@naculus/connect-appkit-core 0.2.5 → 0.2.7

package/dist/index.cjs

@@ -21,11 +21,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   DEFAULT_NOTIFICATION_SETTINGS: () => DEFAULT_NOTIFICATION_SETTINGS,
+  InvalidUserOperationReceiptError: () => InvalidUserOperationReceiptError,
   NOTIFICATION_SETTINGS_KEY: () => NOTIFICATION_SETTINGS_KEY,
   __resetResolverForTests: () => __resetResolverForTests,
   addInAppNotification: () => addInAppNotification,
+  assertHexSignature: () => assertHexSignature,
   atomicSupportFor: () => atomicSupportFor,
   bareEvmAddress: () => bareEvmAddress,
+  buildDelegationPolicyMessage: () => buildDelegationPolicyMessage,
+  buildSmartAccountConfig: () => buildSmartAccountConfig,
   chainNamespace: () => chainNamespace,
   chainNumber: () => chainNumber,
   chainsForNamespace: () => chainsForNamespace,
@@ -33,28 +37,48 @@ __export(src_exports, {
   clearOneInAppNotification: () => clearOneInAppNotification,
   compareCostsKey: () => compareCostsKey,
   createDecimalsCache: () => createDecimalsCache,
+  createDelegationPolicyFlow: () => createDelegationPolicyFlow,
   createNotification: () => createNotification,
   createNotificationSettingsStorage: () => createNotificationSettingsStorage,
   decodeRevertReason: () => decodeRevertReason,
+  defaultSiwxDomain: () => defaultSiwxDomain,
+  defaultSiwxUri: () => defaultSiwxUri,
   describeChain: () => describeChain,
   eip155ChainIdToNumber: () => eip155ChainIdToNumber,
+  encodeErc20Approve: () => encodeErc20Approve,
+  encodeErc20Transfer: () => encodeErc20Transfer,
+  encodeErc20TransferFrom: () => encodeErc20TransferFrom,
+  fetchUserOperationReceipt: () => fetchUserOperationReceipt,
   getResolver: () => getResolver,
+  getSharedSessionKeyManager: () => getSharedSessionKeyManager,
   initialWeb3State: () => initialWeb3State,
   isBurnDestination: () => isBurnDestination,
   isEvmChainId: () => isEvmChainId,
   isPositiveIntegerAmount: () => isPositiveIntegerAmount,
   isQuotableInput: () => isQuotableInput,
+  isSiwxExpired: () => isSiwxExpired,
+  isSiwxNotBeforeValid: () => isSiwxNotBeforeValid,
+  isVerifiablePolicy: () => isVerifiablePolicy,
   loadNotificationSettings: () => loadNotificationSettings,
   mutedChainSettings: () => mutedChainSettings,
   normalizeCapabilities: () => normalizeCapabilities,
   normalizeEip155ChainId: () => normalizeEip155ChainId,
+  parseUserOperationReceipt: () => parseUserOperationReceipt,
   readDecimals: () => readDecimals,
   readSolanaRoles: () => readSolanaRoles,
+  resetSharedSessionKeyManager: () => resetSharedSessionKeyManager,
   resolveChain: () => resolveChain,
+  resolveContextSimulationEndpoint: () => resolveContextSimulationEndpoint,
   resolveEvmChainId: () => resolveEvmChainId,
   resolveRevertReason: () => resolveRevertReason,
+  resolveSimulationEndpoint: () => resolveSimulationEndpoint,
+  resolveUserOpChain: () => resolveUserOpChain,
+  sameExecutionIntent: () => sameExecutionIntent,
   saveNotificationSettings: () => saveNotificationSettings,
   selectChainCapabilities: () => selectChainCapabilities,
+  sessionKeyConfigFingerprint: () => sessionKeyConfigFingerprint,
+  simulateTransactionPreview: () => simulateTransactionPreview,
+  siwxResultToSession: () => siwxResultToSession,
   toChainSwitchError: () => toChainSwitchError,
   toEip155Accounts: () => toEip155Accounts,
   toExecuteRouteError: () => toExecuteRouteError,
@@ -211,8 +235,34 @@ function writeDecimals(cache, token, value) {
   cache.value = value;
 }
 
-// src/provider-errors.ts
+// src/erc20-calldata.ts
 var import_connect_core5 = require("@naculus/connect-core");
+var UINT256_MAX = (1n << 256n) - 1n;
+var EVM_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+function addressWord(address) {
+  if (typeof address !== "string" || !EVM_ADDRESS.test(address) || address !== address.toLowerCase() && !(0, import_connect_core5.isChecksumAddress)(address)) {
+    throw new TypeError("Invalid EVM address checksum");
+  }
+  return address.slice(2).toLowerCase().padStart(64, "0");
+}
+function uint256Word(value) {
+  if (typeof value !== "bigint" || value < 0n || value > UINT256_MAX) {
+    throw new RangeError("Amount must be a uint256 bigint");
+  }
+  return value.toString(16).padStart(64, "0");
+}
