@naculus/connect-appkit-core 0.2.5 → 0.2.6

package/dist/index.js

@@ -141,6 +141,32 @@ function writeDecimals(cache, token, value) {
   cache.value = value;
 }
 
+// src/erc20-calldata.ts
+import { isChecksumAddress } from "@naculus/connect-core";
+var UINT256_MAX = (1n << 256n) - 1n;
+var EVM_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+function addressWord(address) {
+  if (typeof address !== "string" || !EVM_ADDRESS.test(address) || address !== address.toLowerCase() && !isChecksumAddress(address)) {
+    throw new TypeError("Invalid EVM address checksum");
+  }
+  return address.slice(2).toLowerCase().padStart(64, "0");
+}
+function uint256Word(value) {
+  if (typeof value !== "bigint" || value < 0n || value > UINT256_MAX) {
+    throw new RangeError("Amount must be a uint256 bigint");
+  }
+  return value.toString(16).padStart(64, "0");
+}
+function encodeErc20Transfer(to, amount) {
+  return `0xa9059cbb${addressWord(to)}${uint256Word(amount)}`;
+}
+function encodeErc20Approve(spender, amount) {
+  return `0x095ea7b3${addressWord(spender)}${uint256Word(amount)}`;
+}
+function encodeErc20TransferFrom(from, to, amount) {
+  return `0x23b872dd${addressWord(from)}${addressWord(to)}${uint256Word(amount)}`;
+}
+
 // src/provider-errors.ts
 import { WalletError as WalletError2 } from "@naculus/connect-core";
 var USER_REJECTED = 4001;
@@ -214,6 +240,173 @@ function resolveRevertReason(data, fallbackMessage) {
   return decodeRevertReason(data) ?? (fallbackMessage.includes("revert") ? fallbackMessage : "Transaction reverted");
 }
 
+// src/simulation-endpoint.ts
+import { WalletError as WalletError3 } from "@naculus/connect-core";
+function resolveSimulationEndpoint(requestedChainId, fallbackChainId, requestedRpcUrl, fallbackRpcUrl) {
+  const chainId = requestedChainId ?? fallbackChainId;
+  if (chainId === void 0) {
+    throw new WalletError3(
+      "invalid_chain",
+      "No chain to simulate on. Connect a wallet or pass a chainId."
+    );
+  }
+  if (requestedChainId !== void 0 && fallbackChainId !== void 0 && requestedChainId !== fallbackChainId && requestedRpcUrl === void 0) {
+    throw new WalletError3(
+      "invalid_chain",
+      "Simulation chain override requires an RPC URL for that chain."
+    );
+  }
+  return { chainId, rpcUrl: requestedRpcUrl ?? fallbackRpcUrl };
+}
+function resolveContextSimulationEndpoint(requestedChainId, currentChain) {
+  const contextChainId = currentChain ? chainNumber(currentChain) ?? void 0 : void 0;
+  if (requestedChainId !== void 0 && currentChain && requestedChainId !== contextChainId) {
+    throw new WalletError3(
+      "invalid_chain",
+      "Simulation chain does not match the connected chain endpoint."
+    );
+  }
+  return resolveSimulationEndpoint(
+    requestedChainId,
+    contextChainId,
+    void 0,
+    currentChain?.rpcUrl
+  );
+}
+
+// src/transaction-simulation.ts
+import { WalletError as WalletError4 } from "@naculus/connect-core";
+var coverage = {
+  balanceChanges: false,
+  approvalChanges: false,
+  risk: false
+};
+function baseResult(status, summary, changesDetected, warnings = []) {
+  return {
+    status,
+    coverage,
+    balanceChanges: [],
+    approvalChanges: [],
+    riskAssessment: { level: "unknown", score: 0, warnings },
+    provider: "eth_call",
+    summary,
+    changesDetected
+  };
+}
+async function simulateTransactionPreview(tx, context) {
+  if (!tx)
+    return baseResult("unavailable", "No transaction to simulate", false);
+  const { chainId, rpcUrl } = resolveContextSimulationEndpoint(
+    context.chainId,
+    context.currentChain
+  );
+  const from = context.evmAccount?.includes(":") ? context.evmAccount.split(":").pop() : context.evmAccount;
+  if (context.publicClient) {
+    if (context.publicClient.chain?.id !== chainId) {
+      throw new WalletError4(
+        "invalid_chain",
+        "Simulation client chain does not match the requested chain."
