@inco/shield-js 0.1.0 → 0.2.0

package/dist/generated/inco/shield/v2/types_pb.js

@@ -1,261 +1,12 @@
-// @generated by protoc-gen-es v1.10.1 with parameter "target=ts,import_extension=.js"
-// @generated from file inco/shield/v2/types.proto (package inco.shield.v2, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-import { Message, proto3 } from "@bufbuild/protobuf";
-/**
- * Address represents a 20-byte Ethereum address.
- * Stored as raw bytes to avoid encoding ambiguity (0x prefix, capitalization).
- *
- * @generated from message inco.shield.v2.Address
- */
-export class Address extends Message {
-    /**
-     * The raw 20-byte address value.
-     *
-     * @generated from field: bytes value = 1;
-     */
-    value = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.Address";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "value", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new Address().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new Address().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new Address().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(Address, a, b);
-    }
-}
-/**
- * Bytes32 represents a 32-byte value, used for hashes and other fixed-size data.
- *
- * @generated from message inco.shield.v2.Bytes32
- */
-export class Bytes32 extends Message {
-    /**
-     * The raw 32-byte value.
-     *
-     * @generated from field: bytes value = 1;
-     */
-    value = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.Bytes32";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "value", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new Bytes32().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new Bytes32().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new Bytes32().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(Bytes32, a, b);
-    }
-}
-/**
- * Handle is a unique identifier for a position in the shield state.
- * Used to track the covalidator's view of the on-chain state.
- *
- * @generated from message inco.shield.v2.Handle
- */
-export class Handle extends Message {
-    /**
-     * The 32-byte handle value.
-     *
-     * @generated from field: bytes value = 1;
-     */
-    value = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.Handle";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "value", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new Handle().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new Handle().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new Handle().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(Handle, a, b);
-    }
-}
-/**
- * AssetId identifies a specific asset type within the shield system.
- * Typically derived from the token contract address.
- *
- * @generated from message inco.shield.v2.AssetId
- */
-export class AssetId extends Message {
-    /**
-     * The 32-byte asset identifier.
-     *
-     * @generated from field: bytes value = 1;
-     */
-    value = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.AssetId";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "value", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new AssetId().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new AssetId().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new AssetId().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(AssetId, a, b);
-    }
-}
-/**
- * Uint256 is an unsigned 256-bit integer.
- *
- * Wire encoding: `value` is exactly 32 bytes, big-endian, unsigned. Same
- * byte layout as Solidity's `uint256` ABI encoding. Producers write the
- * integer to a 32-byte buffer big-endian (left-zero-padded); consumers
- * read the 32 bytes as a big-endian unsigned integer. The zero value is
- * 32 zero bytes (not an empty `value`). Length other than 32 is invalid.
- *
- * @generated from message inco.shield.v2.Uint256
- */
-export class Uint256 extends Message {
-    /**
-     * @generated from field: bytes value = 1;
-     */
-    value = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.Uint256";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "value", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new Uint256().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new Uint256().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new Uint256().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(Uint256, a, b);