+function encodeErc20Transfer(to, amount) {
+  return `0xa9059cbb${addressWord(to)}${uint256Word(amount)}`;
+}
+function encodeErc20Approve(spender, amount) {
+  return `0x095ea7b3${addressWord(spender)}${uint256Word(amount)}`;
+}
+function encodeErc20TransferFrom(from, to, amount) {
+  return `0x23b872dd${addressWord(from)}${addressWord(to)}${uint256Word(amount)}`;
+}
+
+// src/provider-errors.ts
+var import_connect_core6 = require("@naculus/connect-core");
 var USER_REJECTED = 4001;
 var UNRECOGNIZED_CHAIN = 4902;
 function providerCode(error) {
@@ -224,19 +274,19 @@ function providerCode(error) {
   return nested ? providerCode(nested) : void 0;
 }
 function toChainSwitchError(error, fallback = "chain_unsupported") {
-  if (error instanceof import_connect_core5.WalletError) return error;
+  if (error instanceof import_connect_core6.WalletError) return error;
   const message = error instanceof Error ? error.message : "Unknown error during chain switch";
   switch (providerCode(error)) {
     case USER_REJECTED:
-      return new import_connect_core5.WalletError("chain_switch_rejected", message, error);
+      return new import_connect_core6.WalletError("chain_switch_rejected", message, error);
     case UNRECOGNIZED_CHAIN:
-      return new import_connect_core5.WalletError(
+      return new import_connect_core6.WalletError(
         "chain_unsupported",
         `${message} (the wallet does not have this chain configured)`,
         error
       );
     default:
-      return new import_connect_core5.WalletError(fallback, message, error);
+      return new import_connect_core6.WalletError(fallback, message, error);
   }
 }
 
@@ -284,12 +334,179 @@ function resolveRevertReason(data, fallbackMessage) {
   return decodeRevertReason(data) ?? (fallbackMessage.includes("revert") ? fallbackMessage : "Transaction reverted");
 }
 
+// src/simulation-endpoint.ts
+var import_connect_core7 = require("@naculus/connect-core");
+function resolveSimulationEndpoint(requestedChainId, fallbackChainId, requestedRpcUrl, fallbackRpcUrl) {
+  const chainId = requestedChainId ?? fallbackChainId;
+  if (chainId === void 0) {
+    throw new import_connect_core7.WalletError(
+      "invalid_chain",
+      "No chain to simulate on. Connect a wallet or pass a chainId."
+    );
+  }
+  if (requestedChainId !== void 0 && fallbackChainId !== void 0 && requestedChainId !== fallbackChainId && requestedRpcUrl === void 0) {
+    throw new import_connect_core7.WalletError(
+      "invalid_chain",
+      "Simulation chain override requires an RPC URL for that chain."
+    );
+  }
+  return { chainId, rpcUrl: requestedRpcUrl ?? fallbackRpcUrl };
+}
+function resolveContextSimulationEndpoint(requestedChainId, currentChain) {
+  const contextChainId = currentChain ? chainNumber(currentChain) ?? void 0 : void 0;
+  if (requestedChainId !== void 0 && currentChain && requestedChainId !== contextChainId) {
+    throw new import_connect_core7.WalletError(
+      "invalid_chain",
+      "Simulation chain does not match the connected chain endpoint."
+    );
+  }
+  return resolveSimulationEndpoint(
+    requestedChainId,
+    contextChainId,
+    void 0,
+    currentChain?.rpcUrl
+  );
+}
+
+// src/transaction-simulation.ts
+var import_connect_core8 = require("@naculus/connect-core");
+var coverage = {
+  balanceChanges: false,
+  approvalChanges: false,
+  risk: false
+};
+function baseResult(status, summary, changesDetected, warnings = []) {
+  return {
+    status,
+    coverage,
+    balanceChanges: [],
+    approvalChanges: [],
+    riskAssessment: { level: "unknown", score: 0, warnings },
+    provider: "eth_call",
+    summary,
+    changesDetected
+  };
+}
+async function simulateTransactionPreview(tx, context) {
+  if (!tx)
+    return baseResult("unavailable", "No transaction to simulate", false);
+  const { chainId, rpcUrl } = resolveContextSimulationEndpoint(
+    context.chainId,
+    context.currentChain
+  );
+  const from = context.evmAccount?.includes(":") ? context.evmAccount.split(":").pop() : context.evmAccount;
+  if (context.publicClient) {
+    if (context.publicClient.chain?.id !== chainId) {
+      throw new import_connect_core8.WalletError(
+        "invalid_chain",
+        "Simulation client chain does not match the requested chain."
