@naculus/connect-appkit-core 0.2.8 → 0.4.0

package/dist/index.js

@@ -793,8 +793,112 @@ function assertHexSignature(value) {
   return value;
 }
 
+// src/delegation-framework-adapter.ts
+import {
+  DELEGATION_FRAMEWORK,
+  sessionKeyAddress,
+  WalletError as WalletError7
+} from "@naculus/connect-core";
+function createDelegationFrameworkAdapter(options) {
+  const { manager, rpc, codec } = options;
+  return {
+    route: "eip7702",
+    async check({ policy }) {
+      const ready = policy.scope.mode === "eip7702" && policy.status === "active" && Boolean(policy.authorized);
+      return {
+        ready,
+        authorizationInstalled: ready,
+        sponsored: false,
+        promptless: true,
+        executorAddress: DELEGATION_FRAMEWORK.eip7702StatelessDeleGator,
+        reason: ready ? "The session key redeems its delegation; the chain enforces the caveats." : "This policy has no attached EIP-7702 delegation."
+      };
+    },
+    async prepare({ policy, transaction }) {
+      if (!transaction.to) {
+        throw new WalletError7(
+          "invalid_input",
+          "A delegated execution needs a target."
+        );
+      }
+      let value;
+      try {
+        value = BigInt(transaction.value ?? "0");
+      } catch {
+        throw new WalletError7(
+          "invalid_input",
+          "Transaction value is not a quantity."
+        );
+      }
+      const execution = {
+        target: transaction.to,
+        value,
+        callData: transaction.data ?? "0x"
+      };
+      const call = await manager.buildDelegationRedemption(
+        policy.id,
+        execution
+      );
+      const chainId = options.chainId();
+      if (chainId !== call.chainId) {
+        throw new WalletError7(
+          "chain_mismatch",
+          `The delegation is for chain ${call.chainId}, not ${String(chainId)}.`
+        );
+      }
+      const from = sessionKeyAddress(policy.publicKey);
+      const [nonce, gas, fees] = await Promise.all([
+        rpc.getTransactionCount(from),
+        rpc.estimateGas({ from, to: call.to, data: call.data }),
+        rpc.fees()
+      ]);
+      const unsigned = {
+        type: "eip1559",
+        chainId,
+        nonce,
+        to: call.to,
+        value: 0n,
+        data: call.data,
+        gas,
+        maxFeePerGas: fees.maxFeePerGas,
+        maxPriorityFeePerGas: fees.maxPriorityFeePerGas
+      };
+      const payload = {
+        outerTx: {
+          to: call.to,
+          value: "0x0",
+          data: call.data,
+          chainId,
+          gas: `0x${gas.toString(16)}`
+        },
+        execution,
+        unsigned
+      };
+      return {
+        digest: codec.signingHash(unsigned),
+        transaction,
+        payload
+      };
+    },
+    async broadcast({ prepared, signature }) {
+      const { unsigned } = prepared.payload;
+      const hash = await rpc.sendRawTransaction(
+        codec.serialize(unsigned, signature)
+      );
+      return { route: "eip7702", hash, status: "submitted" };
+    }
+  };
+}
+
 // src/delegation-policy.ts
-import { WalletError as WalletError7 } from "@naculus/connect-core";
+import {
+  DELEGATION_FRAMEWORK as DELEGATION_FRAMEWORK2,
+  delegationTypedData,
+  WalletError as WalletError8
+} from "@naculus/connect-core";
+function delegatesToStatelessDeleGator(delegation) {
+  return delegation.delegated === true && delegation.delegate?.toLowerCase() === DELEGATION_FRAMEWORK2.eip7702StatelessDeleGator.toLowerCase();
+}
 function sorted(values) {
   return values ? [...values].map((value) => value.toLowerCase()).sort() : null;
 }
@@ -841,12 +945,13 @@ function buildDelegationPolicyMessage(policy, origin) {
 ${JSON.stringify(payload)}`;
 }
 function isVerifiablePolicy(policy) {
-  return policy.status === "active" && Boolean(policy.authorized) && policy.scope.mode === "offchain";
+  return policy.status === "active" && Boolean(policy.authorized) && (policy.scope.mode === "offchain" || policy.scope.mode === "eip7702");
 }
 function createDelegationPolicyFlow(deps) {