+      );
+    }
+    try {
+      await context.publicClient.call({
+        to: tx.to,
+        data: tx.data ?? "0x",
+        value: tx.value ? BigInt(tx.value) : 0n,
+        ...from ? { from } : {}
+      });
+      return {
+        ...baseResult(
+          "success",
+          "Transaction simulation succeeded (basic revert check only)",
+          true
+        ),
+        gasInfo: tx.gas ? { gasLimit: BigInt(tx.gas), estimatedFeeEth: "0" } : void 0
+      };
+    } catch (cause) {
+      const error = cause;
+      const reason = resolveRevertReason(
+        error?.data ?? error?.cause?.data,
+        error?.message ?? String(cause)
+      );
+      return {
+        ...baseResult(
+          "reverted",
+          reason ? `Transaction reverted: ${reason}` : "Transaction reverted",
+          false,
+          [
+            {
+              category: "simulation_failed",
+              severity: "high",
+              message: reason ? `Transaction would revert: ${reason}` : "Transaction would revert"
+            }
+          ]
+        ),
+        revertReason: reason
+      };
+    }
+  }
+  if (!rpcUrl) {
+    return baseResult(
+      "unavailable",
+      "Simulation unavailable: no RPC URL",
+      false,
+      [
+        {
+          category: "simulation_failed",
+          severity: "low",
+          message: "No RPC URL or public client available for simulation"
+        }
+      ]
+    );
+  }
+  try {
+    const response = await (context.fetcher ?? fetch)(rpcUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: Date.now(),
+        method: "eth_call",
+        params: [
+          {
+            to: tx.to,
+            from,
+            data: tx.data ?? "0x",
+            value: tx.value ?? "0x0"
+          },
+          "latest"
+        ]
+      })
+    });
+    const json = await response.json();
+    if (json.error) {
+      return baseResult("reverted", "Transaction reverted", false, [
+        {
+          category: "simulation_failed",
+          severity: "high",
+          message: `Transaction would revert: ${json.error.message}`
+        }
+      ]);
+    }
+    return baseResult("success", "Transaction simulation succeeded", true);
+  } catch (cause) {
+    const error = cause;
+    return baseResult(
+      "unavailable",
+      "Simulation unavailable due to network error",
+      false,
+      [
+        {
+          category: "simulation_failed",
+          severity: "medium",
+          message: `Network error: ${error?.message ?? "Unknown"}`
+        }
+      ]
+    );
+  }
+}
+
 // src/name-resolver.ts
 import { NameResolver } from "@naculus/connect-core";
 var sharedResolver = null;
@@ -246,7 +439,10 @@ function createNotificationSettingsStorage() {
       try {
         return await storage.get(key);
       } catch (cause) {
-        console.warn("useNotification: failed to read from storage:", cause);
+        console.warn(
+          "notification settings: failed to read from storage:",
+          cause
+        );
         return null;
       }
     },
@@ -254,14 +450,20 @@ function createNotificationSettingsStorage() {
       try {
         await storage.set(key, value);
       } catch (cause) {
-        console.warn("useNotification: failed to write to storage:", cause);
+        console.warn(
+          "notification settings: failed to write to storage:",
+          cause
+        );
       }
     },
     removeItem: async (key) => {
       try {
         await storage.remove(key);
       } catch (cause) {
-        console.warn("useNotification: failed to remove from storage:", cause);
+        console.warn(
+          "notification settings: failed to remove from storage:",
+          cause
+        );
       }
