@lit-protocol/vincent-app-sdk 2.0.1 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +15 -16
  2. package/dist/CHANGELOG.md +15 -16
  3. package/dist/package.json +1 -1
  4. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,3 +1,18 @@
1
+ ## 2.1.0 (2025-09-11)
2
+
3
+ ### 🚀 Features
4
+
5
+ - Refactor the Uniswap Swap Ability to utilize a prepare step which uses a Lit Action to generate and sign a Uniswap route generated by the V3 Alpha Router. The Swap Ability now intakes the signed route, validates it was signed by the expected PKP (which can only be used to sign the generated Uniswap routes within the prepare Lit Action), then uses the provided route to create and sign the Uniswap Swap transaction with the Agent Wallet PKP. The Uniswap Swap Ability was also updated to no longer support the Spending Limit Policy, and currently doesn't support any Policies. ([8bbb1c07](https://github.com/LIT-Protocol/Vincent/commit/8bbb1c07))
6
+
7
+ ### 🧱 Updated Dependencies
8
+
9
+ - Updated ability-sdk to 2.1.0
10
+ - Updated contracts-sdk to 1.2.0
11
+
12
+ ### ❤️ Thank You
13
+
14
+ - Wyatt Barnes @spacesailor24
15
+
1
16
  ## 2.0.1 (2025-09-03)
2
17
 
3
18
  ### 🧱 Updated Dependencies
@@ -13,7 +28,6 @@
13
28
  - ### Implement supported Vincent Ability API range ([14f0ece1](https://github.com/LIT-Protocol/Vincent/commit/14f0ece1))
14
29
 
15
30
  Added basic Ability API handling to ensure abilities & policies are only used by compatible abilities and policies, and with the correct version of the vincentAbilityClient / app-sdk
16
-
17
31
  - Added a new jsParam when VincentAbilityClient calls an ability, `vincentAbilityApiVersion`
18
32
  - LIT action wrappers for abilities + policies compare `vincentAbilityApiVersion` to match the major semver range the handler was built with from the ability-sdk
19
33
  - vincentAbilityHandler() is responsible for passing along the value when it evaluates supported policies
@@ -21,7 +35,6 @@
21
35
  ### 🩹 Fixes
22
36
 
23
37
  - ### Fix ability failure response cases ([e2be50d9](https://github.com/LIT-Protocol/Vincent/commit/e2be50d9))
24
-
25
38
  - Ensures that policy denial disables checking the ability result against its fail schema in the abilityClient, because it will always be undefined :)
26
39
  - Ensures that `context` is returned in the response from the abilityClient.execute() method in cases where the ability response was a runtime or schemaValidationError
27
40
 
@@ -29,7 +42,6 @@
29
42
 
30
43
  - Add support for CBOR2 encoded policy parameters using the new vincent-contracts-sdk ([868c6c2a](https://github.com/LIT-Protocol/Vincent/commit/868c6c2a))
31
44
  - ### Add support for explicit `schemaValidationError` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
32
-
33
45
  - Previously, a failure to validate either input or results of lifecycle method would result in `result: { zodError }` being returned
34
46
  - Now, `result` will be `undefined` and there will be an explicit `schemaValidationError` in the result of the ability / policy
35
47
 