   const { manager, origin } = deps;
   const verifyStoredPolicy = async (policy) => {
     if (!isVerifiablePolicy(policy)) return false;
+    if (policy.scope.mode === "eip7702") return true;
     return manager.verifyOffchainAuthorization(
       policy.id,
       buildDelegationPolicyMessage(policy, origin),
@@ -856,28 +961,29 @@ function createDelegationPolicyFlow(deps) {
   const createPolicy = async (scope) => {
     const signer = deps.signer();
     if (!signer) {
-      throw new WalletError7("wallet_unavailable", "No active EVM account");
+      throw new WalletError8("wallet_unavailable", "No active EVM account");
     }
+    if (scope.mode === "eip7702") return createDelegatedPolicy(scope, signer);
     if (scope.mode && scope.mode !== "offchain") {
-      throw new WalletError7(
+      throw new WalletError8(
         "method_not_allowed",
-        "This flow creates signed off-chain policies only. EIP-7702 and AA-module policies require a configured on-chain execution adapter."
+        "This flow creates off-chain and EIP-7702 policies only; AA-module policies need an on-chain module."
       );
     }
     if (scope.allowedRecipients && scope.allowedRecipients.length > 0) {
-      throw new WalletError7(
+      throw new WalletError8(
         "method_not_allowed",
         "Recipient-limited policies are not supported by this flow: its executions sign raw digests, which connect-core refuses while allowedRecipients is set."
       );
     }
     if (!deps.encryptionKeyConfigured) {
-      throw new WalletError7(
+      throw new WalletError8(
         "method_not_allowed",
         "Persistent delegation policies require a host-provided encryptionKey. The deterministic compatibility fallback is not a production key boundary."
       );
     }
     if (!deps.storageAvailable()) {
-      throw new WalletError7(
+      throw new WalletError8(
         "storage_unavailable",
         "Persistent delegation policy storage is unavailable in this browser"
       );
@@ -891,7 +997,7 @@ function createDelegationPolicyFlow(deps) {
       const message = buildDelegationPolicyMessage(draft, origin);
       const signature = await deps.signMessage(message);
       if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) {
-        throw new WalletError7(
+        throw new WalletError8(
           "invalid_input",
           "Wallet did not return a valid 65-byte EVM policy signature"
         );
@@ -902,7 +1008,7 @@ function createDelegationPolicyFlow(deps) {
         signerAddress: signer
       });
       if (!recovers) {
-        throw new WalletError7(
+        throw new WalletError8(
           "invalid_input",
           "Policy signature does not recover to the connected EVM account"
         );
@@ -917,13 +1023,13 @@ function createDelegationPolicyFlow(deps) {
         (policy) => policy.id === draft?.id
       );
       if (!authorized?.authorized) {
-        throw new WalletError7(
+        throw new WalletError8(
           "invalid_input",
           "Policy authorization was not persisted"
         );
       }
       if (!await verifyStoredPolicy(authorized)) {
-        throw new WalletError7(
+        throw new WalletError8(
           "invalid_input",
           "Persisted policy signature did not verify against its stored scope and origin"
         );
@@ -940,6 +1046,66 @@ function createDelegationPolicyFlow(deps) {
       throw cause instanceof Error ? cause : new Error("Policy creation failed");
     }
   };
+  const createDelegatedPolicy = async (scope, signer) => {
+    if (!deps.signTypedData || !deps.chainId) {
+      throw new WalletError8(
+        "method_not_allowed",
+        "EIP-7702 policies need the wallet's signTypedData and the current chain."
+      );
+    }
+    if (!deps.encryptionKeyConfigured) {
+      throw new WalletError8(
+        "method_not_allowed",
+        "Persistent delegation policies require a host-provided encryptionKey. The deterministic compatibility fallback is not a production key boundary."
