync.io 2>/dev/null || echo "0")
+    BALANCE_ETH=$(cast --to-unit $BALANCE ether 2>/dev/null || echo "0")
+    
+    echo "   💰 Balance: $BALANCE_ETH ETH"
+    
+    # Check if balance is sufficient (at least 0.5 ETH recommended)
+    BALANCE_GWEI=$(cast --to-unit $BALANCE gwei 2>/dev/null | cut -d. -f1)
+    if [ "$BALANCE_GWEI" -lt 500000000 ]; then
+      echo "   ⚠️  Low balance. Recommended: at least 1 ETH"
+      echo "      Transfer ETH to: $DEPLOYER_ADDRESS"
+      ISSUES=$((ISSUES + 1))
+    else
+      echo "   ✅ Sufficient balance for deployment"
+    fi
+  else
+    echo "   ❌ Invalid WALLET_PRIVATE_KEY"
+    ISSUES=$((ISSUES + 1))
+  fi
+else
+  echo "5. Skipping balance check (WALLET_PRIVATE_KEY not set)"
+fi
+echo ""
+
+# Check 6: Key registry owner balance
+if [ ! -z "$KEY_REGISTRY_OWNER_PRIVATE_KEY" ]; then
+  echo "6. Checking key registry owner wallet balance..."
+  OWNER_ADDRESS=$(cast wallet address --private-key $KEY_REGISTRY_OWNER_PRIVATE_KEY 2>/dev/null || echo "")
+  
+  if [ ! -z "$OWNER_ADDRESS" ]; then
+    echo "   📍 Owner address: $OWNER_ADDRESS"
+    
+    BALANCE=$(cast balance $OWNER_ADDRESS --rpc-url https://zksync-os-mainnet-dawn.zksync.io 2>/dev/null || echo "0")
+    BALANCE_ETH=$(cast --to-unit $BALANCE ether 2>/dev/null || echo "0")
+    
+    echo "   💰 Balance: $BALANCE_ETH ETH"
+    
+    # Check if balance is sufficient (at least 0.01 ETH recommended)
+    BALANCE_GWEI=$(cast --to-unit $BALANCE gwei 2>/dev/null | cut -d. -f1)
+    if [ "$BALANCE_GWEI" -lt 10000000 ]; then
+      echo "   ⚠️  Low balance. Recommended: at least 0.1 ETH"
+      echo "      Transfer ETH to: $OWNER_ADDRESS"
+      ISSUES=$((ISSUES + 1))
+    else
+      echo "   ✅ Sufficient balance"
+    fi
+  else
+    echo "   ❌ Invalid KEY_REGISTRY_OWNER_PRIVATE_KEY"
+    ISSUES=$((ISSUES + 1))
+  fi
+else
+  echo "6. Skipping owner balance check (KEY_REGISTRY_OWNER_PRIVATE_KEY not set)"
+fi
+echo ""
+
+# Check 7: Contracts build
+echo "7. Checking if contracts are built..."
+if [ -d "packages/contracts/artifacts-zk" ]; then
+  echo "   ✅ Contracts appear to be built"
+else
+  echo "   ⚠️  Contracts not built yet"
+  echo "      Run: cd packages/contracts && pnpm build"
+fi
+echo ""
+
+# Check 8: Dependencies installed
+echo "8. Checking if dependencies are installed..."
+if [ -d "node_modules" ] && [ -d "packages/contracts/node_modules" ]; then
+  echo "   ✅ Dependencies installed"
+else
+  echo "   ⚠️  Dependencies not fully installed"
+  echo "      Run: pnpm install -r"
+fi
+echo ""
+
+# Summary
+echo "========================================="
+if [ $ISSUES -eq 0 ]; then
+  echo "✅ All checks passed! Ready for deployment."
+  echo ""
+  echo "To deploy, run:"
+  echo "  ./scripts/deploy-dawn-mainnet.sh"
+  exit 0
+else
+  echo "❌ Found $ISSUES issue(s). Please fix them before deploying."
+  echo ""
+  echo "Need help? See: docs/DAWN_MAINNET_DEPLOYMENT.md"
+  exit 1
+fi
diff --git a/scripts/deploy-dawn-mainnet.sh b/scripts/deploy-dawn-mainnet.sh
new file mode 100755
index 00000000..31afdda2
--- /dev/null
+++ b/scripts/deploy-dawn-mainnet.sh
@@ -0,0 +1,101 @@
+#!/bin/bash
+
+# Dawn Mainnet Quick Deploy Script
+# This script provides a streamlined deployment process for Dawn Mainnet
+
+set -e  # Exit on error
+
+echo "🚀 Dawn Mainnet Deployment Script"
+echo "=================================="
+echo ""
+
+# Check prerequisites
+echo "📋 Checking prerequisites..."
+
+if [ -z "$WALLET_PRIVATE_KEY" ]; then
+  echo "❌ WALLET_PRIVATE_KEY environment variable not set"
+  echo "   Set it with: export WALLET_PRIVATE_KEY=your_private_key"
+  exit 1
+fi
+
+if [ -z "$KEY_REGISTRY_OWNER_PRIVATE_KEY" ]; then
+  echo "❌ KEY_REGISTRY_OWNER_PRIVATE_KEY environment variable not set"
+  echo "   Set it with: export KEY_REGISTRY_OWNER_PRIVATE_KEY=your_private_key"
+  exit 1
+fi
+
+echo "✅ Environment variables set"
+echo ""
+
+# Get deployer address
+DEPLOYER_ADDRESS=$(cast wallet address --private-key $WALLET_PRIVATE_KEY)
+echo "📍 Deployer Address: $DEPLOYER_ADDRESS"
+
+# Check deployer balance
+BALANCE=$(cast balance $DEPLOYER_ADDRESS --rpc-url https://zksync-os-mainnet-dawn.zksync.io)
+echo "💰 Deployer Balance: $(cast --to-unit $BALANCE ether) ETH"
+echo ""
+
+if [ "$(cast --to-unit $BALANCE ether | cut -d. -f1)" -lt 1 ]; then
+  echo "⚠️  Warning: Low balance. Recommended: at least 1 ETH for deployment + paymaster funding"
+  read -p "Continue anyway? (y/N): " -n 1 -r
+  echo
+  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    exit 1
+  fi
+fi
+
+# Navigate to contracts directory
+cd "$(dirname "$0")/../packages/contracts"
+
+echo "🔨 Building contracts..."
+pnpm build
+echo "✅ Contracts built"
+echo ""
+
+# Ask for paymaster funding amount
+read -p "💵 Enter amount of ETH to fund paymaster (e.g., 0.1, or 0 to skip): " FUND_AMOUNT
+echo ""
+
+# Deploy contracts
+echo "🚀 Deploying contracts to Dawn Mainnet..."
+pnpm hardhat deploy \
+  --network dawnMainnet \
+  --file ../auth-server/stores/dawn-mainnet.json \
+  --fund $FUND_AMOUNT \
+  --keyregistryowner $KEY_REGISTRY_OWNER_PRIVATE_KEY
+
+echo "✅ Contracts deployed"
+echo ""
+
+# Initialize OIDC Key Registry
+echo "🔑 Initializing OIDC Key Registry with Google keys..."
+ORIGINAL_WALLET=$WALLET_PRIVATE_KEY
+export WALLET_PRIVATE_KEY=$KEY_REGISTRY_OWNER_PRIVATE_KEY
+pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
+export WALLET_PRIVATE_KEY=$ORIGINAL_WALLET
+echo "✅ OIDC Key Registry initialized"
+echo ""
+
+# Verify deployment
+echo "🔍 Verifying deployment..."
+export WALLET_PRIVATE_KEY=$ORIGINAL_WALLET
+node verify-dawn-deployment.js
+echo ""
+
+# Display next steps
+echo "✅ Deployment Complete!"
+echo ""
+echo "📝 Next Steps:"
+echo "1. Update packages/auth-server/stores/client.ts with deployed addresses"
+echo "   (Addresses saved in: packages/auth-server/stores/dawn-mainnet.json)"
+echo ""
+echo "2. Deploy bundler service with the new contract addresses"
+echo ""
+echo "3. Deploy auth-server:"
+echo "   cd packages/auth-server"
+echo "   NUXT_PUBLIC_CHAIN_ID=30715 pnpm build"
+echo ""
+echo "4. Test the deployment end-to-end"
+echo ""
+echo "📄 Full deployment guide: docs/DAWN_MAINNET_DEPLOYMENT.md"