     }
   };
@@ -392,6 +594,490 @@ function toExecuteRouteError(cause) {
   };
 }
 
+// src/session-key-manager.ts
+import {
+  DEFAULT_SESSION_KEY_CONFIG,
+  LocalStorageAdapter,
+  MemoryStorageAdapter,
+  SessionKeyManager,
+  WalletError as WalletError5
+} from "@naculus/connect-core";
+var sharedManager = null;
+var sharedFingerprint = null;
+function sessionKeyConfigFingerprint(config) {
+  if (!config) return "";
+  return JSON.stringify({
+    defaultMaxTotalValue: config.defaultMaxTotalValue?.toString(),
+    defaultMaxTxCount: config.defaultMaxTxCount,
+    defaultExpiryMs: config.defaultExpiryMs,
+    requireAllowedContracts: config.requireAllowedContracts,
+    forbiddenMethods: config.forbiddenMethods,
+    pbkdf2Iterations: config.pbkdf2Iterations,
+    unsafeAllowWeakKdf: config.unsafeAllowWeakKdf,
+    storagePrefix: config.storagePrefix,
+    encryptionKey: config.encryptionKey,
+    encryptionSalt: config.encryptionSalt
+  });
+}
+function getSharedSessionKeyManager(config) {
+  const fingerprint = sessionKeyConfigFingerprint(config);
+  if (!sharedManager) {
+    const storagePrefix = config?.storagePrefix ?? DEFAULT_SESSION_KEY_CONFIG.storagePrefix;
+    sharedManager = new SessionKeyManager(
+      config,
+      typeof window !== "undefined" ? new LocalStorageAdapter(`${storagePrefix}:`) : new MemoryStorageAdapter()
+    );
+    sharedFingerprint = fingerprint;
+    return sharedManager;
+  }
+  if (fingerprint !== "" && fingerprint !== sharedFingerprint) {
+    throw new WalletError5(
+      "invalid_input",
+      "useSessionKeys is backed by a process-wide SessionKeyManager, and a different spending configuration was supplied after it was created. The second configuration would be ignored, so the caller would be operating under limits it did not set. Use one configuration per application, or construct a SessionKeyManager directly."
+    );
+  }
+  return sharedManager;
+}
+function resetSharedSessionKeyManager() {
+  sharedManager = null;
+  sharedFingerprint = null;
+}
+
+// src/user-op-receipt.ts
+var InvalidUserOperationReceiptError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidUserOperationReceiptError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAddress(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+function isHash(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]{64}$/.test(value);
+}
+function isHexData(value) {
+  return typeof value === "string" && /^0x(?:[0-9a-fA-F]{2})*$/.test(value);
+}
+function parseQuantity(value, field) {
+  if (typeof value !== "string" || !/^(?:0x(?:0|[1-9a-fA-F][0-9a-fA-F]*)|(?:0|[1-9][0-9]*))$/.test(value)) {
+    throw new InvalidUserOperationReceiptError(
+      `Bundler returned an invalid ${field}.`
+    );
+  }
+  return BigInt(value);
+}
+function parseUserOperationReceipt(value, expectedHash) {
+  if (!isRecord(value)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler returned an invalid UserOperation receipt."
+    );
+  }
+  if (!isHash(value.userOpHash) || value.userOpHash.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt does not match the requested UserOperation hash."
+    );
+  }
+  if (!isAddress(value.entryPoint) || !isAddress(value.sender)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid account address."
+    );
+  }
+  if (value.paymaster !== void 0 && value.paymaster !== null && !isAddress(value.paymaster)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid paymaster address."
+    );
+  }
+  if (typeof value.success !== "boolean" || !isHash(value.transactionHash)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid execution result."
+    );
+  }
+  if (!Array.isArray(value.logs)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains invalid logs."