-    }
-}
-/**
- * EncryptedEnvelope wraps an authenticated payload for the covalidator.
- * The covalidator determines the inner plaintext type from the RPC method being called.
- * The payload is serialized into a protobuf message and encrypted using the TEE's public key.
- *
- * @generated from message inco.shield.v2.EncryptedEnvelope
- */
-export class EncryptedEnvelope extends Message {
-    /**
-     * The payload bytes, encrypted using the TEE's public key.
-     *
-     * @generated from field: bytes payload = 1;
-     */
-    payload = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.EncryptedEnvelope";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "payload", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new EncryptedEnvelope().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new EncryptedEnvelope().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new EncryptedEnvelope().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(EncryptedEnvelope, a, b);
-    }
-}
-/**
- * EncryptedResponse wraps a response payload from the covalidator.
- * The response is serialized into a protobuf message and AEAD-encrypted using the caller's response_key.
- * The nonce and ciphertext are always populated.
- *
- * @generated from message inco.shield.v2.EncryptedResponse
- */
-export class EncryptedResponse extends Message {
-    /**
-     * The AEAD nonce used to encrypt the response payload.
-     *
-     * @generated from field: bytes nonce = 1;
-     */
-    nonce = new Uint8Array(0);
-    /**
-     * The AEAD-encrypted serialized response payload.
-     *
-     * @generated from field: bytes ciphertext = 2;
-     */
-    ciphertext = new Uint8Array(0);
-    constructor(data) {
-        super();
-        proto3.util.initPartial(data, this);
-    }
-    static runtime = proto3;
-    static typeName = "inco.shield.v2.EncryptedResponse";
-    static fields = proto3.util.newFieldList(() => [
-        { no: 1, name: "nonce", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-        { no: 2, name: "ciphertext", kind: "scalar", T: 12 /* ScalarType.BYTES */ },
-    ]);
-    static fromBinary(bytes, options) {
-        return new EncryptedResponse().fromBinary(bytes, options);
-    }
-    static fromJson(jsonValue, options) {
-        return new EncryptedResponse().fromJson(jsonValue, options);
-    }
-    static fromJsonString(jsonString, options) {
-        return new EncryptedResponse().fromJsonString(jsonString, options);
-    }
-    static equals(a, b) {
-        return proto3.util.equals(EncryptedResponse, a, b);
-    }
-}
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+export const file_inco_shield_v2_types = fileDesc("ChppbmNvL3NoaWVsZC92Mi90eXBlcy5wcm90bxIOaW5jby5zaGllbGQudjIiGAoHQWRkcmVzcxINCgV2YWx1ZRgBIAEoDCIYCgdCeXRlczMyEg0KBXZhbHVlGAEgASgMIhcKBkhhbmRsZRINCgV2YWx1ZRgBIAEoDCIYCgdBc3NldElkEg0KBXZhbHVlGAEgASgMIhgKB1VpbnQyNTYSDQoFdmFsdWUYASABKAwiJAoRRW5jcnlwdGVkRW52ZWxvcGUSDwoHcGF5bG9hZBgBIAEoDCJXCgtSZXF1ZXN0QXV0aBIdChBlaXA3MTJfc2lnbmF0dXJlGAEgASgMSACIAQESFAoMcmVzcG9uc2Vfa2V5GAIgASgMQhMKEV9laXA3MTJfc2lnbmF0dXJlIkgKDVNpZ25lZFJlcXVlc3QSKQoEYXV0aBgBIAEoCzIbLmluY28uc2hpZWxkLnYyLlJlcXVlc3RBdXRoEgwKBGJvZHkYAiABKAwiNgoRRW5jcnlwdGVkUmVzcG9uc2USDQoFbm9uY2UYASABKAwSEgoKY2lwaGVydGV4dBgCIAEoDCI1Cg5TaWduZWRSZXNwb25zZRIMCgRib2R5GAEgASgMEhUKDXRlZV9zaWduYXR1cmUYAiABKAxiBnByb3RvMw");
+export const AddressSchema = messageDesc(file_inco_shield_v2_types, 0);
+export const Bytes32Schema = messageDesc(file_inco_shield_v2_types, 1);
+export const HandleSchema = messageDesc(file_inco_shield_v2_types, 2);
+export const AssetIdSchema = messageDesc(file_inco_shield_v2_types, 3);
+export const Uint256Schema = messageDesc(file_inco_shield_v2_types, 4);
+export const EncryptedEnvelopeSchema = messageDesc(file_inco_shield_v2_types, 5);
+export const RequestAuthSchema = messageDesc(file_inco_shield_v2_types, 6);
+export const SignedRequestSchema = messageDesc(file_inco_shield_v2_types, 7);
+export const EncryptedResponseSchema = messageDesc(file_inco_shield_v2_types, 8);
+export const SignedResponseSchema = messageDesc(file_inco_shield_v2_types, 9);