From 09c10031f3251d2d38a3c1c8bbcf97f0c83bcda8 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Mon, 12 Jan 2026 23:03:09 -0800
Subject: [PATCH 2/8] feat: add addresses

also try to fix the server in prod
---
 packages/auth-server/app.vue                  | 13 ++++---
 packages/auth-server/stores/client.ts         | 38 ++++++++++++++++++-
 packages/auth-server/stores/dawn-mainnet.json | 10 +++++
 3 files changed, 55 insertions(+), 6 deletions(-)
 create mode 100644 packages/auth-server/stores/dawn-mainnet.json

diff --git a/packages/auth-server/app.vue b/packages/auth-server/app.vue
index 2580964f..daf72fd1 100644
--- a/packages/auth-server/app.vue
+++ b/packages/auth-server/app.vue
@@ -10,11 +10,14 @@ import { createAppKit } from "@reown/appkit/vue";
 const { defaultChain } = useClientStore();
 const { metadata, projectId, wagmiAdapter } = useAppKit();
 
-createAppKit({
-  adapters: [wagmiAdapter],
-  networks: [defaultChain],
-  projectId,
-  metadata,
+// Defer AppKit initialization until after mount to avoid SSR/initialization issues
+onMounted(() => {
+  createAppKit({
+    adapters: [wagmiAdapter],
+    networks: [defaultChain],
+    projectId,
+    metadata,
+  });
 });
 
 // BigInt polyfill
diff --git a/packages/auth-server/stores/client.ts b/packages/auth-server/stores/client.ts
index ff4e9862..53e07d08 100644
--- a/packages/auth-server/stores/client.ts
+++ b/packages/auth-server/stores/client.ts
@@ -42,17 +42,40 @@ const zksyncOsLocal = defineChain({
   },
 });
 
-export const supportedChains = [localhost, zksyncOsTestnet, zksyncOsLocal];
+const dawnMainnet = defineChain({
+  id: 30715,
+  name: "Dawn Mainnet",
+  nativeCurrency: {
+    name: "Ether",
+    symbol: "ETH",
+    decimals: 18,
+  },
+  rpcUrls: {
+    default: {
+      http: ["https://zksync-os-mainnet-dawn.zksync.io"],
+    },
+  },
+  blockExplorers: {
+    default: {
+      name: "Dawn Mainnet Explorer",
+      url: "https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev",
+    },
+  },
+});
+
+export const supportedChains = [localhost, zksyncOsTestnet, zksyncOsLocal, dawnMainnet];
 export type SupportedChainId = (typeof supportedChains)[number]["id"];
 export const blockExplorerUrlByChain: Record<SupportedChainId, string> = {
   [localhost.id]: "http://localhost:3010",
   [zksyncOsTestnet.id]: "https://zksync-os-testnet-alpha.staging-scan-v2.zksync.dev",
   [zksyncOsLocal.id]: "",
+  [dawnMainnet.id]: "https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev",
 };
 export const blockExplorerApiByChain: Record<SupportedChainId, string> = {
   [localhost.id]: "http://localhost:3020",
   [zksyncOsTestnet.id]: "https://block-explorer-api.zksync-os-testnet-alpha.zksync.dev/api",
   [zksyncOsLocal.id]: "",
+  [dawnMainnet.id]: "https://block-explorer-api.zksync-os-mainnet-dawn.zksync.io",
 };
 
