@lit-protocol/vincent-app-sdk 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +22 -16
  2. package/dist/CHANGELOG.md +22 -16
  3. package/dist/package.json +6 -6
  4. package/package.json +8 -8
package/CHANGELOG.md CHANGED
@@ -1,3 +1,25 @@
1
+ ## 2.1.0 (2025-09-11)
2
+
3
+ ### 🚀 Features
4
+
5
+ - Refactor the Uniswap Swap Ability to utilize a prepare step which uses a Lit Action to generate and sign a Uniswap route generated by the V3 Alpha Router. The Swap Ability now intakes the signed route, validates it was signed by the expected PKP (which can only be used to sign the generated Uniswap routes within the prepare Lit Action), then uses the provided route to create and sign the Uniswap Swap transaction with the Agent Wallet PKP. The Uniswap Swap Ability was also updated to no longer support the Spending Limit Policy, and currently doesn't support any Policies. ([8bbb1c07](https://github.com/LIT-Protocol/Vincent/commit/8bbb1c07))
6
+
7
+ ### 🧱 Updated Dependencies
8
+
9
+ - Updated ability-sdk to 2.1.0
10
+ - Updated contracts-sdk to 1.2.0
11
+
12
+ ### ❤️ Thank You
13
+
14
+ - Wyatt Barnes @spacesailor24
15
+
16
+ ## 2.0.1 (2025-09-03)
17
+
18
+ ### 🧱 Updated Dependencies
19
+
20
+ - Updated ability-sdk to 2.0.1
21
+ - Updated contracts-sdk to 1.1.0
22
+
1
23
  # 2.0.0 (2025-08-05)
2
24
 
3
25
  ### 🚀 Features
@@ -6,7 +28,6 @@
6
28
  - ### Implement supported Vincent Ability API range ([14f0ece1](https://github.com/LIT-Protocol/Vincent/commit/14f0ece1))
7
29
 
8
30
  Added basic Ability API handling to ensure abilities & policies are only used by compatible abilities and policies, and with the correct version of the vincentAbilityClient / app-sdk
9
-
10
31
  - Added a new jsParam when VincentAbilityClient calls an ability, `vincentAbilityApiVersion`
11
32
  - LIT action wrappers for abilities + policies compare `vincentAbilityApiVersion` to match the major semver range the handler was built with from the ability-sdk
12
33
  - vincentAbilityHandler() is responsible for passing along the value when it evaluates supported policies
@@ -14,7 +35,6 @@
14
35
  ### 🩹 Fixes
15
36
 
16
37
  - ### Fix ability failure response cases ([e2be50d9](https://github.com/LIT-Protocol/Vincent/commit/e2be50d9))
17
-
18
38
  - Ensures that policy denial disables checking the ability result against its fail schema in the abilityClient, because it will always be undefined :)
19
39
  - Ensures that `context` is returned in the response from the abilityClient.execute() method in cases where the ability response was a runtime or schemaValidationError
20
40
 
@@ -22,7 +42,6 @@
22
42
 
23
43
  - Add support for CBOR2 encoded policy parameters using the new vincent-contracts-sdk ([868c6c2a](https://github.com/LIT-Protocol/Vincent/commit/868c6c2a))
24
44
  - ### Add support for explicit `schemaValidationError` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
25
-
26
45
  - Previously, a failure to validate either input or results of lifecycle method would result in `result: { zodError }` being returned
27
46
  - Now, `result` will be `undefined` and there will be an explicit `schemaValidationError` in the result of the ability / policy
28
47
 