+      );
+    }
+    try {
+      await context.publicClient.call({
+        to: tx.to,
+        data: tx.data ?? "0x",
+        value: tx.value ? BigInt(tx.value) : 0n,
+        ...from ? { from } : {}
+      });
+      return {
+        ...baseResult(
+          "success",
+          "Transaction simulation succeeded (basic revert check only)",
+          true
+        ),
+        gasInfo: tx.gas ? { gasLimit: BigInt(tx.gas), estimatedFeeEth: "0" } : void 0
+      };
+    } catch (cause) {
+      const error = cause;
+      const reason = resolveRevertReason(
+        error?.data ?? error?.cause?.data,
+        error?.message ?? String(cause)
+      );
+      return {
+        ...baseResult(
+          "reverted",
+          reason ? `Transaction reverted: ${reason}` : "Transaction reverted",
+          false,
+          [
+            {
+              category: "simulation_failed",
+              severity: "high",
+              message: reason ? `Transaction would revert: ${reason}` : "Transaction would revert"
+            }
+          ]
+        ),
+        revertReason: reason
+      };
+    }
+  }
+  if (!rpcUrl) {
+    return baseResult(
+      "unavailable",
+      "Simulation unavailable: no RPC URL",
+      false,
+      [
+        {
+          category: "simulation_failed",
+          severity: "low",
+          message: "No RPC URL or public client available for simulation"
+        }
+      ]
+    );
+  }
+  try {
+    const response = await (context.fetcher ?? fetch)(rpcUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: Date.now(),
+        method: "eth_call",
+        params: [
+          {
+            to: tx.to,
+            from,
+            data: tx.data ?? "0x",
+            value: tx.value ?? "0x0"
+          },
+          "latest"
+        ]
+      })
+    });
+    const json = await response.json();
+    if (json.error) {
+      return baseResult("reverted", "Transaction reverted", false, [
+        {
+          category: "simulation_failed",
+          severity: "high",
+          message: `Transaction would revert: ${json.error.message}`
+        }
+      ]);
+    }
+    return baseResult("success", "Transaction simulation succeeded", true);
+  } catch (cause) {
+    const error = cause;
+    return baseResult(
+      "unavailable",
+      "Simulation unavailable due to network error",
+      false,
+      [
+        {
+          category: "simulation_failed",
+          severity: "medium",
+          message: `Network error: ${error?.message ?? "Unknown"}`
+        }
+      ]
+    );
+  }
+}
+
 // src/name-resolver.ts
-var import_connect_core6 = require("@naculus/connect-core");
+var import_connect_core9 = require("@naculus/connect-core");
 var sharedResolver = null;
 function getResolver(config) {
-  if (config) return new import_connect_core6.NameResolver(config);
-  if (!sharedResolver) sharedResolver = new import_connect_core6.NameResolver();
+  if (config) return new import_connect_core9.NameResolver(config);
+  if (!sharedResolver) sharedResolver = new import_connect_core9.NameResolver();
   return sharedResolver;
 }
 function __resetResolverForTests() {
@@ -297,7 +514,7 @@ function __resetResolverForTests() {
 }
 
 // src/notification.ts
-var import_connect_core7 = require("@naculus/connect-core");
+var import_connect_core10 = require("@naculus/connect-core");
 var NOTIFICATION_SETTINGS_KEY = "naculus_notif_react_settings";
 var DEFAULT_NOTIFICATION_SETTINGS = {
   telegram: false,
@@ -308,13 +525,16 @@ var DEFAULT_NOTIFICATION_SETTINGS = {
   mutedTypes: []
 };
 function createNotificationSettingsStorage() {
-  const storage = (0, import_connect_core7.createStorageAdapter)("local", "naculus_notif_");
+  const storage = (0, import_connect_core10.createStorageAdapter)("local", "naculus_notif_");
   return {
     getItem: async (key) => {
       try {
         return await storage.get(key);
       } catch (cause) {
-        console.warn("useNotification: failed to read from storage:", cause);
+        console.warn(
+          "notification settings: failed to read from storage:",
+          cause
+        );
         return null;
       }
     },
@@ -322,14 +542,20 @@ function createNotificationSettingsStorage() {
       try {
         await storage.set(key, value);
       } catch (cause) {
-        console.warn("useNotification: failed to write to storage:", cause);
+        console.warn(
+          "notification settings: failed to write to storage:",
+          cause
+        );
       }
     },
     removeItem: async (key) => {
       try {
         await storage.remove(key);
       } catch (cause) {
-        console.warn("useNotification: failed to remove from storage:", cause);
+        console.warn(
+          "notification settings: failed to remove from storage:",
+          cause
+        );
       }
     }
   };
@@ -389,21 +615,16 @@ async function clearOneInAppNotification(channel, id) {
 }
 
 // src/destination.ts
-var import_connect_core8 = require("@naculus/connect-core");
-var DEAD_ADDRESSES = /* @__PURE__ */ new Set([
-  "0x0000000000000000000000000000000000000001",
-  "0x000000000000000000000000000000000000dead"
-]);
+var import_connect_core11 = require("@naculus/connect-core");
 function isBurnDestination(address) {
-  const lower = address.toLowerCase();
-  return DEAD_ADDRESSES.has(lower) || lower.includes("dead");
+  return (0, import_connect_core11.isBurnAddress)(address);
 }