 type ChainContracts = {
@@ -79,6 +102,16 @@ export const contractsByChain: Record<SupportedChainId, ChainContracts> = {
     bundlerUrl: "https://bundler-api.stage-sso.zksync.dev",
     beacon: "0x1D779D791B55a093dE60da664C3F301a87f96C62",
   },
+  [dawnMainnet.id]: {
+    eoaValidator: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
+    webauthnValidator: "0x5FC8d32690cc91D4c39d9d3abcBD16989F875707",
+    sessionValidator: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
+    factory: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
+    bundlerUrl: "https://bundler-api.dawn-mainnet.zksync.io", // Update with actual bundler URL when available
+    beacon: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+    guardianExecutor: "0xa513E6E4b8f2a923D98304ec87F64353C4D5C853",
+    accountPaymaster: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1", // MockPaymaster
+  },
 };
 
 export const chainParameters: Record<SupportedChainId, { blockTime: number }> = {
@@ -91,6 +124,9 @@ export const chainParameters: Record<SupportedChainId, { blockTime: number }> =
   [zksyncOsTestnet.id]: {
     blockTime: 1,
   },
+  [dawnMainnet.id]: {
+    blockTime: 1,
+  },
 };
 
 export const useClientStore = defineStore("client", () => {
diff --git a/packages/auth-server/stores/dawn-mainnet.json b/packages/auth-server/stores/dawn-mainnet.json
new file mode 100644
index 00000000..3304c992
--- /dev/null
+++ b/packages/auth-server/stores/dawn-mainnet.json
@@ -0,0 +1,10 @@
+{
+  "eoaValidator": "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
+  "sessionValidator": "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
+  "webauthnValidator": "0x5FC8d32690cc91D4c39d9d3abcBD16989F875707",
+  "guardianExecutor": "0xa513E6E4b8f2a923D98304ec87F64353C4D5C853",
+  "accountImplementation": "0x2279B7A0a67DB372996a5FaB50D91eAA73d2eBe6",
+  "beacon": "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+  "factory": "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
+  "entryPoint": "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE"
+}

From 2e011640c64e5ebed59699406e9758fe5e723330 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Tue, 13 Jan 2026 01:16:47 -0800
Subject: [PATCH 3/8] fix: remove appkit

breaks page loading
---
 packages/auth-server/app.vue                  | 17 +-----
 packages/auth-server/composables/useAppKit.ts |  8 ++-
 packages/auth-server/plugins/appkit.client.ts | 55 +++++++++++++++++++
 3 files changed, 62 insertions(+), 18 deletions(-)
 create mode 100644 packages/auth-server/plugins/appkit.client.ts

diff --git a/packages/auth-server/app.vue b/packages/auth-server/app.vue
index daf72fd1..36455795 100644
--- a/packages/auth-server/app.vue
+++ b/packages/auth-server/app.vue
@@ -5,22 +5,7 @@
 </template>
 
 <script lang="ts" setup>
-import { createAppKit } from "@reown/appkit/vue";
-
-const { defaultChain } = useClientStore();
-const { metadata, projectId, wagmiAdapter } = useAppKit();
-
-// Defer AppKit initialization until after mount to avoid SSR/initialization issues
-onMounted(() => {
-  createAppKit({
-    adapters: [wagmiAdapter],
-    networks: [defaultChain],
-    projectId,
-    metadata,
-  });
-});
-
-// BigInt polyfill
+// BigInt polyfill for JSON serialization
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 (BigInt.prototype as any).toJSON = function () {
   return this.toString();
diff --git a/packages/auth-server/composables/useAppKit.ts b/packages/auth-server/composables/useAppKit.ts
index 4e118a96..5ef5ac45 100644
--- a/packages/auth-server/composables/useAppKit.ts
+++ b/packages/auth-server/composables/useAppKit.ts
@@ -5,11 +5,15 @@ export const useAppKit = () => {
   const { defaultChain } = useClientStore();
 
   const projectId = runtimeConfig.public.appKitProjectId;
+
+  // Use fallback for SSR/build time when window is not available
+  const origin = typeof window !== "undefined" ? window.location.origin : "https://auth.zksync.dev";
+
   const metadata = {
     name: "ZKsync SSO Auth Server",
     description: "ZKsync SSO Auth Server",
-    url: window.location.origin,
-    icons: [new URL("/icon-512.png", window.location.origin).toString()],
+    url: origin,
+    icons: [new URL("/icon-512.png", origin).toString()],
   };
 
   const wagmiAdapter = new WagmiAdapter({
diff --git a/packages/auth-server/plugins/appkit.client.ts b/packages/auth-server/plugins/appkit.client.ts
new file mode 100644
index 00000000..d0c25363
--- /dev/null
+++ b/packages/auth-server/plugins/appkit.client.ts
@@ -0,0 +1,55 @@
+import { createAppKit } from "@reown/appkit/vue";
+
+export default defineNuxtPlugin(async () => {
+  const { defaultChain } = useClientStore();
+
+  // Dynamic import to ensure browser globals are available
+  const { WagmiAdapter } = await import("@reown/appkit-adapter-wagmi");
+  const runtimeConfig = useRuntimeConfig();
+
+  const projectId = runtimeConfig.public.appKitProjectId;
+  const origin = window.location.origin;
+
+  const metadata = {
+    name: "ZKsync SSO Auth Server",
+    description: "ZKsync SSO Auth Server",
+    url: origin,
+    icons: [new URL("/icon-512.png", origin).toString()],
+  };
+
+  // Create plain chain object to avoid Viem Proxy issues
+  const plainChain = {
+    id: defaultChain.id,
+    name: defaultChain.name,
+    nativeCurrency: {
+      name: defaultChain.nativeCurrency.name,
+      symbol: defaultChain.nativeCurrency.symbol,
+      decimals: defaultChain.nativeCurrency.decimals,
+    },
+    rpcUrls: {
+      default: {
+        http: [...defaultChain.rpcUrls.default.http],
+      },
+    },
+    blockExplorers: defaultChain.blockExplorers
+      ? {
+          default: {
+            name: defaultChain.blockExplorers.default.name,
+            url: defaultChain.blockExplorers.default.url,
+          },
+        }
+      : undefined,
+  };
+
+  const wagmiAdapter = new WagmiAdapter({
+    networks: [plainChain],
+    projectId,
+  });
+
+  createAppKit({
+    adapters: [wagmiAdapter],
+    networks: [plainChain],
+    projectId,
+    metadata,
+  });
+});