@@ -42,7 +54,6 @@
42
54
  ```
43
55
 
44
56
  - ### `error` is now `runtimeError` and can only be set by `throw ...` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
45
-
46
57
  - Previously, if you had not defined a `deny` or `fail` schema, you could call `deny()` or `fail()` with a string
47
58
  - That string would end up in the ability/policy response as the `error` property instead of `result`
48
59
  - This was problematic because there was no consistent way to identify _un-handled_ error vs. _explicitly returned fail/deny results_
@@ -70,11 +81,9 @@
70
81
  - #### Renamed `consent page` to `delegation auth page` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
71
82
  - #### Move utils exports to `@lit-protocol/vincent-app-sdk/utils` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
72
83
  - #### Moved jwt exports to `@lit-protocol/vincent-app-sdk/jwt` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
73
-
74
84
  - Enhanced typedocs for all methods and removed type aliases for core functions
75
85
 
76
86
  - #### Move `VincentWebAppClient` exports to `@lit-protocol/vincent-app-sdk/webAppClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
77
-
78
87
  - Renamed `VincentWebAppClient` to `WebAuthClient`
79
88
  - Renamed `VincentAppClientConfig` to `WebAuthClientConfig`
80
89
  - Renamed `RedirectToVincentConsentPageParams` to `RedirectToVincentDelegationPageParams`
@@ -82,16 +91,13 @@
82
91
  - Renamed `getVincentWebAppClient()` to `getWebAuthClient()`
83
92
 
84
93
  - #### Move express-authentication-middleware exports to `@lit-protocol/vincent-app-sdk/expressMiddleware` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
85
-
86
94
  - Removed `ExpressAuthHelpers` interface - its types are now directly exported from the `expressMiddleware` package sub-path
87
95
 
88
96
  - #### Moved abilityClient exports to `@lit-protocol/vincent-app-sdk/abilityClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
89
97
  - ### Update express middleware to support non-app-specific JWTs ([9dd1cd26](https://github.com/LIT-Protocol/Vincent/commit/9dd1cd26))
90
-
91
98
  - Replaced individual function exports of `authenticatedRequestHandler()` and `getAuthenticateUserExpressHandler()` with a single `createVincentUserMiddleware()` function
92
99
 
93
100
  #### createVincentUserMiddleware({ allowedAudience, userKey, requiredAppId? }) -> { middleware(), handler() }
94
-
95
101
  - You can now configure the property on `req` where the vincent user JWT data will be placed using `userKey`
96
102
  - You can now configure the authentication middleware to throw if `requiredAppId` does not match a specific appId you provide
97
103
  - `allowedAudience` behaviour remains unchanged
@@ -106,7 +112,6 @@
106
112
  This release adds support for general authentication JWTs that are not tied to a specific app. This is a breaking change that requires updates to code that uses the JWT validation functions.
107
113
 
108
114
  #### API Changes
109
-
110
115
  - `verify` and `decode` functions now accept object parameters instead of separate parameters
111
116
  - Their return values are strongly typed based on whether `requiredAppId` is provided.
112
117
  - They throw if `requiredAppId` is provided but the jwt is either not app-specific or the app id on the token doesn't match the `requiredAppId`
@@ -114,7 +119,6 @@
114
119
  - WebAuthClient now throws an error if the `appId` it was configured with isn't in the JWT it decodes
115
120
 
116
121
  #### New Functions
117
-
118
122
  - `isGeneralJWT`: Type guard to check if a JWT is Vincent JWT that has no app associated
119
123
  - `isAppSpecificJWT`: Type guard to check if a JWT is a vincent JWT that is app-specific
120
124
  - `assertIsVincentJWT`: Assertion function to validate if a decoded JWT is a valid Vincent JWT
@@ -122,7 +126,6 @@
122
126
  - `getPKPInfo`: Convenience method that returns PKP information from any Vincent JWT's payload
123
127
 
124
128
  #### New Types
125
-
126
129
  - `VincentJWT`: Interface for a decoded Vincent JWT without app-specific details (general authentication)
127
130
  - `VincentJWTAppSpecific`: Interface for a decoded app-specific Vincent JWT
128
131
  - `BaseVincentJWTPayload`: Payload that contains always-present properties on all Vincent JWTs
@@ -131,12 +134,10 @@
131
134
  - ## JWT Refactor ([c21bc3c3](https://github.com/LIT-Protocol/Vincent/commit/c21bc3c3))