 function validateDestination(address) {
   if (!address) return { isValid: false, level: "blocked", issue: "empty" };
-  if (!(0, import_connect_core8.isEvmAddress)(address)) {
+  if (!(0, import_connect_core11.isEvmAddress)(address)) {
     return { isValid: false, level: "blocked", issue: "invalid_format" };
   }
-  if ((0, import_connect_core8.isZeroAddress)(address)) {
+  if ((0, import_connect_core11.isZeroAddress)(address)) {
     return { isValid: false, level: "blocked", issue: "zero_address" };
   }
   if (isBurnDestination(address)) {
@@ -414,11 +635,11 @@ function validateDestination(address) {
 function bareEvmAddress(account) {
   if (!account) return null;
   const value = account.includes(":") ? account.split(":").pop() : account;
-  return value && (0, import_connect_core8.isEvmAddress)(value) ? value : null;
+  return value && (0, import_connect_core11.isEvmAddress)(value) ? value : null;
 }
 
 // src/routing.ts
-var import_connect_core9 = require("@naculus/connect-core");
+var import_connect_core12 = require("@naculus/connect-core");
 function isPositiveIntegerAmount(amount) {
   return /^(?:0|[1-9][0-9]*)$/.test(amount) && BigInt(amount) > 0n;
 }
@@ -443,7 +664,7 @@ function validateRouteRecipient(quote, recipient) {
     };
   }
   const namespace = quote?.toChain?.split(":")[0];
-  if (namespace && !(0, import_connect_core9.isValidAddress)(recipient, namespace)) {
+  if (namespace && !(0, import_connect_core12.isValidAddress)(recipient, namespace)) {
     return {
       code: "invalid_recipient",
       message: `"${recipient}" is not a valid ${namespace} address for the destination chain ${quote?.toChain}`
@@ -460,8 +681,482 @@ function toExecuteRouteError(cause) {
   };
 }
 
+// src/session-key-manager.ts
+var import_connect_core13 = require("@naculus/connect-core");
+var sharedManager = null;
+var sharedFingerprint = null;
+function sessionKeyConfigFingerprint(config) {
+  if (!config) return "";
+  return JSON.stringify({
+    defaultMaxTotalValue: config.defaultMaxTotalValue?.toString(),
+    defaultMaxTxCount: config.defaultMaxTxCount,
+    defaultExpiryMs: config.defaultExpiryMs,
+    requireAllowedContracts: config.requireAllowedContracts,
+    forbiddenMethods: config.forbiddenMethods,
+    pbkdf2Iterations: config.pbkdf2Iterations,
+    unsafeAllowWeakKdf: config.unsafeAllowWeakKdf,
+    storagePrefix: config.storagePrefix,
+    encryptionKey: config.encryptionKey,
+    encryptionSalt: config.encryptionSalt
+  });
+}
+function getSharedSessionKeyManager(config) {
+  const fingerprint = sessionKeyConfigFingerprint(config);
+  if (!sharedManager) {
+    const storagePrefix = config?.storagePrefix ?? import_connect_core13.DEFAULT_SESSION_KEY_CONFIG.storagePrefix;
+    sharedManager = new import_connect_core13.SessionKeyManager(
+      config,
+      typeof window !== "undefined" ? new import_connect_core13.LocalStorageAdapter(`${storagePrefix}:`) : new import_connect_core13.MemoryStorageAdapter()
+    );
+    sharedFingerprint = fingerprint;
+    return sharedManager;
+  }
+  if (fingerprint !== "" && fingerprint !== sharedFingerprint) {
+    throw new import_connect_core13.WalletError(
+      "invalid_input",
+      "useSessionKeys is backed by a process-wide SessionKeyManager, and a different spending configuration was supplied after it was created. The second configuration would be ignored, so the caller would be operating under limits it did not set. Use one configuration per application, or construct a SessionKeyManager directly."
+    );
+  }
+  return sharedManager;
+}
+function resetSharedSessionKeyManager() {
+  sharedManager = null;
+  sharedFingerprint = null;
+}
+
+// src/user-op-receipt.ts
+var InvalidUserOperationReceiptError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidUserOperationReceiptError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAddress(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+function isHash(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]{64}$/.test(value);
+}
+function isHexData(value) {
+  return typeof value === "string" && /^0x(?:[0-9a-fA-F]{2})*$/.test(value);
+}
+function parseQuantity(value, field) {
+  if (typeof value !== "string" || !/^(?:0x(?:0|[1-9a-fA-F][0-9a-fA-F]*)|(?:0|[1-9][0-9]*))$/.test(value)) {
+    throw new InvalidUserOperationReceiptError(
+      `Bundler returned an invalid ${field}.`
+    );
+  }
+  return BigInt(value);
+}
+function parseUserOperationReceipt(value, expectedHash) {
+  if (!isRecord(value)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler returned an invalid UserOperation receipt."
+    );
+  }
+  if (!isHash(value.userOpHash) || value.userOpHash.toLowerCase() !== expectedHash.toLowerCase()) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt does not match the requested UserOperation hash."
+    );
+  }
+  if (!isAddress(value.entryPoint) || !isAddress(value.sender)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid account address."
+    );
+  }
+  if (value.paymaster !== void 0 && value.paymaster !== null && !isAddress(value.paymaster)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid paymaster address."
+    );
+  }
+  if (typeof value.success !== "boolean" || !isHash(value.transactionHash)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains an invalid execution result."
+    );
+  }
+  if (!Array.isArray(value.logs)) {
+    throw new InvalidUserOperationReceiptError(
+      "Bundler receipt contains invalid logs."