From 329e2495af5bf9d8c9c64ffd73089fdb6118682a Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Tue, 13 Jan 2026 01:18:57 -0800
Subject: [PATCH 4/8] fix: code review comments

---
 .github/workflows/deploy-dawn-mainnet.yml | 353 +++++++++++-----------
 1 file changed, 179 insertions(+), 174 deletions(-)

diff --git a/.github/workflows/deploy-dawn-mainnet.yml b/.github/workflows/deploy-dawn-mainnet.yml
index 7feabd97..14dd29dc 100644
--- a/.github/workflows/deploy-dawn-mainnet.yml
+++ b/.github/workflows/deploy-dawn-mainnet.yml
@@ -1,181 +1,186 @@
 name: "Deploy Dawn Mainnet Contracts"
 
+permissions:
+  contents: read
+
 on:
-    workflow_dispatch:
-        inputs:
-            fund_amount:
-                description: "Amount of ETH to fund the paymaster (e.g., 0.1)"
-                required: false
-                default: "0"
-            deploy_bundler:
-                description: "Deploy bundler service"
-                type: boolean
-                required: false
-                default: false
-            deploy_auth_server:
-                description: "Deploy auth server"
-                type: boolean
-                required: false
-                default: false
+  workflow_dispatch:
+    inputs:
+      fund_amount:
+        description: "Amount of ETH to fund the paymaster (e.g., 0.1)"
+        required: false
+        default: "0"
+      deploy_bundler:
+        description: "Deploy bundler service"
+        type: boolean
+        required: false
+        default: false
+      deploy_auth_server:
+        description: "Deploy auth server"
+        type: boolean
+        required: false
+        default: false
 