132
135
 
133
136
  #### Refactored our JWT structure, composition, and verification logic.
134
-
135
137
  - Removed dependency on `did-jwt`; since we are signing using EIP-191 compliant signatures, the presence of `did:ethr` was misleading.
136
138
  - Added support for Delegatee JWTs
137
139
 
138
140
  #### We now support 3 types of JWT:
139
-
140
141
  - `VincentJWTAppUser`
141
142
  - `role` claim in the JWT payload is `app-user`
142
143
  - Contains PKP info
@@ -155,7 +156,6 @@
155
156
  - Used to authenticate with services that require proof that they are being used by a specific delegatee who has permissions to act on behalf of a delegator (app user) account.
156
157
 
157
158
  ### API Changes
158
-
159
159
  - Many classes and interfaces were renamed to clearly indicate which type of JWT that they apply to.
160
160
  - Added `publicKey` to the `payload` of all JWTs for signature verification convenience
161
161
  - `iss` and `sub` are now raw hex-formatted ethers addresses, without `did:ethr` prefixes
@@ -196,7 +196,6 @@
196
196
  ### 🩹 Fixes
197
197
 
198
198
  - #### VincentAbilityClient Precheck fixes ([8da32df2](https://github.com/LIT-Protocol/Vincent/commit/8da32df2))
199
-
200
199
  - Fix a case where deny results from `precheck()` were not correctly bubbled to the caller
201
200
  - Fixed incorrect return type shape - `error` is a sibling of `result` in the policiesContext- Ensured `error` is bubbled up to the caller when provided
202
201
 
package/dist/CHANGELOG.md CHANGED
@@ -1,3 +1,18 @@
1
+ ## 2.1.0 (2025-09-11)
2
+
3
+ ### 🚀 Features
4
+
5
+ - Refactor the Uniswap Swap Ability to utilize a prepare step which uses a Lit Action to generate and sign a Uniswap route generated by the V3 Alpha Router. The Swap Ability now intakes the signed route, validates it was signed by the expected PKP (which can only be used to sign the generated Uniswap routes within the prepare Lit Action), then uses the provided route to create and sign the Uniswap Swap transaction with the Agent Wallet PKP. The Uniswap Swap Ability was also updated to no longer support the Spending Limit Policy, and currently doesn't support any Policies. ([8bbb1c07](https://github.com/LIT-Protocol/Vincent/commit/8bbb1c07))
6
+
7
+ ### 🧱 Updated Dependencies
8
+
9
+ - Updated ability-sdk to 2.1.0
10
+ - Updated contracts-sdk to 1.2.0
11
+
12
+ ### ❤️ Thank You
13
+
14
+ - Wyatt Barnes @spacesailor24
15
+
1
16
  ## 2.0.1 (2025-09-03)
2
17
 
3
18
  ### 🧱 Updated Dependencies
@@ -13,7 +28,6 @@
13
28
  - ### Implement supported Vincent Ability API range ([14f0ece1](https://github.com/LIT-Protocol/Vincent/commit/14f0ece1))
14
29
 
15
30
  Added basic Ability API handling to ensure abilities & policies are only used by compatible abilities and policies, and with the correct version of the vincentAbilityClient / app-sdk
16
-
17
31
  - Added a new jsParam when VincentAbilityClient calls an ability, `vincentAbilityApiVersion`
18
32
  - LIT action wrappers for abilities + policies compare `vincentAbilityApiVersion` to match the major semver range the handler was built with from the ability-sdk
19
33
  - vincentAbilityHandler() is responsible for passing along the value when it evaluates supported policies
@@ -21,7 +35,6 @@
21
35
  ### 🩹 Fixes
22
36
 
23
37
  - ### Fix ability failure response cases ([e2be50d9](https://github.com/LIT-Protocol/Vincent/commit/e2be50d9))
24
-
25
38
  - Ensures that policy denial disables checking the ability result against its fail schema in the abilityClient, because it will always be undefined :)
26
39
  - Ensures that `context` is returned in the response from the abilityClient.execute() method in cases where the ability response was a runtime or schemaValidationError
27
40
 
@@ -29,7 +42,6 @@
29
42
 
30
43
  - Add support for CBOR2 encoded policy parameters using the new vincent-contracts-sdk ([868c6c2a](https://github.com/LIT-Protocol/Vincent/commit/868c6c2a))
31
44
  - ### Add support for explicit `schemaValidationError` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
32
-
33
45
  - Previously, a failure to validate either input or results of lifecycle method would result in `result: { zodError }` being returned
34
46
  - Now, `result` will be `undefined` and there will be an explicit `schemaValidationError` in the result of the ability / policy
35
47
 
@@ -42,7 +54,6 @@
42
54
  ```
43
55
 