+    );
+  }
+  const logs = value.logs.map((candidate) => {
+    if (!isRecord(candidate) || !isAddress(candidate.address) || !Array.isArray(candidate.topics) || !candidate.topics.every(isHash) || !isHexData(candidate.data)) {
+      throw new InvalidUserOperationReceiptError(
+        "Bundler receipt contains an invalid log entry."
+      );
+    }
+    return {
+      address: candidate.address,
+      topics: candidate.topics,
+      data: candidate.data
+    };
+  });
+  return {
+    userOpHash: value.userOpHash,
+    entryPoint: value.entryPoint,
+    sender: value.sender,
+    nonce: parseQuantity(value.nonce, "nonce"),
+    ...value.paymaster === void 0 || value.paymaster === null ? {} : { paymaster: value.paymaster },
+    actualGasUsed: parseQuantity(value.actualGasUsed, "actualGasUsed"),
+    actualGasCost: parseQuantity(value.actualGasCost, "actualGasCost"),
+    success: value.success,
+    transactionHash: value.transactionHash,
+    logs
+  };
+}
+async function fetchUserOperationReceipt(bundlerUrl, hash, signal) {
+  const response = await fetch(bundlerUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "eth_getUserOperationReceipt",
+      params: [hash]
+    }),
+    signal
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Bundler returned HTTP ${response.status} while reading UserOperation status.`
+    );
+  }
+  const json = await response.json();
+  if (json.error) {
+    throw new Error(
+      typeof json.error.message === "string" ? json.error.message : "Bundler returned a JSON-RPC error."
+    );
+  }
+  if (json.result === void 0 || json.result === null) return null;
+  return parseUserOperationReceipt(json.result, hash);
+}
+
+// src/smart-account.ts
+var import_connect_core14 = require("@naculus/connect-core");
+function resolveUserOpChain(optionsChainId, connectedChainId) {
+  const chainId = resolveEvmChainId(optionsChainId, connectedChainId);
+  if (!chainId) {
+    throw new import_connect_core14.WalletError(
+      "invalid_chain",
+      optionsChainId || connectedChainId ? `Invalid EVM chain ID: ${optionsChainId ?? connectedChainId}` : "No EVM chain to send on. Connect a wallet or pass options.chainId."
+    );
+  }
+  if (connectedChainId && connectedChainId !== chainId) {
+    throw new import_connect_core14.WalletError(
+      "chain_mismatch",
+      `Connected chain ${connectedChainId} does not match UserOperation chain ${chainId}.`
+    );
+  }
+  return chainId;
+}
+function buildSmartAccountConfig(owner, chainId, options = {}) {
+  return {
+    owner,
+    accountType: options.accountType ?? "simple",
+    entryPoint: options.entryPoint ?? import_connect_core14.AA_SUPPORTED_CHAINS[chainId]?.entryPoint ?? import_connect_core14.DEFAULT_ENTRY_POINT,
+    chainId,
+    salt: options.salt
+  };
+}
+function assertHexSignature(value) {
+  if (typeof value !== "string" || !/^0x(?:[0-9a-fA-F]{2})+$/.test(value)) {
+    throw new import_connect_core14.WalletError(
+      "signature_rejected",
+      "Wallet returned an invalid UserOperation signature."
+    );
+  }
+  return value;
+}
+
+// src/delegation-policy.ts
+var import_connect_core15 = require("@naculus/connect-core");
+function sorted(values) {
+  return values ? [...values].map((value) => value.toLowerCase()).sort() : null;
+}
+function sameExecutionIntent(requested, prepared) {
+  const sameHex = (left, right, empty) => {
+    const l = left === void 0 ? empty : left.toLowerCase();
+    const r = right === void 0 ? empty : right.toLowerCase();
+    return l === r;
+  };
+  const sameQuantity = (left, right) => {
+    try {
+      return BigInt(left ?? "0") === BigInt(right ?? "0");
+    } catch {
+      return false;
+    }
+  };
+  return sameHex(requested.to, prepared.to) && sameHex(requested.data, prepared.data, "0x") && sameQuantity(requested.value, prepared.value) && requested.chainId === prepared.chainId;
+}
+function buildDelegationPolicyMessage(policy, origin) {
+  const tokenAllowances = policy.scope.tokenAllowances ? Object.entries(policy.scope.tokenAllowances).map(
+    ([token, value]) => [token.toLowerCase(), value.toString()]
+  ).sort(([left], [right]) => left.localeCompare(right)) : null;
+  const payload = {
+    version: 1,
+    origin,
+    signer: policy.signerAddress.toLowerCase(),
+    sessionId: policy.id,
+    sessionPublicKey: policy.publicKey.toLowerCase(),
+    expiresAt: new Date(policy.expiresAt).toISOString(),
+    mode: policy.scope.mode,
+    limits: {
+      maxTotalGas: policy.scope.maxTotalGas?.toString() ?? null,
+      maxGasPerTx: policy.scope.maxGasPerTx?.toString() ?? null,
+      maxTotalValue: policy.scope.maxTotalValue?.toString() ?? null,
+      maxValuePerTx: policy.scope.maxValuePerTx?.toString() ?? null,
+      maxTxCount: policy.scope.maxTxCount ?? null
+    },
+    allowedContracts: sorted(policy.scope.allowedContracts),