 env:
-    HUSKY: 0
-    CI: true
+  HUSKY: 0
+  CI: true
 
 jobs:
-    deploy-contracts:
-        runs-on: ubuntu-latest
-        outputs:
-            contracts: ${{ steps.deploy.outputs.contracts }}
-        steps:
-            - uses: actions/checkout@v4
-              with:
-                  submodules: recursive
-
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
-              with:
-                  version: 9.11.0
-
-            - name: Use Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: lts/Iron
-                  cache: "pnpm"
-
-            - name: Install dependencies
-              run: pnpm install -r --frozen-lockfile
-
-            - name: Install contract dependencies
-              run: pnpm install -r --frozen-lockfile
-              working-directory: packages/contracts
-
-            - name: Build contracts
-              run: pnpm build
-              working-directory: packages/contracts
-
-            - name: Deploy contracts to Dawn Mainnet
-              id: deploy
-              env:
-                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
-                  KEY_REGISTRY_OWNER_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
-              run: |
-                  # Deploy all contracts
-                  pnpm hardhat deploy \
-                    --network dawnMainnet \
-                    --file ../auth-server/stores/dawn-mainnet.json \
-                    --fund ${{ github.event.inputs.fund_amount }} \
-                    --keyregistryowner $KEY_REGISTRY_OWNER_PRIVATE_KEY
-
-                  # Read the deployed contracts
-                  echo "contracts=$(cat ../auth-server/stores/dawn-mainnet.json)" >> $GITHUB_OUTPUT
-              working-directory: packages/contracts
-
-            - name: Initialize OIDC Key Registry with Google keys
-              env:
-                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
-              run: |
-                  pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
-              working-directory: packages/contracts
-
-            - name: Verify deployment
-              env:
-                  WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
-              run: |
-                  node verify-dawn-deployment.js
-              working-directory: packages/contracts
-
-            - name: Upload deployment artifacts
-              uses: actions/upload-artifact@v4
-              with:
-                  name: dawn-mainnet-deployment
-                  path: packages/auth-server/stores/dawn-mainnet.json
-                  retention-days: 90
-
-            - name: Comment deployment info on commit
-              uses: actions/github-script@v7
-              with:
-                  script: |
-                      const contracts = JSON.parse('${{ steps.deploy.outputs.contracts }}');
-                      const comment = `
-                      ## 🚀 Dawn Mainnet Deployment Complete
-
-                      **Network:** Dawn Mainnet (Chain ID: 30715)
-                      **RPC URL:** https://zksync-os-mainnet-dawn.zksync.io
-                      **Block Explorer:** https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev
-
-                      ### Deployed Contracts
-
-                      | Contract | Address |
-                      |----------|---------|
-                      | Factory | \`${contracts.accountFactory}\` |
-                      | WebAuthn Validator | \`${contracts.passkey}\` |
-                      | Session Validator | \`${contracts.session}\` |
-                      | Beacon | \`${contracts.beacon}\` |
-                      | Guardian Recovery | \`${contracts.recovery}\` |
-                      | OIDC Recovery | \`${contracts.recoveryOidc}\` |
-                      | OIDC Key Registry | \`${contracts.oidcKeyRegistry}\` |
-                      | Paymaster | \`${contracts.accountPaymaster}\` |
-
-                      ### Next Steps
-                      1. Add these addresses to \`packages/auth-server/stores/client.ts\`
-                      2. Update bundler configuration if deploying bundler service
-                      3. Deploy auth-server if needed
-                      4. Test account creation and transactions
-                      `;
-
-                      github.rest.repos.createCommitComment({
-                        owner: context.repo.owner,
-                        repo: context.repo.repo,
-                        commit_sha: context.sha,
-                        body: comment
-                      });
-
-    deploy-bundler:
-        needs: deploy-contracts
-        if: ${{ github.event.inputs.deploy_bundler == 'true' }}
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Deploy Bundler Service
-              run: |
-                  echo "Bundler deployment would happen here"
-                  # TODO: Add bundler deployment steps when ready
-
-    deploy-auth-server:
-        needs: deploy-contracts
-        if: ${{ github.event.inputs.deploy_auth_server == 'true' }}
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
-              with:
-                  version: 9.11.0
-
-            - name: Use Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: lts/Iron
-                  cache: "pnpm"
-
-            - name: Download deployment artifacts
-              uses: actions/download-artifact@v4
-              with:
-                  name: dawn-mainnet-deployment
-                  path: packages/auth-server/stores/
-
-            - name: Install dependencies
-              run: pnpm install -r --frozen-lockfile
-
-            - name: Build auth server
-              run: pnpm nx build auth-server
-              env:
-                  NUXT_PUBLIC_CHAIN_ID: 30715
-
-            - name: Deploy to Firebase (or other hosting)
-              run: |
-                  echo "Auth server deployment would happen here"
-                  # TODO: Configure Firebase or other hosting for Dawn Mainnet
+  deploy-contracts:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    outputs:
+      contracts: ${{ steps.deploy.outputs.contracts }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.11.0
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/Iron
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install -r --frozen-lockfile
+
+      - name: Install contract dependencies
+        run: pnpm install -r --frozen-lockfile
+        working-directory: packages/contracts
+
+      - name: Build contracts
+        run: pnpm build
+        working-directory: packages/contracts
+
+      - name: Deploy contracts to Dawn Mainnet
+        id: deploy
+        env:
+          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
+          KEY_REGISTRY_OWNER_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
+        run: |
+          # Deploy all contracts
+          pnpm hardhat deploy \
+            --network dawnMainnet \
+            --file ../auth-server/stores/dawn-mainnet.json \
+            --fund ${{ github.event.inputs.fund_amount }} \
+            --keyregistryowner $KEY_REGISTRY_OWNER_PRIVATE_KEY
+
+          # Read the deployed contracts
+          echo "contracts=$(cat ../auth-server/stores/dawn-mainnet.json)" >> $GITHUB_OUTPUT
+        working-directory: packages/contracts
+
+      - name: Initialize OIDC Key Registry with Google keys
+        env:
+          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
+        run: |
+          pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
+        working-directory: packages/contracts
+
+      - name: Verify deployment
+        env:
+          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
+        run: |
+          node verify-dawn-deployment.js
+        working-directory: packages/contracts
+
+      - name: Upload deployment artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dawn-mainnet-deployment
+          path: packages/auth-server/stores/dawn-mainnet.json
+          retention-days: 90
+
+      - name: Comment deployment info on commit
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const contracts = JSON.parse('${{ steps.deploy.outputs.contracts }}');
+            const comment = `
+            ## 🚀 Dawn Mainnet Deployment Complete
+
+            **Network:** Dawn Mainnet (Chain ID: 30715)
+            **RPC URL:** https://zksync-os-mainnet-dawn.zksync.io
+            **Block Explorer:** https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev
+
+            ### Deployed Contracts
+
+            | Contract | Address |
+            |----------|---------|
+            | Factory | \`${contracts.accountFactory}\` |
+            | WebAuthn Validator | \`${contracts.passkey}\` |
+            | Session Validator | \`${contracts.session}\` |
+            | Beacon | \`${contracts.beacon}\` |
+            | Guardian Recovery | \`${contracts.recovery}\` |
+            | OIDC Recovery | \`${contracts.recoveryOidc}\` |
+            | OIDC Key Registry | \`${contracts.oidcKeyRegistry}\` |
+            | Paymaster | \`${contracts.accountPaymaster}\` |
+
+            ### Next Steps
+            1. Add these addresses to \`packages/auth-server/stores/client.ts\`
+            2. Update bundler configuration if deploying bundler service
+            3. Deploy auth-server if needed
+            4. Test account creation and transactions
+            `;
+
+            github.rest.repos.createCommitComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              commit_sha: context.sha,
+              body: comment
+            });
+
+  deploy-bundler:
+    needs: deploy-contracts
+    if: ${{ github.event.inputs.deploy_bundler == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Deploy Bundler Service
+        run: |
+          echo "Bundler deployment would happen here"
+          # TODO: Add bundler deployment steps when ready
+
+  deploy-auth-server:
+    needs: deploy-contracts
+    if: ${{ github.event.inputs.deploy_auth_server == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.11.0
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/Iron
+          cache: "pnpm"
+
+      - name: Download deployment artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dawn-mainnet-deployment
+          path: packages/auth-server/stores/
+
+      - name: Install dependencies
+        run: pnpm install -r --frozen-lockfile
+
+      - name: Build auth server
+        run: pnpm nx build auth-server
+        env:
+          NUXT_PUBLIC_CHAIN_ID: 30715
+
+      - name: Deploy to Firebase (or other hosting)
+        run: |
+          echo "Auth server deployment would happen here"
+          # TODO: Configure Firebase or other hosting for Dawn Mainnet

From dd22bb472eb278c833d4d3add059ee595d142c96 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Tue, 13 Jan 2026 08:25:54 -0800
Subject: [PATCH 5/8] chore: cspell update for gwei

in script comment
---
 cspell-config/cspell-misc.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cspell-config/cspell-misc.txt b/cspell-config/cspell-misc.txt
index d5d300ec..edd068b7 100644
--- a/cspell-config/cspell-misc.txt
+++ b/cspell-config/cspell-misc.txt
@@ -14,6 +14,7 @@ ethereum
 sepolia
 foundryup
 unpermitted
+gwei
 
 // auth-server
 oidc

From f325487d31462f8b40742bc07120adef99e9f6ab Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Wed, 14 Jan 2026 08:29:01 -0800
Subject: [PATCH 6/8] fix: addresses and scripts

tested locally
---
 .github/workflows/deploy-dawn-mainnet.yml     |  29 +++--
 packages/auth-server/stores/client.ts         |  13 +--
 packages/auth-server/stores/dawn-mainnet.json |  16 +--
 scripts/deploy-dawn-mainnet.sh                |   9 --
 scripts/verify-dawn-deployment.js             | 108 ++++++++++++++++++
 5 files changed, 139 insertions(+), 36 deletions(-)
 create mode 100644 scripts/verify-dawn-deployment.js

diff --git a/.github/workflows/deploy-dawn-mainnet.yml b/.github/workflows/deploy-dawn-mainnet.yml
index 14dd29dc..543ad3b3 100644
--- a/.github/workflows/deploy-dawn-mainnet.yml
+++ b/.github/workflows/deploy-dawn-mainnet.yml
@@ -76,19 +76,20 @@ jobs:
           echo "contracts=$(cat ../auth-server/stores/dawn-mainnet.json)" >> $GITHUB_OUTPUT
         working-directory: packages/contracts
 