44
56
  - ### `error` is now `runtimeError` and can only be set by `throw ...` ([337a4bde](https://github.com/LIT-Protocol/Vincent/commit/337a4bde))
45
-
46
57
  - Previously, if you had not defined a `deny` or `fail` schema, you could call `deny()` or `fail()` with a string
47
58
  - That string would end up in the ability/policy response as the `error` property instead of `result`
48
59
  - This was problematic because there was no consistent way to identify _un-handled_ error vs. _explicitly returned fail/deny results_
@@ -70,11 +81,9 @@
70
81
  - #### Renamed `consent page` to `delegation auth page` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
71
82
  - #### Move utils exports to `@lit-protocol/vincent-app-sdk/utils` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
72
83
  - #### Moved jwt exports to `@lit-protocol/vincent-app-sdk/jwt` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
73
-
74
84
  - Enhanced typedocs for all methods and removed type aliases for core functions
75
85
 
76
86
  - #### Move `VincentWebAppClient` exports to `@lit-protocol/vincent-app-sdk/webAppClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
77
-
78
87
  - Renamed `VincentWebAppClient` to `WebAuthClient`
79
88
  - Renamed `VincentAppClientConfig` to `WebAuthClientConfig`
80
89
  - Renamed `RedirectToVincentConsentPageParams` to `RedirectToVincentDelegationPageParams`
@@ -82,16 +91,13 @@
82
91
  - Renamed `getVincentWebAppClient()` to `getWebAuthClient()`
83
92
 
84
93
  - #### Move express-authentication-middleware exports to `@lit-protocol/vincent-app-sdk/expressMiddleware` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
85
-
86
94
  - Removed `ExpressAuthHelpers` interface - its types are now directly exported from the `expressMiddleware` package sub-path
87
95
 
88
96
  - #### Moved abilityClient exports to `@lit-protocol/vincent-app-sdk/abilityClient` ([b94ca569](https://github.com/LIT-Protocol/Vincent/commit/b94ca569))
89
97
  - ### Update express middleware to support non-app-specific JWTs ([9dd1cd26](https://github.com/LIT-Protocol/Vincent/commit/9dd1cd26))
90
-
91
98
  - Replaced individual function exports of `authenticatedRequestHandler()` and `getAuthenticateUserExpressHandler()` with a single `createVincentUserMiddleware()` function
92
99
 
93
100
  #### createVincentUserMiddleware({ allowedAudience, userKey, requiredAppId? }) -> { middleware(), handler() }
94
-
95
101
  - You can now configure the property on `req` where the vincent user JWT data will be placed using `userKey`
96
102
  - You can now configure the authentication middleware to throw if `requiredAppId` does not match a specific appId you provide
97
103
  - `allowedAudience` behaviour remains unchanged
@@ -106,7 +112,6 @@
106
112
  This release adds support for general authentication JWTs that are not tied to a specific app. This is a breaking change that requires updates to code that uses the JWT validation functions.
107
113
 
108
114
  #### API Changes
109
-
110
115
  - `verify` and `decode` functions now accept object parameters instead of separate parameters
111
116
  - Their return values are strongly typed based on whether `requiredAppId` is provided.
112
117
  - They throw if `requiredAppId` is provided but the jwt is either not app-specific or the app id on the token doesn't match the `requiredAppId`
@@ -114,7 +119,6 @@
114
119
  - WebAuthClient now throws an error if the `appId` it was configured with isn't in the JWT it decodes
115
120
 