@@ -35,7 +54,6 @@
35
54
  ```
36
55
 
37
56
  - ### `error` is now `runtimeError` and can only be set by `throw ...` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
38
-
39
57
  - Previously, if you had not defined a `deny` or `fail` schema, you could call `deny()` or `fail()` with a string
40
58
  - That string would end up in the ability/policy response as the `error` property instead of `result`
41
59
  - This was problematic because there was no consistent way to identify _un-handled_ error vs. _explicitly returned fail/deny results_
@@ -63,11 +81,9 @@
63
81
  - #### Renamed `consent page` to `delegation auth page` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
64
82
  - #### Move utils exports to `@lit-protocol/vincent-app-sdk/utils` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
65
83
  - #### Moved jwt exports to `@lit-protocol/vincent-app-sdk/jwt` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
66
-
67
84
  - Enhanced typedocs for all methods and removed type aliases for core functions
68
85
 
69
86
  - #### Move `VincentWebAppClient` exports to `@lit-protocol/vincent-app-sdk/webAppClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
70
-
71
87
  - Renamed `VincentWebAppClient` to `WebAuthClient`
72
88
  - Renamed `VincentAppClientConfig` to `WebAuthClientConfig`
73
89
  - Renamed `RedirectToVincentConsentPageParams` to `RedirectToVincentDelegationPageParams`
@@ -75,16 +91,13 @@
75
91
  - Renamed `getVincentWebAppClient()` to `getWebAuthClient()`
76
92
 
77
93
  - #### Move express-authentication-middleware exports to `@lit-protocol/vincent-app-sdk/expressMiddleware` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
78
-
79
94
  - Removed `ExpressAuthHelpers` interface - its types are now directly exported from the `expressMiddleware` package sub-path
80
95
 
81
96
  - #### Moved abilityClient exports to `@lit-protocol/vincent-app-sdk/abilityClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
82
97
  - ### Update express middleware to support non-app-specific JWTs ([9dd1cd26](https://github.com/LIT-Protocol/Vincent/commit/9dd1cd26))
83
-
84
98
  - Replaced individual function exports of `authenticatedRequestHandler()` and `getAuthenticateUserExpressHandler()` with a single `createVincentUserMiddleware()` function
85
99
 
86
100
  #### createVincentUserMiddleware({ allowedAudience, userKey, requiredAppId? }) -> { middleware(), handler() }
87
-
88
101
  - You can now configure the property on `req` where the vincent user JWT data will be placed using `userKey`
89
102
  - You can now configure the authentication middleware to throw if `requiredAppId` does not match a specific appId you provide
90
103
  - `allowedAudience` behaviour remains unchanged
@@ -99,7 +112,6 @@
99
112
  This release adds support for general authentication JWTs that are not tied to a specific app. This is a breaking change that requires updates to code that uses the JWT validation functions.
100
113
 
101
114
  #### API Changes
102
-
103
115
  - `verify` and `decode` functions now accept object parameters instead of separate parameters
104
116
  - Their return values are strongly typed based on whether `requiredAppId` is provided.
105
117
  - They throw if `requiredAppId` is provided but the jwt is either not app-specific or the app id on the token doesn't match the `requiredAppId`
@@ -107,7 +119,6 @@
107
119
  - WebAuthClient now throws an error if the `appId` it was configured with isn't in the JWT it decodes
108
120
 
109
121
  #### New Functions
110
-
111
122
  - `isGeneralJWT`: Type guard to check if a JWT is Vincent JWT that has no app associated
112
123
  - `isAppSpecificJWT`: Type guard to check if a JWT is a vincent JWT that is app-specific
113
124
  - `assertIsVincentJWT`: Assertion function to validate if a decoded JWT is a valid Vincent JWT
@@ -115,7 +126,6 @@
115
126
  - `getPKPInfo`: Convenience method that returns PKP information from any Vincent JWT's payload
116
127
 
117
128
  #### New Types
118
-
119
129
  - `VincentJWT`: Interface for a decoded Vincent JWT without app-specific details (general authentication)
120
130
  - `VincentJWTAppSpecific`: Interface for a decoded app-specific Vincent JWT
121
131
  - `BaseVincentJWTPayload`: Payload that contains always-present properties on all Vincent JWTs
@@ -124,12 +134,10 @@
124
134
  - ## JWT Refactor ([c21bc3c3](https://github.com/LIT-Protocol/Vincent/commit/c21bc3c3))
125
135
 
126
136