+    allowedMethods: sorted(policy.scope.allowedMethods),
+    allowedChainIds: policy.scope.allowedChainIds ? [...policy.scope.allowedChainIds].sort((left, right) => left - right) : null,
+    tokenAllowances
+  };
+  return `Naculus Session Policy v1
+${JSON.stringify(payload)}`;
+}
+function isVerifiablePolicy(policy) {
+  return policy.status === "active" && Boolean(policy.authorized) && policy.scope.mode === "offchain";
+}
+function createDelegationPolicyFlow(deps) {
+  const { manager, origin } = deps;
+  const verifyStoredPolicy = async (policy) => {
+    if (!isVerifiablePolicy(policy)) return false;
+    return manager.verifyOffchainAuthorization(
+      policy.id,
+      buildDelegationPolicyMessage(policy, origin),
+      deps.verifySignature
+    );
+  };
+  const createPolicy = async (scope) => {
+    const signer = deps.signer();
+    if (!signer) {
+      throw new import_connect_core15.WalletError("wallet_unavailable", "No active EVM account");
+    }
+    if (scope.mode && scope.mode !== "offchain") {
+      throw new import_connect_core15.WalletError(
+        "method_not_allowed",
+        "This flow creates signed off-chain policies only. EIP-7702 and AA-module policies require a configured on-chain execution adapter."
+      );
+    }
+    if (!deps.encryptionKeyConfigured) {
+      throw new import_connect_core15.WalletError(
+        "method_not_allowed",
+        "Persistent delegation policies require a host-provided encryptionKey. The deterministic compatibility fallback is not a production key boundary."
+      );
+    }
+    if (!deps.storageAvailable()) {
+      throw new import_connect_core15.WalletError(
+        "storage_unavailable",
+        "Persistent delegation policy storage is unavailable in this browser"
+      );
+    }
+    let draft = null;
+    try {
+      draft = await manager.createSessionKey(
+        { ...scope, mode: "offchain" },
+        signer
+      );
+      const message = buildDelegationPolicyMessage(draft, origin);
+      const signature = await deps.signMessage(message);
+      if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) {
+        throw new import_connect_core15.WalletError(
+          "invalid_input",
+          "Wallet did not return a valid 65-byte EVM policy signature"
+        );
+      }
+      const recovers = await deps.verifySignature({
+        message,
+        signature,
+        signerAddress: signer
+      });
+      if (!recovers) {
+        throw new import_connect_core15.WalletError(
+          "invalid_input",
+          "Policy signature does not recover to the connected EVM account"
+        );
+      }
+      await manager.setAuthorization(draft.id, {
+        signerAddress: signer,
+        type: "offchain",
+        rawSignature: signature,
+        message
+      });
+      const authorized = (await manager.listSessions()).find(
+        (policy) => policy.id === draft?.id
+      );
+      if (!authorized?.authorized) {
+        throw new import_connect_core15.WalletError(
+          "invalid_input",
+          "Policy authorization was not persisted"
+        );
+      }
+      if (!await verifyStoredPolicy(authorized)) {
+        throw new import_connect_core15.WalletError(
+          "invalid_input",
+          "Persisted policy signature did not verify against its stored scope and origin"
+        );
+      }
+      await deps.refresh();
+      return authorized;
+    } catch (cause) {
+      if (draft) {
+        try {
+          await manager.revokeSession(draft.id);
+        } catch {
+        }
+      }
+      throw cause instanceof Error ? cause : new Error("Policy creation failed");
+    }
+  };
+  const revokePolicy = async (policyId) => {
+    await manager.revokeSession(policyId);
+    await deps.refresh();
+  };
+  const previewPolicyExecution = async (policyId, tx, callCount = 1, atomicity = "preferred") => {
+    const policy = (await manager.listSessions()).find((item) => item.id === policyId) ?? null;
+    const scope = await manager.checkSessionScope(policyId, tx);
+    const plan = deps.previewExecution(callCount, atomicity);
+    const signer = deps.signer();
+    const authorizationVerified = policy ? await verifyStoredPolicy(policy) : false;
+    const signerMatches = Boolean(
+      policy && signer && policy.signerAddress.toLowerCase() === signer.toLowerCase()
+    );
+    const adapter = deps.adapter;
+    let adapterCheck = null;
+    if (policy && adapter && authorizationVerified && signerMatches && scope.valid) {
+      try {
+        adapterCheck = await adapter.check({ policy, transaction: tx });
+      } catch (cause) {
+        adapterCheck = {
+          ready: false,
+          authorizationInstalled: false,
+          sponsored: false,
+          promptless: false,
+          reason: cause instanceof Error ? `Execution adapter check failed: ${cause.message}` : "Execution adapter check failed."