package/dist/index.d.ts

@@ -1,12 +1,6 @@
-/**
- * IncoShield SDK
- *
- * TypeScript SDK for interacting with IncoShield contracts.
- * Works in both browser and Node.js environments.
- */
 export { bytesToHex, hexToBytes } from './binary.js';
 export * as contracts from './contracts/index.js';
-export { computeErc20AssetId } from './contracts/utils.js';
+export { computeErc20AssetId, ERC20_ASSET_STANDARD, } from './contracts/utils.js';
 export * from './errors.js';
 export * from './shield/index.js';
 export * as abi from './shield/shield.eip712.gen.js';

package/dist/index.js

@@ -1,19 +1,6 @@
-/**
- * IncoShield SDK
- *
- * TypeScript SDK for interacting with IncoShield contracts.
- * Works in both browser and Node.js environments.
- */
-// Binary helpers
 export { bytesToHex, hexToBytes } from './binary.js';
-// On-chain contract interactions
 export * as contracts from './contracts/index.js';
-export { computeErc20AssetId } from './contracts/utils.js';
-// Tagged error types
+export { computeErc20AssetId, ERC20_ASSET_STANDARD, } from './contracts/utils.js';
 export * from './errors.js';
-// Shield covalidator client
 export * from './shield/index.js';
-// Generated EIP-712 ABI structs and digest helpers
 export * as abi from './shield/shield.eip712.gen.js';
-// The UniswapV4 adapter is exposed via the `@inco/shield-js/uniswap` subpath so
-// its ethers/@uniswap peer dependencies stay optional for core consumers.

package/dist/shield/abi.d.ts

@@ -0,0 +1,5 @@
+import { type Hex } from 'viem';
+import { EIP712_TYPES, type EIP712StructTypes } from './shield.eip712.gen.js';
+export type StructName = keyof typeof EIP712_TYPES;
+export declare function encodeStruct<Name extends StructName>(name: Name, value: EIP712StructTypes[Name]): Hex;
+export declare function decodeStruct<Name extends StructName>(name: Name, data: Hex): EIP712StructTypes[Name];

package/dist/shield/abi.js

@@ -0,0 +1,28 @@
+import { decodeAbiParameters, encodeAbiParameters, } from 'viem';
+import { EIP712_TYPES, } from './shield.eip712.gen.js';
+function isStructName(name) {
+    return name in EIP712_TYPES;
+}
+function componentsOf(name) {
+    return EIP712_TYPES[name].map((f) => {
+        const isArray = f.type.endsWith('[]');
+        const elem = isArray ? f.type.slice(0, -2) : f.type;
+        if (isStructName(elem)) {
+            return {
+                name: f.name,
+                type: isArray ? 'tuple[]' : 'tuple',
+                components: componentsOf(elem),
+            };
+        }
+        return { name: f.name, type: f.type };
+    });
+}
+function structTupleParam(name) {
+    return { type: 'tuple', components: componentsOf(name) };
+}
+export function encodeStruct(name, value) {
+    return encodeAbiParameters([structTupleParam(name)], [value]);
+}
+export function decodeStruct(name, data) {
+    return decodeAbiParameters([structTupleParam(name)], data)[0];
+}