  #### Refactored our JWT structure, composition, and verification logic.
127
-
128
137
  - Removed dependency on `did-jwt`; since we are signing using EIP-191 compliant signatures, the presence of `did:ethr` was misleading.
129
138
  - Added support for Delegatee JWTs
130
139
 
131
140
  #### We now support 3 types of JWT:
132
-
133
141
  - `VincentJWTAppUser`
134
142
  - `role` claim in the JWT payload is `app-user`
135
143
  - Contains PKP info
@@ -148,7 +156,6 @@
148
156
  - Used to authenticate with services that require proof that they are being used by a specific delegatee who has permissions to act on behalf of a delegator (app user) account.
149
157
 
150
158
  ### API Changes
151
-
152
159
  - Many classes and interfaces were renamed to clearly indicate which type of JWT that they apply to.
153
160
  - Added `publicKey` to the `payload` of all JWTs for signature verification convenience
154
161
  - `iss` and `sub` are now raw hex-formatted ethers addresses, without `did:ethr` prefixes
@@ -189,7 +196,6 @@
189
196
  ### 🩹 Fixes
190
197
 
191
198
  - #### VincentAbilityClient Precheck fixes ([8da32df2](https://github.com/LIT-Protocol/Vincent/commit/8da32df2))
192
-
193
199
  - Fix a case where deny results from `precheck()` were not correctly bubbled to the caller
194
200
  - Fixed incorrect return type shape - `error` is a sibling of `result` in the policiesContext- Ensured `error` is bubbled up to the caller when provided
195
201
 
package/dist/CHANGELOG.md CHANGED
@@ -1,3 +1,25 @@
1
+ ## 2.1.0 (2025-09-11)
2
+
3
+ ### 🚀 Features
4
+
5
+ - Refactor the Uniswap Swap Ability to utilize a prepare step which uses a Lit Action to generate and sign a Uniswap route generated by the V3 Alpha Router. The Swap Ability now intakes the signed route, validates it was signed by the expected PKP (which can only be used to sign the generated Uniswap routes within the prepare Lit Action), then uses the provided route to create and sign the Uniswap Swap transaction with the Agent Wallet PKP. The Uniswap Swap Ability was also updated to no longer support the Spending Limit Policy, and currently doesn't support any Policies. ([8bbb1c07](https://github.com/LIT-Protocol/Vincent/commit/8bbb1c07))
6
+
7
+ ### 🧱 Updated Dependencies
8
+
9
+ - Updated ability-sdk to 2.1.0
10
+ - Updated contracts-sdk to 1.2.0
11
+
12
+ ### ❤️ Thank You
13
+
14
+ - Wyatt Barnes @spacesailor24
15
+
16
+ ## 2.0.1 (2025-09-03)
17
+
18
+ ### 🧱 Updated Dependencies
19
+
20
+ - Updated ability-sdk to 2.0.1
21
+ - Updated contracts-sdk to 1.1.0
22
+
1
23
  # 2.0.0 (2025-08-05)
2
24
 
3
25
  ### 🚀 Features
@@ -6,7 +28,6 @@
6
28
  - ### Implement supported Vincent Ability API range ([14f0ece1](https://github.com/LIT-Protocol/Vincent/commit/14f0ece1))
7
29
 
8
30
  Added basic Ability API handling to ensure abilities & policies are only used by compatible abilities and policies, and with the correct version of the vincentAbilityClient / app-sdk
9
-
10
31
  - Added a new jsParam when VincentAbilityClient calls an ability, `vincentAbilityApiVersion`
11
32
  - LIT action wrappers for abilities + policies compare `vincentAbilityApiVersion` to match the major semver range the handler was built with from the ability-sdk
12
33
  - vincentAbilityHandler() is responsible for passing along the value when it evaluates supported policies
@@ -14,7 +35,6 @@
14
35
  ### 🩹 Fixes
15
36
 
16
37
  - ### Fix ability failure response cases ([e2be50d9](https://github.com/LIT-Protocol/Vincent/commit/e2be50d9))
17
-
18
38
  - Ensures that policy denial disables checking the ability result against its fail schema in the abilityClient, because it will always be undefined :)
19
39
  - Ensures that `context` is returned in the response from the abilityClient.execute() method in cases where the ability response was a runtime or schemaValidationError
20
40
 
@@ -22,7 +42,6 @@
22
42
 
23
43
  - Add support for CBOR2 encoded policy parameters using the new vincent-contracts-sdk ([868c6c2a](https://github.com/LIT-Protocol/Vincent/commit/868c6c2a))
24
44
  - ### Add support for explicit `schemaValidationError` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
25
-
26
45
  - Previously, a failure to validate either input or results of lifecycle method would result in `result: { zodError }` being returned
27
46
  - Now, `result` will be `undefined` and there will be an explicit `schemaValidationError` in the result of the ability / policy
28
47
 
@@ -35,7 +54,6 @@
35
54
  ```
36
55
 