+    );
+  }
+  const logs = value.logs.map((candidate) => {
+    if (!isRecord(candidate) || !isAddress(candidate.address) || !Array.isArray(candidate.topics) || !candidate.topics.every(isHash) || !isHexData(candidate.data)) {
+      throw new InvalidUserOperationReceiptError(
+        "Bundler receipt contains an invalid log entry."
+      );
+    }
+    return {
+      address: candidate.address,
+      topics: candidate.topics,
+      data: candidate.data
+    };
+  });
+  return {
+    userOpHash: value.userOpHash,
+    entryPoint: value.entryPoint,
+    sender: value.sender,
+    nonce: parseQuantity(value.nonce, "nonce"),
+    ...value.paymaster === void 0 || value.paymaster === null ? {} : { paymaster: value.paymaster },
+    actualGasUsed: parseQuantity(value.actualGasUsed, "actualGasUsed"),
+    actualGasCost: parseQuantity(value.actualGasCost, "actualGasCost"),
+    success: value.success,
+    transactionHash: value.transactionHash,
+    logs
+  };
+}
+async function fetchUserOperationReceipt(bundlerUrl, hash, signal) {
+  const response = await fetch(bundlerUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "eth_getUserOperationReceipt",
+      params: [hash]
+    }),
+    signal
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Bundler returned HTTP ${response.status} while reading UserOperation status.`
+    );
+  }
+  const json = await response.json();
+  if (json.error) {
+    throw new Error(
+      typeof json.error.message === "string" ? json.error.message : "Bundler returned a JSON-RPC error."
+    );
+  }
+  if (json.result === void 0 || json.result === null) return null;
+  return parseUserOperationReceipt(json.result, hash);
+}
+
+// src/smart-account.ts
+import {
+  AA_SUPPORTED_CHAINS,
+  DEFAULT_ENTRY_POINT,
+  WalletError as WalletError6
+} from "@naculus/connect-core";
+function resolveUserOpChain(optionsChainId, connectedChainId) {
+  const chainId = resolveEvmChainId(optionsChainId, connectedChainId);
+  if (!chainId) {
+    throw new WalletError6(
+      "invalid_chain",
+      optionsChainId || connectedChainId ? `Invalid EVM chain ID: ${optionsChainId ?? connectedChainId}` : "No EVM chain to send on. Connect a wallet or pass options.chainId."
+    );
+  }
+  if (connectedChainId && connectedChainId !== chainId) {
+    throw new WalletError6(
+      "chain_mismatch",
+      `Connected chain ${connectedChainId} does not match UserOperation chain ${chainId}.`
+    );
+  }
+  return chainId;
+}
+function buildSmartAccountConfig(owner, chainId, options = {}) {
+  return {
+    owner,
+    accountType: options.accountType ?? "simple",
+    entryPoint: options.entryPoint ?? AA_SUPPORTED_CHAINS[chainId]?.entryPoint ?? DEFAULT_ENTRY_POINT,
+    chainId,
+    salt: options.salt
+  };
+}
+function assertHexSignature(value) {
+  if (typeof value !== "string" || !/^0x(?:[0-9a-fA-F]{2})+$/.test(value)) {
+    throw new WalletError6(
+      "signature_rejected",
+      "Wallet returned an invalid UserOperation signature."