+        };
+      }
+    }
+    const delegation = deps.delegation();
+    const delegationMatches = Boolean(
+      adapter?.route !== "eip7702" || delegation.delegated === true && adapterCheck?.executorAddress && delegation.delegate?.toLowerCase() === adapterCheck.executorAddress.toLowerCase()
+    );
+    const policyReady = Boolean(
+      policy?.status === "active" && policy.authorized && authorizationVerified && policy.scope.mode === "offchain" && signerMatches && scope.valid
+    );
+    const adapterSponsorshipReady = Boolean(
+      deps.sponsorship !== "required" || adapterCheck?.sponsored
+    );
+    const broadcastReady = Boolean(
+      policyReady && callCount === 1 && adapterCheck?.ready && adapterCheck.authorizationInstalled && adapterCheck.promptless && adapterSponsorshipReady && delegationMatches
+    );
+    const ready = Boolean(policyReady && (plan.route || broadcastReady));
+    const reason = !policy ? "Policy not found." : policy.status !== "active" ? `Policy is ${policy.status}.` : !policy.authorized ? "The main wallet has not signed this policy." : !authorizationVerified ? "The persisted policy signature no longer matches its scope, signer, or origin." : !signerMatches ? "The connected account is not the policy signer." : !scope.valid ? scope.reason ?? "The transaction is outside the policy scope." : broadcastReady ? `The configured ${adapter?.route ?? "AA/7702"} adapter can submit this policy-authorized operation without another main-wallet prompt.${adapterCheck?.sponsored ? " Gas sponsorship is guaranteed." : ""} ${adapterCheck?.reason ?? "The on-chain execution adapter is ready."}` : !adapter ? `${plan.reason} The signed off-chain policy permits this request; an AA/7702 adapter is still required to broadcast without another wallet prompt.` : !adapterCheck?.ready || !adapterCheck.authorizationInstalled ? `${plan.reason} ${adapterCheck?.reason ?? "The execution adapter is not ready."}` : !adapterCheck.promptless ? `${plan.reason} The configured adapter would invoke the main wallet again, so promptless broadcast is not ready.` : !adapterSponsorshipReady ? `${plan.reason} Sponsored gas is required, but the configured adapter does not guarantee sponsorship.` : callCount !== 1 ? `${plan.reason} This policy adapter prepares one execution at a time and cannot claim a multi-call broadcast.` : !delegationMatches ? `${plan.reason} The configured EIP-7702 executor does not match the account's on-chain delegation.` : !plan.route ? plan.reason : `${plan.reason} ${adapterCheck.reason}`;
+    return {
+      policy,
+      scope,
+      execution: plan,
+      signerMatches,
+      authorizationVerified,
+      ready,
+      broadcastReady,
+      broadcastRoute: broadcastReady ? adapter?.route ?? null : null,
+      onchainAuthorizationVerified: Boolean(
+        adapterCheck?.authorizationInstalled && delegationMatches
+      ),
+      broadcastSponsored: broadcastReady ? adapterCheck?.sponsored ?? false : null,
+      broadcastPromptless: Boolean(broadcastReady && adapterCheck?.promptless),
+      reason
+    };
+  };
+  const signVerified = (policyId, digest, tx) => manager.signWithVerifiedOffchainAuthorization(
+    policyId,
+    (authoritativePolicy) => buildDelegationPolicyMessage(authoritativePolicy, origin),
+    deps.verifySignature,
+    digest,
+    tx
+  );
+  const signPolicyDigest = async (policyId, digest, tx) => {
+    const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+    if (!preview.ready) {
+      throw new import_connect_core15.WalletError("method_not_allowed", preview.reason);
+    }
+    return signVerified(policyId, digest, tx);
+  };
+  const executePolicy = async (policyId, tx) => {
+    const adapter = deps.adapter;
+    if (!adapter) {
+      throw new import_connect_core15.WalletError(
+        "method_not_allowed",
+        "No session-policy-aware AA/7702 execution adapter is configured."
+      );
+    }
+    const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+    if (!preview.broadcastReady || !preview.policy) {
+      throw new import_connect_core15.WalletError("method_not_allowed", preview.reason);
+    }
+    const prepared = await adapter.prepare({
+      policy: preview.policy,
+      transaction: tx
+    });
+    if (!/^0x[0-9a-fA-F]{64}$/.test(prepared.digest)) {
+      throw new import_connect_core15.WalletError(
+        "invalid_input",
+        "Execution adapter returned a digest that is not 32 bytes."
+      );
+    }
+    if (!sameExecutionIntent(tx, prepared.transaction)) {
+      throw new import_connect_core15.WalletError(
+        "invalid_input",
+        "Execution adapter changed the requested target, value, data, or chain."
+      );
+    }
+    const currentCheck = await adapter.check({
+      policy: preview.policy,
+      transaction: prepared.transaction
+    });
+    const delegation = deps.delegation();
+    const currentDelegationMatches = adapter.route !== "eip7702" || delegation.delegated === true && currentCheck.executorAddress !== void 0 && delegation.delegate?.toLowerCase() === currentCheck.executorAddress.toLowerCase();
+    if (!currentCheck.ready || !currentCheck.authorizationInstalled || !currentCheck.promptless || deps.sponsorship === "required" && !currentCheck.sponsored || !currentDelegationMatches) {
+      throw new import_connect_core15.WalletError(
+        "method_not_allowed",
+        currentCheck.reason || "The on-chain policy authorization is not ready."