37
56
  - ### `error` is now `runtimeError` and can only be set by `throw ...` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
38
-
39
57
  - Previously, if you had not defined a `deny` or `fail` schema, you could call `deny()` or `fail()` with a string
40
58
  - That string would end up in the ability/policy response as the `error` property instead of `result`
41
59
  - This was problematic because there was no consistent way to identify _un-handled_ error vs. _explicitly returned fail/deny results_
@@ -63,11 +81,9 @@
63
81
  - #### Renamed `consent page` to `delegation auth page` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
64
82
  - #### Move utils exports to `@lit-protocol/vincent-app-sdk/utils` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
65
83
  - #### Moved jwt exports to `@lit-protocol/vincent-app-sdk/jwt` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
66
-
67
84
  - Enhanced typedocs for all methods and removed type aliases for core functions
68
85
 
69
86
  - #### Move `VincentWebAppClient` exports to `@lit-protocol/vincent-app-sdk/webAppClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
70
-
71
87
  - Renamed `VincentWebAppClient` to `WebAuthClient`
72
88
  - Renamed `VincentAppClientConfig` to `WebAuthClientConfig`
73
89
  - Renamed `RedirectToVincentConsentPageParams` to `RedirectToVincentDelegationPageParams`
@@ -75,16 +91,13 @@
75
91
  - Renamed `getVincentWebAppClient()` to `getWebAuthClient()`
76
92
 
77
93
  - #### Move express-authentication-middleware exports to `@lit-protocol/vincent-app-sdk/expressMiddleware` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
78
-
79
94
  - Removed `ExpressAuthHelpers` interface - its types are now directly exported from the `expressMiddleware` package sub-path
80
95
 
81
96
  - #### Moved abilityClient exports to `@lit-protocol/vincent-app-sdk/abilityClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
82
97
  - ### Update express middleware to support non-app-specific JWTs ([9dd1cd26](https://github.com/LIT-Protocol/Vincent/commit/9dd1cd26))
83
-
84
98
  - Replaced individual function exports of `authenticatedRequestHandler()` and `getAuthenticateUserExpressHandler()` with a single `createVincentUserMiddleware()` function
85
99
 
86
100
  #### createVincentUserMiddleware({ allowedAudience, userKey, requiredAppId? }) -> { middleware(), handler() }
87
-
88
101
  - You can now configure the property on `req` where the vincent user JWT data will be placed using `userKey`
89
102
  - You can now configure the authentication middleware to throw if `requiredAppId` does not match a specific appId you provide
90
103
  - `allowedAudience` behaviour remains unchanged
@@ -99,7 +112,6 @@
99
112
  This release adds support for general authentication JWTs that are not tied to a specific app. This is a breaking change that requires updates to code that uses the JWT validation functions.
100
113
 
101
114
  #### API Changes
102
-
103
115
  - `verify` and `decode` functions now accept object parameters instead of separate parameters
104
116
  - Their return values are strongly typed based on whether `requiredAppId` is provided.
105
117
  - They throw if `requiredAppId` is provided but the jwt is either not app-specific or the app id on the token doesn't match the `requiredAppId`
@@ -107,7 +119,6 @@
107
119
  - WebAuthClient now throws an error if the `appId` it was configured with isn't in the JWT it decodes
108
120
 
109
121
  #### New Functions
110
-
111
122
  - `isGeneralJWT`: Type guard to check if a JWT is Vincent JWT that has no app associated
112
123
  - `isAppSpecificJWT`: Type guard to check if a JWT is a vincent JWT that is app-specific
113
124
  - `assertIsVincentJWT`: Assertion function to validate if a decoded JWT is a valid Vincent JWT
@@ -115,7 +126,6 @@
115
126
  - `getPKPInfo`: Convenience method that returns PKP information from any Vincent JWT's payload
116
127
 
117
128
  #### New Types
118
-
119
129
  - `VincentJWT`: Interface for a decoded Vincent JWT without app-specific details (general authentication)
120
130
  - `VincentJWTAppSpecific`: Interface for a decoded app-specific Vincent JWT
121
131
  - `BaseVincentJWTPayload`: Payload that contains always-present properties on all Vincent JWTs
@@ -124,12 +134,10 @@
124
134
  - ## JWT Refactor ([c21bc3c3](https://github.com/LIT-Protocol/Vincent/commit/c21bc3c3))
125
135
 
126
136
  #### Refactored our JWT structure, composition, and verification logic.
127
-
128
137
  - Removed dependency on `did-jwt`; since we are signing using EIP-191 compliant signatures, the presence of `did:ethr` was misleading.
129
138
  - Added support for Delegatee JWTs
130
139
 
131
140
  #### We now support 3 types of JWT:
132
-
133
141
  - `VincentJWTAppUser`
134
142
  - `role` claim in the JWT payload is `app-user`
135
143
  - Contains PKP info
@@ -148,7 +156,6 @@
148
156
  - Used to authenticate with services that require proof that they are being used by a specific delegatee who has permissions to act on behalf of a delegator (app user) account.
149
157
 