+      );
+    }
+    if (!deps.storageAvailable()) {
+      throw new WalletError8(
+        "storage_unavailable",
+        "Persistent delegation policy storage is unavailable in this browser"
+      );
+    }
+    if (!delegatesToStatelessDeleGator(deps.delegation())) {
+      throw new WalletError8(
+        "method_not_allowed",
+        `The account must first delegate to EIP7702StatelessDeleGatorImpl (${DELEGATION_FRAMEWORK2.eip7702StatelessDeleGator}).`
+      );
+    }
+    const chainId = deps.chainId();
+    if (chainId === null || !Number.isSafeInteger(chainId)) {
+      throw new WalletError8("wallet_unavailable", "No connected EVM chain");
+    }
+    let draft = null;
+    try {
+      draft = await manager.createSessionKey(
+        { ...scope, mode: "eip7702" },
+        signer
+      );
+      const delegation = await manager.prepareDelegation(draft.id, chainId);
+      const signature = await deps.signTypedData(
+        delegationTypedData(delegation)
+      );
+      if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) {
+        throw new WalletError8(
+          "invalid_input",
+          "Wallet did not return a valid 65-byte EVM signature"
+        );
+      }
+      await manager.attachDelegation(
+        draft.id,
+        delegation,
+        signature
+      );
+      await deps.refresh();
+      return (await manager.listSessions()).find((s) => s.id === draft?.id) ?? draft;
+    } catch (cause) {
+      if (draft) await manager.revokeSession(draft.id).catch(() => {
+      });
+      await deps.refresh().catch(() => {
+      });
+      throw cause;
+    }
+  };
   const revokePolicy = async (policyId) => {
     await manager.revokeSession(policyId);
     await deps.refresh();
@@ -972,16 +1138,21 @@ function createDelegationPolicyFlow(deps) {
     const delegationMatches = Boolean(
       adapter?.route !== "eip7702" || delegation.delegated === true && adapterCheck?.executorAddress && delegation.delegate?.toLowerCase() === adapterCheck.executorAddress.toLowerCase()
     );
+    const delegatedPolicy = policy?.scope.mode === "eip7702";
     const policyReady = Boolean(
-      policy?.status === "active" && policy.authorized && authorizationVerified && policy.scope.mode === "offchain" && signerMatches && scope.valid
+      policy?.status === "active" && policy.authorized && authorizationVerified && (policy.scope.mode === "offchain" || delegatedPolicy) && signerMatches && scope.valid
     );
     const adapterSponsorshipReady = Boolean(
       deps.sponsorship !== "required" || adapterCheck?.sponsored
     );
     const broadcastReady = Boolean(
-      policyReady && callCount === 1 && adapterCheck?.ready && adapterCheck.authorizationInstalled && adapterCheck.promptless && adapterSponsorshipReady && delegationMatches
+      policyReady && callCount === 1 && adapterCheck?.ready && adapterCheck.authorizationInstalled && adapterCheck.promptless && adapterSponsorshipReady && delegationMatches && // An eip7702 policy executes only through a redemption: the key
+      // signs nothing else, so only an eip7702 adapter can carry it.