-      - name: Initialize OIDC Key Registry with Google keys
+      - name: Verify contracts on block explorer
         env:
-          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
+          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
         run: |
-          pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
+          # Verify all deployed contracts on the block explorer
+          echo "🔍 Verifying contracts on Dawn Mainnet block explorer..."
+          pnpm hardhat verify-all --network dawnMainnet --file ../auth-server/stores/dawn-mainnet.json || echo "⚠️ Verification failed or already verified"
         working-directory: packages/contracts
 
       - name: Verify deployment
         env:
           WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
         run: |
-          node verify-dawn-deployment.js
-        working-directory: packages/contracts
+          node scripts/verify-dawn-deployment.js
 
       - name: Upload deployment artifacts
         uses: actions/upload-artifact@v4
@@ -113,14 +114,14 @@ jobs:
 
             | Contract | Address |
             |----------|---------|
-            | Factory | \`${contracts.accountFactory}\` |
-            | WebAuthn Validator | \`${contracts.passkey}\` |
-            | Session Validator | \`${contracts.session}\` |
+            | Factory | \`${contracts.factory}\` |
+            | WebAuthn Validator | \`${contracts.webauthnValidator}\` |
+            | Session Validator | \`${contracts.sessionValidator}\` |
+            | EOA Validator | \`${contracts.eoaValidator}\` |
+            | Guardian Executor | \`${contracts.guardianExecutor}\` |
             | Beacon | \`${contracts.beacon}\` |
-            | Guardian Recovery | \`${contracts.recovery}\` |
-            | OIDC Recovery | \`${contracts.recoveryOidc}\` |
-            | OIDC Key Registry | \`${contracts.oidcKeyRegistry}\` |
-            | Paymaster | \`${contracts.accountPaymaster}\` |
+            | Account Implementation | \`${contracts.accountImplementation}\` |
+            | Entry Point | \`${contracts.entryPoint}\` |
 
             ### Next Steps
             1. Add these addresses to \`packages/auth-server/stores/client.ts\`
@@ -140,6 +141,8 @@ jobs:
     needs: deploy-contracts
     if: ${{ github.event.inputs.deploy_bundler == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -152,6 +155,8 @@ jobs:
     needs: deploy-contracts
     if: ${{ github.event.inputs.deploy_auth_server == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
diff --git a/packages/auth-server/stores/client.ts b/packages/auth-server/stores/client.ts
index 53e07d08..d208b8da 100644
--- a/packages/auth-server/stores/client.ts
+++ b/packages/auth-server/stores/client.ts
@@ -103,14 +103,13 @@ export const contractsByChain: Record<SupportedChainId, ChainContracts> = {
     beacon: "0x1D779D791B55a093dE60da664C3F301a87f96C62",
   },
   [dawnMainnet.id]: {
-    eoaValidator: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
-    webauthnValidator: "0x5FC8d32690cc91D4c39d9d3abcBD16989F875707",
-    sessionValidator: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-    factory: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
     bundlerUrl: "https://bundler-api.dawn-mainnet.zksync.io", // Update with actual bundler URL when available
-    beacon: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
-    guardianExecutor: "0xa513E6E4b8f2a923D98304ec87F64353C4D5C853",
-    accountPaymaster: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1", // MockPaymaster
+    eoaValidator: "0x6f9861381E67DA7B26E7112cb1098027DD9e3dc6",
+    webauthnValidator: "0xe11bCfC99754CA38e1c0b0EE48E1C54C9e5B006B",
+    sessionValidator: "0x8Bd9da9021734fa962a57900ef6d626531158419",
+    guardianExecutor: "0xA1454A0cE96A52A3c8082675FE8C8Be7D620eF0E",
+    beacon: "0xF0a5f0f274aAfd2cA649a3B00b1d9FA22BD7d39A",
+    factory: "0x6F652864bDe910565beA169B89e133d70e2A9770",
   },
 };
 
diff --git a/packages/auth-server/stores/dawn-mainnet.json b/packages/auth-server/stores/dawn-mainnet.json
index 3304c992..cd03b3b8 100644
--- a/packages/auth-server/stores/dawn-mainnet.json
+++ b/packages/auth-server/stores/dawn-mainnet.json
@@ -1,10 +1,10 @@
 {
-  "eoaValidator": "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
-  "sessionValidator": "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-  "webauthnValidator": "0x5FC8d32690cc91D4c39d9d3abcBD16989F875707",
-  "guardianExecutor": "0xa513E6E4b8f2a923D98304ec87F64353C4D5C853",
-  "accountImplementation": "0x2279B7A0a67DB372996a5FaB50D91eAA73d2eBe6",
-  "beacon": "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
-  "factory": "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-  "entryPoint": "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE"
+  "eoaValidator": "0x6f9861381E67DA7B26E7112cb1098027DD9e3dc6",
+  "webauthnValidator": "0xe11bCfC99754CA38e1c0b0EE48E1C54C9e5B006B",
+  "sessionValidator": "0x8Bd9da9021734fa962a57900ef6d626531158419",
+  "guardianExecutor": "0xA1454A0cE96A52A3c8082675FE8C8Be7D620eF0E",
+  "accountImplementation": "0x223406537f502d3dC3Da23804b2c9F0E635267ad",
+  "beacon": "0xF0a5f0f274aAfd2cA649a3B00b1d9FA22BD7d39A",
+  "factory": "0x6F652864bDe910565beA169B89e133d70e2A9770",
+  "entryPoint": "0x0000000071727De22E5E9d8BAf0edAc6f37da032"
 }
diff --git a/scripts/deploy-dawn-mainnet.sh b/scripts/deploy-dawn-mainnet.sh
index 31afdda2..61bbfabf 100755
--- a/scripts/deploy-dawn-mainnet.sh
+++ b/scripts/deploy-dawn-mainnet.sh
@@ -68,15 +68,6 @@ pnpm hardhat deploy \
 echo "✅ Contracts deployed"
 echo ""
 