package/dist/shield/client.d.ts

@@ -1,72 +1,48 @@
-import { type Hex, type TransactionReceipt } from 'viem';
-import { type BundlerClient, type UserOperation } from 'viem/account-abstraction';
-import type { PermissionAttestation, PermissionAttestationRequest, TransferIntentOp, WithdrawalIntentOp } from './shield.eip712.gen.js';
-import type { Balance, DepositAttestation, GetBalanceParams, GetPermissionDetailsParams, GetPermissionsByOwnerParams, GetPermissionsBySpenderParams, PermissionDetails, PermissionInfo, RequestDepositAttestationParams, ShieldConfig } from './types.js';
+import { type Hex, type TransactionReceipt, type TypedDataDomain } from 'viem';
+import { type UserOperation } from 'viem/account-abstraction';
+import type { UserGasParams } from './intent.js';
+import { type DepositAttestationParams, type GetBalanceParams, type GetPermissionDetailsParams, type GetPermissionsByOwnerParams, type GetPermissionsBySpenderParams, type HistoryPageOptions, type SignedViewingSession, type ViewingSessionParams } from './rpc.js';
+import type { BalanceHistoryResponse, BalanceResponse, DepositAttestation, OwnerGenerationResponse, PermissionAttestation, PermissionDetailsResponse, PermissionListResponse, PermissionRequest, PortfolioHistoryResponse, PortfolioResponse, TransferIntentOp, WithdrawalIntentOp } from './shield.eip712.gen.js';
+import type { ResolvedSigner, ShieldConfig, ShieldSignerInput } from './types.js';
 import type { ENTRYPOINT_VERSION } from './userop/types.js';
 export declare function computeDomainSeparator(chainId: bigint, verifyingContract: Hex): Hex;
-/** Client interface for interacting with the shield conductor. */
+export declare function shieldDomain(chainId: bigint, verifyingContract: Hex): TypedDataDomain;
+export declare function resolveShieldSigner(signer: ShieldSignerInput): ResolvedSigner;
 export interface ShieldClient {
-    issueTransfer(intentOp: TransferIntentOp): Promise<{
+    issueTransfer(intentOp: TransferIntentOp, gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    issueWithdraw(intentOp: WithdrawalIntentOp): Promise<{
+    issueWithdraw(intentOp: WithdrawalIntentOp, gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    /**
-     * Owner-side issuance: sign a `PermissionIntent` and exchange it for a
-     * TEE-signed `PermissionAttestation` the spender presents on every draft.
-     */
-    requestPermissionAttestation(req: PermissionAttestationRequest): Promise<PermissionAttestation>;
-    issueDelegatedTransfer(intentOp: TransferIntentOp, attestation: PermissionAttestation): Promise<{
+    requestPermissionAttestation(req: PermissionRequest): Promise<PermissionAttestation>;
+    issueDelegatedTransfer(intentOp: TransferIntentOp, permissionId: Hex, gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    /** Settles byte-identically to a direct withdraw on-chain. */
-    issueDelegatedWithdraw(intentOp: WithdrawalIntentOp, attestation: PermissionAttestation): Promise<{