150
158
  ### API Changes
151
-
152
159
  - Many classes and interfaces were renamed to clearly indicate which type of JWT that they apply to.
153
160
  - Added `publicKey` to the `payload` of all JWTs for signature verification convenience
154
161
  - `iss` and `sub` are now raw hex-formatted ethers addresses, without `did:ethr` prefixes
@@ -189,7 +196,6 @@
189
196
  ### 🩹 Fixes
190
197
 
191
198
  - #### VincentAbilityClient Precheck fixes ([8da32df2](https://github.com/LIT-Protocol/Vincent/commit/8da32df2))
192
-
193
199
  - Fix a case where deny results from `precheck()` were not correctly bubbled to the caller
194
200
  - Fixed incorrect return type shape - `error` is a sibling of `result` in the policiesContext- Ensured `error` is bubbled up to the caller when provided
195
201
 
package/dist/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lit-protocol/vincent-app-sdk",
3
- "version": "2.0.0",
3
+ "version": "2.1.0",
4
4
  "description": "Vincent SDK for browser and backend",
5
5
  "author": "Lit Protocol",
6
6
  "license": "ISC",
@@ -52,9 +52,9 @@
52
52
  "typecheck": "./scripts/precommit-check.sh"
53
53
  },
54
54
  "dependencies": {
55
- "@lit-protocol/auth-helpers": "^7.0.9",
56
- "@lit-protocol/constants": "^7.0.8",
57
- "@lit-protocol/lit-node-client": "^7.0.8",
55
+ "@lit-protocol/auth-helpers": "^7.2.3",
56
+ "@lit-protocol/constants": "^7.2.3",
57
+ "@lit-protocol/lit-node-client": "^7.2.3",
58
58
  "@lit-protocol/vincent-ability-sdk": "workspace:*",
59
59
  "@lit-protocol/vincent-contracts-sdk": "workspace:*",
60
60
  "@noble/secp256k1": "^2.2.3",
@@ -68,8 +68,8 @@
68
68
  "*.md"
69
69
  ],
70
70
  "devDependencies": {
71
- "@lit-protocol/pkp-ethers": "^7.2.0",
72
- "@lit-protocol/types": "^7.0.8",
71
+ "@lit-protocol/pkp-ethers": "^7.2.3",
72
+ "@lit-protocol/types": "^7.2.3",
73
73
  "@types/express": "^5.0.1",
74
74
  "chokidar-cli": "^3.0.0",
75
75
  "live-server": "^1.2.2",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lit-protocol/vincent-app-sdk",
3
- "version": "2.0.0",
3
+ "version": "2.1.0",
4
4
  "description": "Vincent SDK for browser and backend",
5
5
  "author": "Lit Protocol",
6
6
  "license": "ISC",
@@ -46,15 +46,15 @@
46
46
  "sdk"
47
47
  ],
48
48
  "dependencies": {
49
- "@lit-protocol/auth-helpers": "^7.0.9",
50
- "@lit-protocol/constants": "^7.0.8",
51
- "@lit-protocol/lit-node-client": "^7.0.8",
49
+ "@lit-protocol/auth-helpers": "^7.2.3",
50
+ "@lit-protocol/constants": "^7.2.3",
51
+ "@lit-protocol/lit-node-client": "^7.2.3",
52
52
  "@noble/secp256k1": "^2.2.3",
53
53
  "ethers": "5.8.0",
54
54
  "tslib": "^2.8.1",
55
55
  "zod": "3.25.64",
56
- "@lit-protocol/vincent-ability-sdk": "2.0.0",
57
- "@lit-protocol/vincent-contracts-sdk": "1.0.1"
56
+ "@lit-protocol/vincent-ability-sdk": "2.1.0",
57
+ "@lit-protocol/vincent-contracts-sdk": "1.2.0"
58
58
  },
59
59
  "sideEffects": false,
60
60
  "files": [
@@ -62,8 +62,8 @@
62
62
  "*.md"
63
63
  ],
64
64
  "devDependencies": {
65
- "@lit-protocol/pkp-ethers": "^7.2.0",
66
- "@lit-protocol/types": "^7.0.8",
65
+ "@lit-protocol/pkp-ethers": "^7.2.3",
66
+ "@lit-protocol/types": "^7.2.3",
67
67
  "@types/express": "^5.0.1",
68
68
  "chokidar-cli": "^3.0.0",
69
69
  "live-server": "^1.2.2",