-# Initialize OIDC Key Registry
-echo "🔑 Initializing OIDC Key Registry with Google keys..."
-ORIGINAL_WALLET=$WALLET_PRIVATE_KEY
-export WALLET_PRIVATE_KEY=$KEY_REGISTRY_OWNER_PRIVATE_KEY
-pnpm hardhat run scripts/add-google-keys.ts --network dawnMainnet
-export WALLET_PRIVATE_KEY=$ORIGINAL_WALLET
-echo "✅ OIDC Key Registry initialized"
-echo ""
-
 # Verify deployment
 echo "🔍 Verifying deployment..."
 export WALLET_PRIVATE_KEY=$ORIGINAL_WALLET
diff --git a/scripts/verify-dawn-deployment.js b/scripts/verify-dawn-deployment.js
new file mode 100644
index 00000000..13e49c91
--- /dev/null
+++ b/scripts/verify-dawn-deployment.js
@@ -0,0 +1,108 @@
+/**
+ * Verification script for Dawn Mainnet deployment
+ * Checks that all contracts are deployed correctly and accessible
+ */
+
+import { ethers } from "ethers";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { Provider, Wallet } from "zksync-ethers";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const DAWN_MAINNET_RPC = "https://zksync-os-mainnet-dawn.zksync.io";
+const DEPLOYMENT_FILE = path.join(__dirname, "../packages/auth-server/stores/dawn-mainnet.json");
+
+async function main() {
+  console.log("🔍 Verifying Dawn Mainnet Deployment...\n");
+
+  // Check if deployment file exists
+  if (!fs.existsSync(DEPLOYMENT_FILE)) {
+    throw new Error(`Deployment file not found: ${DEPLOYMENT_FILE}`);
+  }
+
+  const contracts = JSON.parse(fs.readFileSync(DEPLOYMENT_FILE, "utf8"));
+  const provider = new Provider(DAWN_MAINNET_RPC);
+
+  console.log("📋 Checking deployed contracts:\n");
+
+  const contractNames = {
+    factory: "Factory",
+    webauthnValidator: "WebAuthn Validator",
+    sessionValidator: "Session Validator",
+    eoaValidator: "EOA Validator",
+    guardianExecutor: "Guardian Executor",
+    beacon: "Beacon",
+    accountImplementation: "Account Implementation",
+    entryPoint: "Entry Point",
+  };
+
+  let allValid = true;
+
+  for (const [key, name] of Object.entries(contractNames)) {
+    const address = contracts[key];
+    if (!address) {
+      console.log(`❌ ${name}: NOT DEPLOYED`);
+      allValid = false;
+      continue;
+    }
+
+    try {
+      const code = await provider.getCode(address);
+      if (code === "0x" || code === "0x0") {
+        console.log(`❌ ${name}: No code at ${address}`);
+        allValid = false;
+      } else {
+        console.log(`✅ ${name}: ${address}`);
+      }
+    } catch (error) {
+      console.log(`❌ ${name}: Error checking ${address} - ${error.message}`);
+      allValid = false;
+    }
+  }
+
+  console.log("\n📊 Network Information:");
+  const blockNumber = await provider.getBlockNumber();
+  console.log(`  Current block: ${blockNumber}`);
+
+  if (process.env.WALLET_PRIVATE_KEY) {
+    const wallet = new Wallet(process.env.WALLET_PRIVATE_KEY, provider);
+    const balance = await wallet.getBalance();
+    console.log(`  Deployer balance: ${ethers.formatEther(balance)} ETH`);
+  }
+
+  // Check paymaster balance if deployed
+  if (contracts.accountPaymaster) {
+    try {
+      const paymasterBalance = await provider.getBalance(contracts.accountPaymaster);
+      console.log(`  Paymaster balance: ${ethers.formatEther(paymasterBalance)} ETH`);
+
+      if (paymasterBalance === 0n) {
+        console.log(`\n⚠️  Warning: Paymaster has zero balance. Fund it to enable sponsored transactions.`);
+      }
+    } catch (error) {
+      console.log(`  ⚠️  Could not check paymaster balance: ${error.message}`);
+    }
+  }
+
+  if (!allValid) {
+    console.log("\n❌ Deployment verification FAILED");
+    process.exit(1);
+  }
+
+  console.log("\n✅ Deployment verification PASSED");
+  console.log("\n📝 Next steps:");
+  console.log("1. Add these contract addresses to packages/auth-server/stores/client.ts");
+  console.log("2. If paymaster balance is low, fund it with: pnpm hardhat fund-paymaster --network dawnMainnet");
+  console.log("3. Test account creation and transactions");
+  console.log("4. Deploy bundler service with these contract addresses");
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((error) => {
+    console.error("\n❌ Error:", error.message);
+    process.exit(1);
+  });

From 2c246ec216495c744c1f23e41d05905348b6e952 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Wed, 14 Jan 2026 09:04:09 -0800
Subject: [PATCH 7/8] fix: update url to app config