+    issueDelegatedWithdraw(intentOp: WithdrawalIntentOp, permissionId: Hex, gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    getBalance(params: GetBalanceParams): Promise<Balance>;
+    createViewingSession(params: ViewingSessionParams): Promise<SignedViewingSession>;
+    getBalance(viewing: SignedViewingSession, params: GetBalanceParams): Promise<BalanceResponse>;
+    getPortfolio(viewing: SignedViewingSession): Promise<PortfolioResponse>;
+    getBalanceHistory(viewing: SignedViewingSession, assetId: Hex, options?: HistoryPageOptions): Promise<BalanceHistoryResponse>;
+    getPortfolioHistory(viewing: SignedViewingSession, options?: HistoryPageOptions): Promise<PortfolioHistoryResponse>;
     revokeOne(params: {
         permissionId: Hex;
-    }): Promise<{
+    }, gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    revokeAll(): Promise<{
+    revokeAll(gas?: UserGasParams): Promise<{
         userOp: UserOperation<typeof ENTRYPOINT_VERSION>;
     }>;
-    requestDepositAttestation(params: RequestDepositAttestationParams): Promise<DepositAttestation>;
-    getPermissionsByOwner(params: GetPermissionsByOwnerParams): Promise<PermissionInfo[]>;
-    getPermissionsBySpender(params: GetPermissionsBySpenderParams): Promise<PermissionInfo[]>;
-    getPermissionDetails(params: GetPermissionDetailsParams): Promise<PermissionDetails>;
-    getOwnerGeneration(): Promise<bigint>;
-    /** Submit a UserOp through a bundler */
-    submitUserOp(userOp: UserOperation<typeof ENTRYPOINT_VERSION>, params: SubmitUserOpParams): Promise<{
+    requestDepositAttestation(params: DepositAttestationParams): Promise<DepositAttestation>;
+    getPermissionsByOwner(params?: GetPermissionsByOwnerParams): Promise<PermissionListResponse>;
+    getPermissionsBySpender(params?: GetPermissionsBySpenderParams): Promise<PermissionListResponse>;
+    getPermissionDetails(params: GetPermissionDetailsParams): Promise<PermissionDetailsResponse>;
+    getOwnerGeneration(): Promise<OwnerGenerationResponse>;
+    getLatestHandle(): Promise<Hex>;
+    submitUserOp(userOp: UserOperation<typeof ENTRYPOINT_VERSION>): Promise<{
         receipt: TransactionReceipt;
     }>;
 }
-/**
- * Create a client for the shield covalidator.
- *
- * @example
- * ```ts
- * import { createShieldClient } from "@inco/shield-js";
- * import { createConnectTransport } from "@connectrpc/connect-web";
- * import { privateKeyToAccount } from "viem/accounts";
- *
- * const transport = createConnectTransport({ baseUrl: "http://localhost:50051" });
- * const signer = privateKeyToAccount("0x...");
- *
- * const client = createShieldClient({
- *   transport,
- *   chainId: BigInt("<your-chain-id>"),
- *   shieldAddress: "0x...",
- *   signer,
- * });
- *
- * const balance = await client.getBalance({ address: signer.address, assetId: "0x..." });
- * ```
- */
 export declare function createShieldClient(config: ShieldConfig): Promise<ShieldClient>;
-type SubmitUserOpParams = {
-    bundlerClient: BundlerClient;
-};
-export {};