+    );
+  }
+  return value;
+}
+
+// src/delegation-policy.ts
+import { WalletError as WalletError7 } from "@naculus/connect-core";
+function sorted(values) {
+  return values ? [...values].map((value) => value.toLowerCase()).sort() : null;
+}
+function sameExecutionIntent(requested, prepared) {
+  const sameHex = (left, right, empty) => {
+    const l = left === void 0 ? empty : left.toLowerCase();
+    const r = right === void 0 ? empty : right.toLowerCase();
+    return l === r;
+  };
+  const sameQuantity = (left, right) => {
+    try {
+      return BigInt(left ?? "0") === BigInt(right ?? "0");
+    } catch {
+      return false;
+    }
+  };
+  return sameHex(requested.to, prepared.to) && sameHex(requested.data, prepared.data, "0x") && sameQuantity(requested.value, prepared.value) && requested.chainId === prepared.chainId;
+}
+function buildDelegationPolicyMessage(policy, origin) {
+  const tokenAllowances = policy.scope.tokenAllowances ? Object.entries(policy.scope.tokenAllowances).map(
+    ([token, value]) => [token.toLowerCase(), value.toString()]
+  ).sort(([left], [right]) => left.localeCompare(right)) : null;
+  const payload = {
+    version: 1,
+    origin,
+    signer: policy.signerAddress.toLowerCase(),
+    sessionId: policy.id,
+    sessionPublicKey: policy.publicKey.toLowerCase(),
+    expiresAt: new Date(policy.expiresAt).toISOString(),
+    mode: policy.scope.mode,
+    limits: {
+      maxTotalGas: policy.scope.maxTotalGas?.toString() ?? null,
+      maxGasPerTx: policy.scope.maxGasPerTx?.toString() ?? null,
+      maxTotalValue: policy.scope.maxTotalValue?.toString() ?? null,
+      maxValuePerTx: policy.scope.maxValuePerTx?.toString() ?? null,
+      maxTxCount: policy.scope.maxTxCount ?? null
+    },
+    allowedContracts: sorted(policy.scope.allowedContracts),
+    allowedMethods: sorted(policy.scope.allowedMethods),
+    allowedChainIds: policy.scope.allowedChainIds ? [...policy.scope.allowedChainIds].sort((left, right) => left - right) : null,
+    tokenAllowances
+  };
+  return `Naculus Session Policy v1
+${JSON.stringify(payload)}`;
+}
+function isVerifiablePolicy(policy) {
+  return policy.status === "active" && Boolean(policy.authorized) && policy.scope.mode === "offchain";
+}
+function createDelegationPolicyFlow(deps) {
+  const { manager, origin } = deps;
+  const verifyStoredPolicy = async (policy) => {
+    if (!isVerifiablePolicy(policy)) return false;
+    return manager.verifyOffchainAuthorization(
+      policy.id,
+      buildDelegationPolicyMessage(policy, origin),
+      deps.verifySignature
+    );
+  };
+  const createPolicy = async (scope) => {
+    const signer = deps.signer();
+    if (!signer) {
+      throw new WalletError7("wallet_unavailable", "No active EVM account");
+    }
+    if (scope.mode && scope.mode !== "offchain") {
+      throw new WalletError7(
+        "method_not_allowed",
+        "This flow creates signed off-chain policies only. EIP-7702 and AA-module policies require a configured on-chain execution adapter."
+      );
+    }
+    if (!deps.encryptionKeyConfigured) {
+      throw new WalletError7(
+        "method_not_allowed",
+        "Persistent delegation policies require a host-provided encryptionKey. The deterministic compatibility fallback is not a production key boundary."