---
 packages/auth-server/composables/useAppKit.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/packages/auth-server/composables/useAppKit.ts b/packages/auth-server/composables/useAppKit.ts
index 5ef5ac45..12e2756e 100644
--- a/packages/auth-server/composables/useAppKit.ts
+++ b/packages/auth-server/composables/useAppKit.ts
@@ -5,9 +5,7 @@ export const useAppKit = () => {
   const { defaultChain } = useClientStore();
 
   const projectId = runtimeConfig.public.appKitProjectId;
-
-  // Use fallback for SSR/build time when window is not available
-  const origin = typeof window !== "undefined" ? window.location.origin : "https://auth.zksync.dev";
+  const origin = runtimeConfig.public.appUrl;
 
   const metadata = {
     name: "ZKsync SSO Auth Server",

From 28b33fc3858e03c30cf03cbf1cd9cb39c988a816 Mon Sep 17 00:00:00 2001
From: cbe <cbe@matterlabs.dev>
Date: Wed, 14 Jan 2026 11:10:31 -0800
Subject: [PATCH 8/8] fix: remove deployment workflow

have issues with github review requirements
---
 .github/workflows/deploy-dawn-mainnet.yml | 191 ----------------------
 1 file changed, 191 deletions(-)
 delete mode 100644 .github/workflows/deploy-dawn-mainnet.yml

diff --git a/.github/workflows/deploy-dawn-mainnet.yml b/.github/workflows/deploy-dawn-mainnet.yml
deleted file mode 100644
index 543ad3b3..00000000
--- a/.github/workflows/deploy-dawn-mainnet.yml
+++ /dev/null
@@ -1,191 +0,0 @@
-name: "Deploy Dawn Mainnet Contracts"
-
-permissions:
-  contents: read
-
-on:
-  workflow_dispatch:
-    inputs:
-      fund_amount:
-        description: "Amount of ETH to fund the paymaster (e.g., 0.1)"
-        required: false
-        default: "0"
-      deploy_bundler:
-        description: "Deploy bundler service"
-        type: boolean
-        required: false
-        default: false
-      deploy_auth_server:
-        description: "Deploy auth server"
-        type: boolean
-        required: false
-        default: false
-
-env:
-  HUSKY: 0
-  CI: true
-
-jobs:
-  deploy-contracts:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    outputs:
-      contracts: ${{ steps.deploy.outputs.contracts }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.11.0
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: lts/Iron
-          cache: "pnpm"
-
-      - name: Install dependencies
-        run: pnpm install -r --frozen-lockfile
-
-      - name: Install contract dependencies
-        run: pnpm install -r --frozen-lockfile
-        working-directory: packages/contracts
-
-      - name: Build contracts
-        run: pnpm build
-        working-directory: packages/contracts
-
-      - name: Deploy contracts to Dawn Mainnet
-        id: deploy
-        env:
-          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
-          KEY_REGISTRY_OWNER_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_KEY_REGISTRY_OWNER_PRIVATE_KEY }}
-        run: |
-          # Deploy all contracts
-          pnpm hardhat deploy \
-            --network dawnMainnet \
-            --file ../auth-server/stores/dawn-mainnet.json \
-            --fund ${{ github.event.inputs.fund_amount }} \
-            --keyregistryowner $KEY_REGISTRY_OWNER_PRIVATE_KEY
-
-          # Read the deployed contracts
-          echo "contracts=$(cat ../auth-server/stores/dawn-mainnet.json)" >> $GITHUB_OUTPUT
-        working-directory: packages/contracts
-
-      - name: Verify contracts on block explorer
-        env:
-          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
-        run: |
-          # Verify all deployed contracts on the block explorer
-          echo "🔍 Verifying contracts on Dawn Mainnet block explorer..."
-          pnpm hardhat verify-all --network dawnMainnet --file ../auth-server/stores/dawn-mainnet.json || echo "⚠️ Verification failed or already verified"
-        working-directory: packages/contracts
-
-      - name: Verify deployment
-        env:
-          WALLET_PRIVATE_KEY: ${{ secrets.DAWN_MAINNET_DEPLOYER_PRIVATE_KEY }}
-        run: |
-          node scripts/verify-dawn-deployment.js
-
-      - name: Upload deployment artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: dawn-mainnet-deployment
-          path: packages/auth-server/stores/dawn-mainnet.json
-          retention-days: 90
-
-      - name: Comment deployment info on commit
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const contracts = JSON.parse('${{ steps.deploy.outputs.contracts }}');
-            const comment = `
-            ## 🚀 Dawn Mainnet Deployment Complete
-
-            **Network:** Dawn Mainnet (Chain ID: 30715)
-            **RPC URL:** https://zksync-os-mainnet-dawn.zksync.io
-            **Block Explorer:** https://zksync-os-mainnet-dawn.staging-scan-v2.zksync.dev
-
-            ### Deployed Contracts
-
-            | Contract | Address |
-            |----------|---------|
-            | Factory | \`${contracts.factory}\` |
-            | WebAuthn Validator | \`${contracts.webauthnValidator}\` |
-            | Session Validator | \`${contracts.sessionValidator}\` |
-            | EOA Validator | \`${contracts.eoaValidator}\` |
-            | Guardian Executor | \`${contracts.guardianExecutor}\` |
-            | Beacon | \`${contracts.beacon}\` |
-            | Account Implementation | \`${contracts.accountImplementation}\` |
-            | Entry Point | \`${contracts.entryPoint}\` |
-
-            ### Next Steps
-            1. Add these addresses to \`packages/auth-server/stores/client.ts\`
-            2. Update bundler configuration if deploying bundler service
-            3. Deploy auth-server if needed
-            4. Test account creation and transactions
-            `;
-
-            github.rest.repos.createCommitComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              commit_sha: context.sha,
-              body: comment
-            });
-
-  deploy-bundler:
-    needs: deploy-contracts
-    if: ${{ github.event.inputs.deploy_bundler == 'true' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Deploy Bundler Service
-        run: |
-          echo "Bundler deployment would happen here"
-          # TODO: Add bundler deployment steps when ready
-
-  deploy-auth-server:
-    needs: deploy-contracts
-    if: ${{ github.event.inputs.deploy_auth_server == 'true' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.11.0
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: lts/Iron
-          cache: "pnpm"
-
-      - name: Download deployment artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: dawn-mainnet-deployment
-          path: packages/auth-server/stores/
-
-      - name: Install dependencies
-        run: pnpm install -r --frozen-lockfile
-
-      - name: Build auth server
-        run: pnpm nx build auth-server
-        env:
-          NUXT_PUBLIC_CHAIN_ID: 30715
-
-      - name: Deploy to Firebase (or other hosting)
-        run: |
-          echo "Auth server deployment would happen here"
-          # TODO: Configure Firebase or other hosting for Dawn Mainnet