package/dist/shield/client.js

@@ -1,21 +1,29 @@
 import { createClient } from '@connectrpc/connect';
-import { createPublicClient, encodeAbiParameters, http, keccak256, toBytes, } from 'viem';
-import { createBundlerClient, } from 'viem/account-abstraction';
-import { MissingWalletAccount, ShieldError } from '../errors.js';
-import { ConductorService } from '../generated/inco/shield/v2/conductor_connect.js';
+import { createPublicClient, encodeAbiParameters, hashTypedData, http, keccak256, toBytes, zeroAddress, } from 'viem';
+import { createBundlerClient, entryPoint07Address, } from 'viem/account-abstraction';
+import { incoShieldAbi } from '../contracts/abi.js';
+import { MissingPaymasterAddress, MissingWalletAccount, ShieldError, } from '../errors.js';
+import { ConductorService } from '../generated/inco/shield/v2/conductor_pb.js';
 import { deserializePublicKey } from './encryption.js';
-import { getBalance, getOwnerGeneration, getPermissionDetails, getPermissionsByOwner, getPermissionsBySpender, issueDelegatedTransfer, issueDelegatedWithdraw, issueTransfer, issueWithdraw, requestDepositAttestation, requestPermissionAttestation, revokeAll, revokeOne, } from './rpc.js';
-import { getChainFromId } from './utils/chain.js';
-/**
- * Default bundler URL.
- * From: https://docs.pimlico.io/references/bundler/public-endpoint#public-endpoint
- */
-function defaultBundlerUrl(chainId) {
-    return `https://public.pimlico.io/v2/${chainId}/rpc`;
+import { createViewingSession, getBalance, getBalanceHistory, getLatestHandle, getOwnerGeneration, getPermissionDetails, getPermissionsByOwner, getPermissionsBySpender, getPortfolio, getPortfolioHistory, issueDelegatedTransfer, issueDelegatedWithdraw, issueTransfer, issueWithdraw, requestDepositAttestation, requestPermissionAttestation, revokeAll, revokeOne, } from './rpc.js';
+import { getPaymasterAssetAdapter } from './userop/token-exchange.js';
+import { defaultBundlerUrl, getChainFromId } from './utils/chain.js';
+async function resolvePaymasterContext(publicClient, shieldAddress) {
+    const paymaster = await publicClient.readContract({
+        address: shieldAddress,
+        abi: incoShieldAbi,
+        functionName: 'paymaster',
+    });
+    if (paymaster === zeroAddress) {
+        throw new MissingPaymasterAddress({
+            message: `shield ${shieldAddress} has no paymaster bound (paymaster() returned the zero address); call grantPaymasterRole before constructing a client`,
+        });
+    }
+    const adapter = await getPaymasterAssetAdapter(publicClient, paymaster);
+    return { paymaster, adapter };
 }
-// ---------------------------------------------------------------------------
-// EIP-712 domain utilities
-// ---------------------------------------------------------------------------
+const EIP712_DOMAIN_NAME = 'IncoShield';
+const EIP712_DOMAIN_VERSION = '1';
 const EIP712_DOMAIN_TYPEHASH = keccak256(toBytes('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)'));
 export function computeDomainSeparator(chainId, verifyingContract) {
     return keccak256(encodeAbiParameters([
@@ -26,12 +34,20 @@ export function computeDomainSeparator(chainId, verifyingContract) {
         { type: 'address' },
     ], [
         EIP712_DOMAIN_TYPEHASH,
-        keccak256(toBytes('IncoShield')),
-        keccak256(toBytes('1')),
+        keccak256(toBytes(EIP712_DOMAIN_NAME)),
+        keccak256(toBytes(EIP712_DOMAIN_VERSION)),
         chainId,
         verifyingContract,
     ]));
 }
+export function shieldDomain(chainId, verifyingContract) {
+    return {
+        name: EIP712_DOMAIN_NAME,
+        version: EIP712_DOMAIN_VERSION,
+        chainId,
+        verifyingContract,
+    };
+}
 function isShieldSigner(signer) {
     return ('address' in signer &&
         typeof signer.address === 'string' &&
@@ -39,9 +55,13 @@ function isShieldSigner(signer) {
         typeof signer.sign === 'function' &&
         !('account' in signer));
 }
-function resolveShieldSigner(signer) {
-    if (isShieldSigner(signer))
-        return signer;
+export function resolveShieldSigner(signer) {
+    if (isShieldSigner(signer)) {
+        return {
+            address: signer.address,
+            signTypedData: (typedData) => signer.sign({ hash: hashTypedData(typedData) }),
+        };
+    }
     const account = signer.account;
     if (!account)
         throw new MissingWalletAccount({
@@ -49,43 +69,13 @@ function resolveShieldSigner(signer) {
         });
     return {
         address: account.address,
-        sign: async ({ hash }) => {
-            if ('sign' in account && typeof account.sign === 'function') {
-                return account.sign({ hash });
-            }
-            return signer.signMessage({
-                account,
-                message: { raw: hash },
-            });
-        },
