@naculus/connect-appkit-core 0.13.0 → 0.15.0

package/dist/index.cjs

@@ -36,6 +36,7 @@ __export(src_exports, {
   chainNumber: () => chainNumber,
   chainsForNamespace: () => chainsForNamespace,
   channelsUpdate: () => channelsUpdate,
+  checkSessionKeyRailGrant: () => checkSessionKeyRailGrant,
   clearOneInAppNotification: () => clearOneInAppNotification,
   compareCostsKey: () => compareCostsKey,
   createDecimalsCache: () => createDecimalsCache,
@@ -769,6 +770,22 @@ function resetSharedSessionKeyManager() {
   sharedFingerprint = null;
 }
 
+// src/session-key-rail.ts
+var knownRails = /* @__PURE__ */ new Set([
+  "transfer",
+  "x402-exact",
+  "mpp-charge"
+]);
+function checkSessionKeyRailGrant(scope, rail) {
+  const rails = scope?.rails;
+  if (!Array.isArray(rails) || rails.length === 0 || new Set(rails).size !== rails.length || !Array.from(rails).every(
+    (candidate) => typeof candidate === "string" && knownRails.has(candidate)
+  ) || !rails.includes(rail)) {
+    return { status: "needs-regrant", missingRail: rail };
+  }
+  return { status: "ok", rail };
+}
+
 // src/user-op-receipt.ts
 var InvalidUserOperationReceiptError = class extends Error {
   constructor(message) {
@@ -993,8 +1010,21 @@ function createDelegationFrameworkAdapter(options) {
         execution,
         unsigned
       };
+      const hex = (value2) => `0x${value2.toString(16)}`;
       return {
         digest: codec.signingHash(unsigned),
+        // The same redemption as `unsigned`, as a request for the digest check.
+        request: {
+          type: "eip1559",
+          chainId: unsigned.chainId,
+          nonce: hex(unsigned.nonce),
+          to: unsigned.to,
+          value: hex(unsigned.value),
+          data: unsigned.data,
+          gas: hex(unsigned.gas),
+          maxFeePerGas: hex(unsigned.maxFeePerGas),
+          maxPriorityFeePerGas: hex(unsigned.maxPriorityFeePerGas)
+        },
         transaction,
         payload
       };
@@ -1011,6 +1041,7 @@ function createDelegationFrameworkAdapter(options) {
 
 // src/delegation-policy.ts
 var import_connect_core16 = require("@naculus/connect-core");
+var import_signing = require("@naculus/connect-core/signing");
 function delegatesToStatelessDeleGator(delegation) {
   return delegation.delegated === true && delegation.delegate?.toLowerCase() === import_connect_core16.DELEGATION_FRAMEWORK.eip7702StatelessDeleGator.toLowerCase();
 }
@@ -1286,16 +1317,39 @@ function createDelegationPolicyFlow(deps) {
       reason
     };
   };
-  const signVerified = (policyId, digest, tx) => manager.signWithVerifiedOffchainAuthorization(
-    policyId,
-    (authoritativePolicy) => buildDelegationPolicyMessage(authoritativePolicy, origin),
-    deps.verifySignature,
-    digest,
-    tx
-  );
+  const signVerified = (policyId, prepared) => {
+    const { request } = prepared;
+    const computed = `0x${Array.from(
+      (0, import_signing.transactionSigningHash)(request),
+      (byte) => byte.toString(16).padStart(2, "0")
+    ).join("")}`;
+    if (computed !== prepared.digest.toLowerCase()) {
+      throw new import_connect_core16.WalletError(
+        "invalid_input",
+        `The prepared digest ${prepared.digest} does not match the signing hash ${computed} of the prepared transaction request.`
+      );
+    }
+    if (!sameExecutionIntent(prepared.transaction, {
+      to: request.to,
+      value: request.value,
+      data: request.data,
+      chainId: request.chainId
+    })) {
+      throw new import_connect_core16.WalletError(
+        "invalid_input",
+        "The prepared transaction request differs from the prepared transaction checked by the policy."
+      );
+    }
+    return manager.signTransactionWithVerifiedOffchainAuthorization(
+      policyId,
+      (authoritativePolicy) => buildDelegationPolicyMessage(authoritativePolicy, origin),
+      deps.verifySignature,
+      request
+    );
+  };
   const signRedemption = (policyId, prepared) => {
     const payload = prepared.payload;
-    if (!payload?.outerTx || !payload.execution) {
+    if (!payload?.outerTx || !payload.execution || !payload.unsigned) {
       throw new import_connect_core16.WalletError(
         "invalid_input",
         "The EIP-7702 adapter did not return a redemption to sign."
@@ -1319,15 +1373,33 @@ function createDelegationPolicyFlow(deps) {
         "The EIP-7702 adapter's execution differs from the requested transaction."
       );
     }
-    return manager.signDelegationRedemption(
+    const { unsigned } = payload;
+    const hex = (value) => `0x${value.toString(16)}`;
+    const tx = {
+      type: "eip1559",
+      chainId: unsigned.chainId,
+      nonce: hex(unsigned.nonce),
+      to: unsigned.to,
+      value: hex(unsigned.value),
+      data: unsigned.data,
+      gas: hex(unsigned.gas),
+      maxFeePerGas: hex(unsigned.maxFeePerGas),
+      maxPriorityFeePerGas: hex(unsigned.maxPriorityFeePerGas)
+    };
+    return manager.signTransactionDelegationRedemption(
       policyId,
-      prepared.digest,
-      payload.outerTx,
+      tx,
+      { gas: payload.outerTx.gas },
       payload.execution
     );
   };
-  const signPolicyDigest = async (policyId, digest, tx) => {
-    const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+  const signPolicyDigest = async (policyId, prepared) => {
+    const preview = await previewPolicyExecution(
+      policyId,
+      prepared.transaction,
+      1,
+      "any"
+    );
     if (preview.policy?.scope.mode === "eip7702") {
       throw new import_connect_core16.WalletError(
         "method_not_allowed",
@@ -1337,7 +1409,7 @@ function createDelegationPolicyFlow(deps) {
     if (!preview.ready) {
       throw new import_connect_core16.WalletError("method_not_allowed", preview.reason);
     }
-    return signVerified(policyId, digest, tx);
+    return signVerified(policyId, prepared);
   };
   const executePolicy = async (policyId, tx) => {
     const adapter = deps.adapter;
@@ -1379,7 +1451,7 @@ function createDelegationPolicyFlow(deps) {
         currentCheck.reason || "The on-chain policy authorization is not ready."
       );
     }
-    const signature = preview.policy.scope.mode === "eip7702" ? await signRedemption(policyId, prepared) : await signVerified(policyId, prepared.digest, prepared.transaction);
+    const signature = preview.policy.scope.mode === "eip7702" ? await signRedemption(policyId, prepared) : await signVerified(policyId, prepared);
     const submission = await adapter.broadcast({
       policy: preview.policy,
       prepared,
@@ -1934,6 +2006,7 @@ function siwxResultToSession(result, now = /* @__PURE__ */ new Date()) {
   chainNumber,
   chainsForNamespace,
   channelsUpdate,
+  checkSessionKeyRailGrant,
   clearOneInAppNotification,
   compareCostsKey,
   createDecimalsCache,