+      );
+    }
+    if (!deps.storageAvailable()) {
+      throw new WalletError7(
+        "storage_unavailable",
+        "Persistent delegation policy storage is unavailable in this browser"
+      );
+    }
+    let draft = null;
+    try {
+      draft = await manager.createSessionKey(
+        { ...scope, mode: "offchain" },
+        signer
+      );
+      const message = buildDelegationPolicyMessage(draft, origin);
+      const signature = await deps.signMessage(message);
+      if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) {
+        throw new WalletError7(
+          "invalid_input",
+          "Wallet did not return a valid 65-byte EVM policy signature"
+        );
+      }
+      const recovers = await deps.verifySignature({
+        message,
+        signature,
+        signerAddress: signer
+      });
+      if (!recovers) {
+        throw new WalletError7(
+          "invalid_input",
+          "Policy signature does not recover to the connected EVM account"
+        );
+      }
+      await manager.setAuthorization(draft.id, {
+        signerAddress: signer,
+        type: "offchain",
+        rawSignature: signature,
+        message
+      });
+      const authorized = (await manager.listSessions()).find(
+        (policy) => policy.id === draft?.id
+      );
+      if (!authorized?.authorized) {
+        throw new WalletError7(
+          "invalid_input",
+          "Policy authorization was not persisted"
+        );
+      }
+      if (!await verifyStoredPolicy(authorized)) {
+        throw new WalletError7(
+          "invalid_input",
+          "Persisted policy signature did not verify against its stored scope and origin"
+        );
+      }
+      await deps.refresh();
+      return authorized;
+    } catch (cause) {
+      if (draft) {
+        try {
+          await manager.revokeSession(draft.id);
+        } catch {
+        }
+      }
+      throw cause instanceof Error ? cause : new Error("Policy creation failed");
+    }
+  };
+  const revokePolicy = async (policyId) => {
+    await manager.revokeSession(policyId);
+    await deps.refresh();
+  };
+  const previewPolicyExecution = async (policyId, tx, callCount = 1, atomicity = "preferred") => {
+    const policy = (await manager.listSessions()).find((item) => item.id === policyId) ?? null;
+    const scope = await manager.checkSessionScope(policyId, tx);
+    const plan = deps.previewExecution(callCount, atomicity);
+    const signer = deps.signer();
+    const authorizationVerified = policy ? await verifyStoredPolicy(policy) : false;
+    const signerMatches = Boolean(
+      policy && signer && policy.signerAddress.toLowerCase() === signer.toLowerCase()
+    );
+    const adapter = deps.adapter;
+    let adapterCheck = null;
+    if (policy && adapter && authorizationVerified && signerMatches && scope.valid) {
+      try {
+        adapterCheck = await adapter.check({ policy, transaction: tx });
+      } catch (cause) {
+        adapterCheck = {
+          ready: false,
+          authorizationInstalled: false,
+          sponsored: false,
+          promptless: false,
+          reason: cause instanceof Error ? `Execution adapter check failed: ${cause.message}` : "Execution adapter check failed."
+        };
+      }
+    }
+    const delegation = deps.delegation();
+    const delegationMatches = Boolean(
+      adapter?.route !== "eip7702" || delegation.delegated === true && adapterCheck?.executorAddress && delegation.delegate?.toLowerCase() === adapterCheck.executorAddress.toLowerCase()
+    );
+    const policyReady = Boolean(
+      policy?.status === "active" && policy.authorized && authorizationVerified && policy.scope.mode === "offchain" && signerMatches && scope.valid
+    );
+    const adapterSponsorshipReady = Boolean(
+      deps.sponsorship !== "required" || adapterCheck?.sponsored
+    );
+    const broadcastReady = Boolean(
+      policyReady && callCount === 1 && adapterCheck?.ready && adapterCheck.authorizationInstalled && adapterCheck.promptless && adapterSponsorshipReady && delegationMatches
+    );
+    const ready = Boolean(policyReady && (plan.route || broadcastReady));