+        signTypedData: (typedData) => signer.signTypedData({ account, ...typedData }),
     };
 }
-/**
- * Create a client for the shield covalidator.
- *
- * @example
- * ```ts
- * import { createShieldClient } from "@inco/shield-js";
- * import { createConnectTransport } from "@connectrpc/connect-web";
- * import { privateKeyToAccount } from "viem/accounts";
- *
- * const transport = createConnectTransport({ baseUrl: "http://localhost:50051" });
- * const signer = privateKeyToAccount("0x...");
- *
- * const client = createShieldClient({
- *   transport,
- *   chainId: BigInt("<your-chain-id>"),
- *   shieldAddress: "0x...",
- *   signer,
- * });
- *
- * const balance = await client.getBalance({ address: signer.address, assetId: "0x..." });
- * ```
- */
 export async function createShieldClient(config) {
     const chain = getChainFromId(Number(config.chainId));
     const conductorClient = createClient(ConductorService, config.grpcTransport);
-    const domainSeparator = computeDomainSeparator(config.chainId, config.shieldAddress);
+    const domain = shieldDomain(config.chainId, config.shieldAddress);
     let teePublicKey;
     try {
         teePublicKey = await deserializePublicKey(config.teePublicKey);
@@ -97,28 +87,43 @@ export async function createShieldClient(config) {
     }
     const signer = resolveShieldSigner(config.signer);
     const bundlerUrl = config.bundlerUrl ?? defaultBundlerUrl(Number(config.chainId));
+    const publicClient = createPublicClient({
+        chain,
+        transport: config.viemTransport ?? http(chain.rpcUrls.default.http[0]),
+    });
     const bundlerClient = createBundlerClient({
-        client: createPublicClient({
-            chain,
-            transport: config.viemTransport ?? http(chain.rpcUrls.default.http[0]),
-        }),
+        client: publicClient,
         transport: http(bundlerUrl),
     });
-    const ctx = { rpc: conductorClient, domainSeparator, signer, teePublicKey };
+    const paymasterContext = await resolvePaymasterContext(publicClient, config.shieldAddress);
+    const ctx = {
+        rpc: conductorClient,
+        domain,
+        signer,
+        teePublicKey,
+        publicClient,
+        shieldConfig: config,
+        paymasterContext,
+    };
     return {
-        issueTransfer: (intentOp) => issueTransfer(ctx, intentOp),
-        issueWithdraw: (intentOp) => issueWithdraw(ctx, intentOp),
+        issueTransfer: (intentOp, gas) => issueTransfer(ctx, intentOp, gas),
+        issueWithdraw: (intentOp, gas) => issueWithdraw(ctx, intentOp, gas),
         requestPermissionAttestation: (params) => requestPermissionAttestation(ctx, params),
-        issueDelegatedTransfer: (intentOp, attestation) => issueDelegatedTransfer(ctx, intentOp, attestation),
-        issueDelegatedWithdraw: (intentOp, attestation) => issueDelegatedWithdraw(ctx, intentOp, attestation),
-        getBalance: (params) => getBalance(ctx, params),
-        revokeOne: (params) => revokeOne(ctx, params),
-        revokeAll: () => revokeAll(ctx),
+        issueDelegatedTransfer: (intentOp, permissionId, gas) => issueDelegatedTransfer(ctx, intentOp, permissionId, gas),
+        issueDelegatedWithdraw: (intentOp, permissionId, gas) => issueDelegatedWithdraw(ctx, intentOp, permissionId, gas),
+        createViewingSession: (params) => createViewingSession(ctx, params),
+        getBalance: (viewing, params) => getBalance(ctx, viewing, params),
+        getPortfolio: (viewing) => getPortfolio(ctx, viewing),
+        getBalanceHistory: (viewing, assetId, options) => getBalanceHistory(ctx, viewing, assetId, options),
+        getPortfolioHistory: (viewing, options) => getPortfolioHistory(ctx, viewing, options),
+        revokeOne: (params, gas) => revokeOne(ctx, params, gas),
+        revokeAll: (gas) => revokeAll(ctx, gas),
         requestDepositAttestation: (params) => requestDepositAttestation(ctx, params),
         getPermissionsByOwner: (params) => getPermissionsByOwner(ctx, params),
         getPermissionsBySpender: (params) => getPermissionsBySpender(ctx, params),
         getPermissionDetails: (params) => getPermissionDetails(ctx, params),
         getOwnerGeneration: () => getOwnerGeneration(ctx),
+        getLatestHandle: () => getLatestHandle(ctx),
         submitUserOp: async (userOp) => {
             return submitUserOp(userOp, {
                 bundlerClient,
@@ -128,7 +133,10 @@ export async function createShieldClient(config) {
 }
 async function submitUserOp(userOp, params) {
     const { bundlerClient } = params;
-    const userOpHash = await bundlerClient.sendUserOperation(userOp);
+    const userOpHash = await bundlerClient.sendUserOperation({
+        ...userOp,
+        entryPointAddress: entryPoint07Address,
+    });
     const { receipt } = await bundlerClient.waitForUserOperationReceipt({
         hash: userOpHash,
     });