116
121
  #### New Functions
117
-
118
122
  - `isGeneralJWT`: Type guard to check if a JWT is Vincent JWT that has no app associated
119
123
  - `isAppSpecificJWT`: Type guard to check if a JWT is a vincent JWT that is app-specific
120
124
  - `assertIsVincentJWT`: Assertion function to validate if a decoded JWT is a valid Vincent JWT
@@ -122,7 +126,6 @@
122
126
  - `getPKPInfo`: Convenience method that returns PKP information from any Vincent JWT's payload
123
127
 
124
128
  #### New Types
125
-
126
129
  - `VincentJWT`: Interface for a decoded Vincent JWT without app-specific details (general authentication)
127
130
  - `VincentJWTAppSpecific`: Interface for a decoded app-specific Vincent JWT
128
131
  - `BaseVincentJWTPayload`: Payload that contains always-present properties on all Vincent JWTs
@@ -131,12 +134,10 @@
131
134
  - ## JWT Refactor ([c21bc3c3](https://github.com/LIT-Protocol/Vincent/commit/c21bc3c3))
132
135
 
133
136
  #### Refactored our JWT structure, composition, and verification logic.
134
-
135
137
  - Removed dependency on `did-jwt`; since we are signing using EIP-191 compliant signatures, the presence of `did:ethr` was misleading.
136
138
  - Added support for Delegatee JWTs
137
139
 
138
140
  #### We now support 3 types of JWT:
139
-
140
141
  - `VincentJWTAppUser`
141
142
  - `role` claim in the JWT payload is `app-user`
142
143
  - Contains PKP info
@@ -155,7 +156,6 @@
155
156
  - Used to authenticate with services that require proof that they are being used by a specific delegatee who has permissions to act on behalf of a delegator (app user) account.
156
157
 
157
158
  ### API Changes
158
-
159
159
  - Many classes and interfaces were renamed to clearly indicate which type of JWT that they apply to.
160
160
  - Added `publicKey` to the `payload` of all JWTs for signature verification convenience
161
161
  - `iss` and `sub` are now raw hex-formatted ethers addresses, without `did:ethr` prefixes
@@ -196,7 +196,6 @@
196
196
  ### 🩹 Fixes
197
197
 
198
198
  - #### VincentAbilityClient Precheck fixes ([8da32df2](https://github.com/LIT-Protocol/Vincent/commit/8da32df2))
199
-
200
199
  - Fix a case where deny results from `precheck()` were not correctly bubbled to the caller
201
200
  - Fixed incorrect return type shape - `error` is a sibling of `result` in the policiesContext- Ensured `error` is bubbled up to the caller when provided
202
201
 
package/dist/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lit-protocol/vincent-app-sdk",
3
- "version": "2.0.1",
3
+ "version": "2.1.0",
4
4
  "description": "Vincent SDK for browser and backend",
5
5
  "author": "Lit Protocol",
6
6
  "license": "ISC",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lit-protocol/vincent-app-sdk",
3
- "version": "2.0.1",
3
+ "version": "2.1.0",
4
4
  "description": "Vincent SDK for browser and backend",
5
5
  "author": "Lit Protocol",
6
6
  "license": "ISC",
@@ -53,8 +53,8 @@
53
53
  "ethers": "5.8.0",
54
54
  "tslib": "^2.8.1",
55
55
  "zod": "3.25.64",
56
- "@lit-protocol/vincent-ability-sdk": "2.0.1",
57
- "@lit-protocol/vincent-contracts-sdk": "1.1.0"
56
+ "@lit-protocol/vincent-ability-sdk": "2.1.0",
57
+ "@lit-protocol/vincent-contracts-sdk": "1.2.0"
58
58
  },
59
59
  "sideEffects": false,
60
60
  "files": [