+      (!delegatedPolicy || adapter?.route === "eip7702")
+    );
+    const ready = Boolean(
+      policyReady && (delegatedPolicy ? broadcastReady : plan.route || broadcastReady)
     );
-    const ready = Boolean(policyReady && (plan.route || broadcastReady));
     const reason = !policy ? "Policy not found." : policy.status !== "active" ? `Policy is ${policy.status}.` : !policy.authorized ? "The main wallet has not signed this policy." : !authorizationVerified ? "The persisted policy signature no longer matches its scope, signer, or origin." : !signerMatches ? "The connected account is not the policy signer." : !scope.valid ? scope.reason ?? "The transaction is outside the policy scope." : broadcastReady ? `The configured ${adapter?.route ?? "AA/7702"} adapter can submit this policy-authorized operation without another main-wallet prompt.${adapterCheck?.sponsored ? " Gas sponsorship is guaranteed." : ""} ${adapterCheck?.reason ?? "The on-chain execution adapter is ready."}` : !adapter ? `${plan.reason} The signed off-chain policy permits this request; an AA/7702 adapter is still required to broadcast without another wallet prompt.` : !adapterCheck?.ready || !adapterCheck.authorizationInstalled ? `${plan.reason} ${adapterCheck?.reason ?? "The execution adapter is not ready."}` : !adapterCheck.promptless ? `${plan.reason} The configured adapter would invoke the main wallet again, so promptless broadcast is not ready.` : !adapterSponsorshipReady ? `${plan.reason} Sponsored gas is required, but the configured adapter does not guarantee sponsorship.` : callCount !== 1 ? `${plan.reason} This policy adapter prepares one execution at a time and cannot claim a multi-call broadcast.` : !delegationMatches ? `${plan.reason} The configured EIP-7702 executor does not match the account's on-chain delegation.` : !plan.route ? plan.reason : `${plan.reason} ${adapterCheck.reason}`;
     return {
       policy,
@@ -1007,37 +1178,76 @@ function createDelegationPolicyFlow(deps) {
     digest,
     tx
   );
+  const signRedemption = (policyId, prepared) => {
+    const payload = prepared.payload;
+    if (!payload?.outerTx || !payload.execution) {
+      throw new WalletError8(
+        "invalid_input",
+        "The EIP-7702 adapter did not return a redemption to sign."
+      );
+    }
+    if (prepared.transaction.chainId !== void 0 && prepared.transaction.chainId !== payload.outerTx.chainId) {
+      throw new WalletError8(
+        "chain_mismatch",
+        `The delegation is for chain ${String(payload.outerTx.chainId)}, not ${prepared.transaction.chainId}.`
+      );
+    }
+    const { execution } = payload;
+    if (typeof execution.value !== "bigint" || execution.value < 0n || !sameExecutionIntent(prepared.transaction, {
+      to: execution.target,
+      data: execution.callData,
+      value: `0x${execution.value.toString(16)}`,
+      chainId: prepared.transaction.chainId
+    })) {
+      throw new WalletError8(
+        "invalid_input",
+        "The EIP-7702 adapter's execution differs from the requested transaction."
+      );
+    }
+    return manager.signDelegationRedemption(
+      policyId,
+      prepared.digest,
+      payload.outerTx,
+      payload.execution
+    );
+  };
   const signPolicyDigest = async (policyId, digest, tx) => {
     const preview = await previewPolicyExecution(policyId, tx, 1, "any");
+    if (preview.policy?.scope.mode === "eip7702") {
+      throw new WalletError8(
+        "method_not_allowed",
+        "An EIP-7702 policy signs only its delegation redemptions; use executePolicy."
+      );
+    }
     if (!preview.ready) {
-      throw new WalletError7("method_not_allowed", preview.reason);
+      throw new WalletError8("method_not_allowed", preview.reason);
     }
     return signVerified(policyId, digest, tx);
   };
   const executePolicy = async (policyId, tx) => {
     const adapter = deps.adapter;
     if (!adapter) {
-      throw new WalletError7(
+      throw new WalletError8(
         "method_not_allowed",
         "No session-policy-aware AA/7702 execution adapter is configured."
       );
     }
     const preview = await previewPolicyExecution(policyId, tx, 1, "any");
     if (!preview.broadcastReady || !preview.policy) {
-      throw new WalletError7("method_not_allowed", preview.reason);
+      throw new WalletError8("method_not_allowed", preview.reason);
     }
     const prepared = await adapter.prepare({
       policy: preview.policy,
       transaction: tx
     });
     if (!/^0x[0-9a-fA-F]{64}$/.test(prepared.digest)) {
-      throw new WalletError7(
+      throw new WalletError8(
         "invalid_input",
         "Execution adapter returned a digest that is not 32 bytes."
       );
     }
     if (!sameExecutionIntent(tx, prepared.transaction)) {
-      throw new WalletError7(
+      throw new WalletError8(
         "invalid_input",
         "Execution adapter changed the requested target, value, data, or chain."