+      );
+    }
+    const signature = await signVerified(
+      policyId,
+      prepared.digest,
+      prepared.transaction
+    );
+    const submission = await adapter.broadcast({
+      policy: preview.policy,
+      prepared,
+      signature
+    });
+    if (submission.route !== adapter.route || submission.status !== "submitted" || !/^0x[0-9a-fA-F]{64}$/.test(submission.hash)) {
+      throw new import_connect_core15.WalletError(
+        "invalid_input",
+        "Execution adapter returned an invalid submission result."
+      );
+    }
+    await deps.refresh();
+    return submission;
+  };
+  return {
+    verifyStoredPolicy,
+    createPolicy,
+    revokePolicy,
+    previewPolicyExecution,
+    signPolicyDigest,
+    executePolicy
+  };
+}
+
 // src/web3-store.ts
-var import_connect_core10 = require("@naculus/connect-core");
+var import_connect_core16 = require("@naculus/connect-core");
 function withTimeout(promise, ms, label = "Operation") {
   let timeoutId;
   const timeout = new Promise((_, reject) => {
@@ -483,7 +1178,7 @@ async function withRetry(fn, options) {
       lastError = error;
       if (attempt < options.maxRetries) {
         const delay = options.baseDelay * 2 ** attempt;
-        import_connect_core10.logger.warn(
+        import_connect_core16.logger.warn(
           "appkit/core",
           `Retry attempt ${attempt + 1}/${options.maxRetries} after ${delay}ms`
         );
@@ -548,14 +1243,58 @@ function web3Reducer(state, action) {
       return state;
   }
 }
+
+// src/siwx-policy.ts
+function defaultSiwxDomain(location) {
+  return location?.host ?? "localhost";
+}
+function defaultSiwxUri(location) {
+  return location?.origin ?? "http://localhost";
+}
+function isSiwxExpired(result, now) {
+  const value = result.message.expirationTime;
+  if (!value) return false;
+  const timestamp = new Date(value).getTime();
+  return !Number.isFinite(timestamp) || timestamp <= now.getTime();
+}
+function isSiwxNotBeforeValid(result, now) {
+  const value = result.message.notBefore;
+  if (!value) return true;
+  const timestamp = new Date(value).getTime();
+  return Number.isFinite(timestamp) && timestamp <= now.getTime();
+}
+function randomSuffix() {
+  const bytes = new Uint8Array(8);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
+}
+function siwxResultToSession(result, now = /* @__PURE__ */ new Date()) {
+  return {
+    id: `siwx_${now.getTime().toString(36)}_${randomSuffix()}`,
+    chainId: result.message.chainId,
+    address: result.message.address,
+    domain: result.message.domain,
+    message: result.message,
+    signature: result.signature,
+    issuedAt: result.message.issuedAt ?? now.toISOString(),
+    expiresAt: result.message.expirationTime ?? null,
+    refreshedAt: null
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_NOTIFICATION_SETTINGS,
+  InvalidUserOperationReceiptError,
   NOTIFICATION_SETTINGS_KEY,
   __resetResolverForTests,
   addInAppNotification,
+  assertHexSignature,
   atomicSupportFor,
   bareEvmAddress,
+  buildDelegationPolicyMessage,
+  buildSmartAccountConfig,
   chainNamespace,
   chainNumber,
   chainsForNamespace,
@@ -563,28 +1302,48 @@ function web3Reducer(state, action) {
   clearOneInAppNotification,
   compareCostsKey,
   createDecimalsCache,
+  createDelegationPolicyFlow,
   createNotification,
   createNotificationSettingsStorage,
   decodeRevertReason,
+  defaultSiwxDomain,
+  defaultSiwxUri,
   describeChain,
   eip155ChainIdToNumber,
+  encodeErc20Approve,
+  encodeErc20Transfer,
+  encodeErc20TransferFrom,
+  fetchUserOperationReceipt,
   getResolver,
+  getSharedSessionKeyManager,
   initialWeb3State,
   isBurnDestination,
   isEvmChainId,
   isPositiveIntegerAmount,
   isQuotableInput,
+  isSiwxExpired,
+  isSiwxNotBeforeValid,
+  isVerifiablePolicy,
   loadNotificationSettings,
   mutedChainSettings,
   normalizeCapabilities,
   normalizeEip155ChainId,
+  parseUserOperationReceipt,
   readDecimals,
   readSolanaRoles,
+  resetSharedSessionKeyManager,
   resolveChain,
+  resolveContextSimulationEndpoint,
   resolveEvmChainId,
   resolveRevertReason,
+  resolveSimulationEndpoint,
+  resolveUserOpChain,
+  sameExecutionIntent,
   saveNotificationSettings,
   selectChainCapabilities,
+  sessionKeyConfigFingerprint,
+  simulateTransactionPreview,
+  siwxResultToSession,
   toChainSwitchError,
   toEip155Accounts,
   toExecuteRouteError,