+    const reason = !policy ? "Policy not found." : policy.status !== "active" ? `Policy is ${policy.status}.` : !policy.authorized ? "The main wallet has not signed this policy." : !authorizationVerified ? "The persisted policy signature no longer matches its scope, signer, or origin." : !signerMatches ? "The connected account is not the policy signer." : !scope.valid ? scope.reason ?? "The transaction is outside the policy scope." : broadcastReady ? `The configured ${adapter?.route ?? "AA/7702"} adapter can submit this policy-authorized operation without another main-wallet prompt.${adapterCheck?.sponsored ? " Gas sponsorship is guaranteed." : ""} ${adapterCheck?.reason ?? "The on-chain execution adapter is ready."}` : !adapter ? `${plan.reason} The signed off-chain policy permits this request; an AA/7702 adapter is still required to broadcast without another wallet prompt.` : !adapterCheck?.ready || !adapterCheck.authorizationInstalled ? `${plan.reason} ${adapterCheck?.reason ?? "The execution adapter is not ready."}` : !adapterCheck.promptless ? `${plan.reason} The configured adapter would invoke the main wallet again, so promptless broadcast is not ready.` : !adapterSponsorshipReady ? `${plan.reason} Sponsored gas is required, but the configured adapter does not guarantee sponsorship.` : callCount !== 1 ? `${plan.reason} This policy adapter prepares one execution at a time and cannot claim a multi-call broadcast.` : !delegationMatches ? `${plan.reason} The configured EIP-7702 executor does not match the account's on-chain delegation.` : !plan.route ? plan.reason : `${plan.reason} ${adapterCheck.reason}`;
+    return {
+      policy,
+      scope,
+      execution: plan,
+      signerMatches,
+      authorizationVerified,
+      ready,
+      broadcastReady,
+      broadcastRoute: broadcastReady ? adapter?.route ?? null : null,
+      onchainAuthorizationVerified: Boolean(
+        adapterCheck?.authorizationInstalled && delegationMatches
+      ),
+      broadcastSponsored: broadcastReady ? adapterCheck?.sponsored ?? false : null,
+      broadcastPromptless: Boolean(broadcastReady && adapterCheck?.promptless),
+      reason
+    };
+  };
+  const signVerified = (policyId, digest, tx) => manager.signWithVerifiedOffchainAuthorization(
+    policyId,
+    (authoritativePolicy) => buildDelegationPolicyMessage(authoritativePolicy, origin),
+    deps.verifySignature,
+    digest,
+    tx
+  );
+  const signPolicyDigest = async (policyId, digest, tx) => {
+    const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+    if (!preview.ready) {
+      throw new WalletError7("method_not_allowed", preview.reason);
+    }
+    return signVerified(policyId, digest, tx);
+  };
+  const executePolicy = async (policyId, tx) => {
+    const adapter = deps.adapter;
+    if (!adapter) {
+      throw new WalletError7(
+        "method_not_allowed",
+        "No session-policy-aware AA/7702 execution adapter is configured."
+      );
+    }
+    const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+    if (!preview.broadcastReady || !preview.policy) {
+      throw new WalletError7("method_not_allowed", preview.reason);
+    }
+    const prepared = await adapter.prepare({
+      policy: preview.policy,
+      transaction: tx
+    });
+    if (!/^0x[0-9a-fA-F]{64}$/.test(prepared.digest)) {
+      throw new WalletError7(
+        "invalid_input",
+        "Execution adapter returned a digest that is not 32 bytes."
+      );
+    }
+    if (!sameExecutionIntent(tx, prepared.transaction)) {
+      throw new WalletError7(
+        "invalid_input",
+        "Execution adapter changed the requested target, value, data, or chain."
+      );
+    }
+    const currentCheck = await adapter.check({
+      policy: preview.policy,
+      transaction: prepared.transaction
+    });
+    const delegation = deps.delegation();
+    const currentDelegationMatches = adapter.route !== "eip7702" || delegation.delegated === true && currentCheck.executorAddress !== void 0 && delegation.delegate?.toLowerCase() === currentCheck.executorAddress.toLowerCase();
+    if (!currentCheck.ready || !currentCheck.authorizationInstalled || !currentCheck.promptless || deps.sponsorship === "required" && !currentCheck.sponsored || !currentDelegationMatches) {
+      throw new WalletError7(
+        "method_not_allowed",
+        currentCheck.reason || "The on-chain policy authorization is not ready."
+      );
+    }
+    const signature = await signVerified(
+      policyId,
+      prepared.digest,
+      prepared.transaction
+    );
+    const submission = await adapter.broadcast({
+      policy: preview.policy,
+      prepared,
+      signature
+    });
+    if (submission.route !== adapter.route || submission.status !== "submitted" || !/^0x[0-9a-fA-F]{64}$/.test(submission.hash)) {
+      throw new WalletError7(
+        "invalid_input",
+        "Execution adapter returned an invalid submission result."