       );
@@ -1049,23 +1259,19 @@ function createDelegationPolicyFlow(deps) {
     const delegation = deps.delegation();
     const currentDelegationMatches = adapter.route !== "eip7702" || delegation.delegated === true && currentCheck.executorAddress !== void 0 && delegation.delegate?.toLowerCase() === currentCheck.executorAddress.toLowerCase();
     if (!currentCheck.ready || !currentCheck.authorizationInstalled || !currentCheck.promptless || deps.sponsorship === "required" && !currentCheck.sponsored || !currentDelegationMatches) {
-      throw new WalletError7(
+      throw new WalletError8(
         "method_not_allowed",
         currentCheck.reason || "The on-chain policy authorization is not ready."
       );
     }
-    const signature = await signVerified(
-      policyId,
-      prepared.digest,
-      prepared.transaction
-    );
+    const signature = preview.policy.scope.mode === "eip7702" ? await signRedemption(policyId, prepared) : await signVerified(policyId, prepared.digest, prepared.transaction);
     const submission = await adapter.broadcast({
       policy: preview.policy,
       prepared,
       signature
     });
     if (submission.route !== adapter.route || submission.status !== "submitted" || !/^0x[0-9a-fA-F]{64}$/.test(submission.hash)) {
-      throw new WalletError7(
+      throw new WalletError8(
         "invalid_input",
         "Execution adapter returned an invalid submission result."
       );
@@ -1083,6 +1289,64 @@ function createDelegationPolicyFlow(deps) {
   };
 }
 
+// src/payment-fetch.ts
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function text(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function requestUrl(input) {
+  if (input instanceof URL) return input.href;
+  if (typeof input !== "string") return input.url;
+  try {
+    return new Request(input).url;
+  } catch {
+    return input;
+  }
+}
+function describePayment(input, result) {
+  const paid = record(result.paid);
+  if (!paid) return null;
+  const resource = requestUrl(input);
+  if (typeof paid.scheme === "string" && typeof paid.network === "string") {
+    const settlement = record(result.settlement);
+    return {
+      protocol: "x402",
+      resource,
+      chainId: text(paid.network),
+      asset: text(paid.asset),
+      payTo: text(paid.payTo),
+      amount: text(paid.amount),
+      // A hash reported for another chain is not this payment's.
+      reference: settlement?.success === true && settlement.network === paid.network ? text(settlement.transaction) : null
+    };
+  }
+  const challenge = record(record(paid.challenge)?.params);
+  const request = record(paid.request);
+  if (challenge && request) {
+    const chainId = challenge.method === "evm" && typeof request.chainId === "number" && Number.isSafeInteger(request.chainId) ? `eip155:${request.chainId}` : challenge.method === "solana" && typeof request.network === "string" && /^solana:[1-9A-HJ-NP-Za-km-z]{32}$/.test(request.network) ? request.network : null;
+    return {
+      protocol: "mpp",
+      resource,
+      chainId,
+      asset: text(request.currency),
+      payTo: text(request.recipient),
+      amount: text(request.amount),
+      reference: text(record(result.receipt)?.reference)
+    };
+  }
+  return {
+    protocol: "unknown",
+    resource,
+    chainId: null,
+    asset: null,
+    payTo: null,
+    amount: null,
+    reference: null
+  };
+}
+
 // src/web3-store.ts
 import { logger } from "@naculus/connect-core";
 function withTimeout(promise, ms, label = "Operation") {
@@ -1229,6 +1493,7 @@ export {
   clearOneInAppNotification,
   compareCostsKey,
   createDecimalsCache,
+  createDelegationFrameworkAdapter,
   createDelegationPolicyFlow,
   createNotification,
   createNotificationSettingsStorage,
@@ -1236,6 +1501,7 @@ export {
   defaultSiwxDomain,
   defaultSiwxUri,
   describeChain,
+  describePayment,
   eip155ChainIdToNumber,
   encodeErc20Approve,
   encodeErc20Transfer,