+      );
+    }
+    await deps.refresh();
+    return submission;
+  };
+  return {
+    verifyStoredPolicy,
+    createPolicy,
+    revokePolicy,
+    previewPolicyExecution,
+    signPolicyDigest,
+    executePolicy
+  };
+}
+
 // src/web3-store.ts
 import { logger } from "@naculus/connect-core";
 function withTimeout(promise, ms, label = "Operation") {
@@ -480,13 +1166,57 @@ function web3Reducer(state, action) {
       return state;
   }
 }
+
+// src/siwx-policy.ts
+function defaultSiwxDomain(location) {
+  return location?.host ?? "localhost";
+}
+function defaultSiwxUri(location) {
+  return location?.origin ?? "http://localhost";
+}
+function isSiwxExpired(result, now) {
+  const value = result.message.expirationTime;
+  if (!value) return false;
+  const timestamp = new Date(value).getTime();
+  return !Number.isFinite(timestamp) || timestamp <= now.getTime();
+}
+function isSiwxNotBeforeValid(result, now) {
+  const value = result.message.notBefore;
+  if (!value) return true;
+  const timestamp = new Date(value).getTime();
+  return Number.isFinite(timestamp) && timestamp <= now.getTime();
+}
+function randomSuffix() {
+  const bytes = new Uint8Array(8);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
+}
+function siwxResultToSession(result, now = /* @__PURE__ */ new Date()) {
+  return {
+    id: `siwx_${now.getTime().toString(36)}_${randomSuffix()}`,
+    chainId: result.message.chainId,
+    address: result.message.address,
+    domain: result.message.domain,
+    message: result.message,
+    signature: result.signature,
+    issuedAt: result.message.issuedAt ?? now.toISOString(),
+    expiresAt: result.message.expirationTime ?? null,
+    refreshedAt: null
+  };
+}
 export {
   DEFAULT_NOTIFICATION_SETTINGS,
+  InvalidUserOperationReceiptError,
   NOTIFICATION_SETTINGS_KEY,
   __resetResolverForTests,
   addInAppNotification,
+  assertHexSignature,
   atomicSupportFor,
   bareEvmAddress,
+  buildDelegationPolicyMessage,
+  buildSmartAccountConfig,
   chainNamespace,
   chainNumber,
   chainsForNamespace,
@@ -494,28 +1224,48 @@ export {
   clearOneInAppNotification,
   compareCostsKey,
   createDecimalsCache,
+  createDelegationPolicyFlow,
   createNotification,
   createNotificationSettingsStorage,
   decodeRevertReason,
+  defaultSiwxDomain,
+  defaultSiwxUri,
   describeChain,
   eip155ChainIdToNumber,
+  encodeErc20Approve,
+  encodeErc20Transfer,
+  encodeErc20TransferFrom,
+  fetchUserOperationReceipt,
   getResolver,
+  getSharedSessionKeyManager,
   initialWeb3State,
   isBurnDestination,
   isEvmChainId,
   isPositiveIntegerAmount,
   isQuotableInput,
+  isSiwxExpired,
+  isSiwxNotBeforeValid,
+  isVerifiablePolicy,
   loadNotificationSettings,
   mutedChainSettings,
   normalizeCapabilities,
   normalizeEip155ChainId,
+  parseUserOperationReceipt,
   readDecimals,
   readSolanaRoles,
+  resetSharedSessionKeyManager,
   resolveChain,
+  resolveContextSimulationEndpoint,
   resolveEvmChainId,
   resolveRevertReason,
+  resolveSimulationEndpoint,
+  resolveUserOpChain,
+  sameExecutionIntent,
   saveNotificationSettings,
   selectChainCapabilities,
+  sessionKeyConfigFingerprint,
+  simulateTransactionPreview,
+  siwxResultToSession,
   toChainSwitchError,
   toEip155Accounts,
   toExecuteRouteError,