@owney/sdk 0.7.25-beta.17 → 0.7.25-beta.18

package/dist/index.cjs

@@ -4273,6 +4273,14 @@ function sponsorError(message, safeToFallback, details = {}) {
     "yieldseeker"
   );
 }
+function assertIntentFresh(expiresAt) {
+  if (!Number.isFinite(expiresAt) || Date.now() + 5e3 >= expiresAt * 1e3)
+    throw sponsorError(
+      "The withdrawal sponsorship request expired. Please try again.",
+      true,
+      { failureCode: "SPONSOR_INTENT_EXPIRED" }
+    );
+}
 function providerReason(value) {
   if (typeof value !== "string") return void 0;
   return value.replace(/https?:\/\/\S+/gi, "[url]").replace(/0x[0-9a-fA-F]{40,}/g, "[hex]").replace(/[A-Za-z0-9_+=\/-]{48,}/g, "[token]").slice(0, 300);
@@ -4561,6 +4569,7 @@ async function submitEoa(input) {
   }
   const userOpHash = operationHash(operation);
   await assertOwnerSession(input.state, input.owner);
+  assertIntentFresh(input.expiresAt);
   const wallet = (0, import_viem11.createWalletClient)({
     account: input.owner,
     chain: import_chains3.base,
@@ -4569,6 +4578,7 @@ async function submitEoa(input) {
   const signature = await wallet.signMessage({ message: { raw: userOpHash } });
   operation = { ...operation, signature };
   await assertOwnerSession(input.state, input.owner);
+  assertIntentFresh(input.expiresAt);
   const userOperation = {
     sender: operation.sender,
     nonce: operation.nonce,
@@ -4646,6 +4656,7 @@ async function submitSmart(input) {
     throw sponsorError("This account cannot use a paymaster on Base.", true);
   await assertOwnerSession(input.state, input.owner);
   let sent;
+  assertIntentFresh(input.expiresAt);
   const requestedId = (0, import_viem11.toHex)(globalThis.crypto.getRandomValues(new Uint8Array(32)));
   savePending(input.onPending, { callsId: requestedId }, true);
   await checkpoint(input.onBeforeSubmission, { callsId: requestedId });
@@ -4744,7 +4755,8 @@ async function submitYieldseekerSponsoredWithdrawal(input) {
     action: "withdraw",
     refreshYieldseekerSignature: input.refreshYieldseekerSignature
   });
-  const args = { ...input, owner, rpcUrl };
+  assertIntentFresh(intent.expiresAt);
+  const args = { ...input, owner, rpcUrl, expiresAt: intent.expiresAt };
   return intent.ownerPath === "eoa" ? submitEoa(args) : submitSmart(args);
 }
 async function submitYieldseekerSponsoredUpgrade(input) {
@@ -4764,7 +4776,8 @@ async function submitYieldseekerSponsoredUpgrade(input) {
   });
   if (intent.ownerPath !== "smart")
     throw sponsorError("V1 upgrade sponsorship requires a Base Account owner.", true);
-  return submitSmart({ ...input, owner, rpcUrl });
+  assertIntentFresh(intent.expiresAt);
+  return submitSmart({ ...input, owner, rpcUrl, expiresAt: intent.expiresAt });
 }
 
 // src/agents/yieldseeker/yieldseeker.agent.ts

package/dist/index.js

@@ -4268,6 +4268,14 @@ function sponsorError(message, safeToFallback, details = {}) {
     "yieldseeker"
   );
 }
+function assertIntentFresh(expiresAt) {
+  if (!Number.isFinite(expiresAt) || Date.now() + 5e3 >= expiresAt * 1e3)
+    throw sponsorError(
+      "The withdrawal sponsorship request expired. Please try again.",
+      true,
+      { failureCode: "SPONSOR_INTENT_EXPIRED" }
+    );
+}
 function providerReason(value) {
   if (typeof value !== "string") return void 0;
   return value.replace(/https?:\/\/\S+/gi, "[url]").replace(/0x[0-9a-fA-F]{40,}/g, "[hex]").replace(/[A-Za-z0-9_+=\/-]{48,}/g, "[token]").slice(0, 300);
@@ -4556,6 +4564,7 @@ async function submitEoa(input) {
   }
   const userOpHash = operationHash(operation);
   await assertOwnerSession(input.state, input.owner);
+  assertIntentFresh(input.expiresAt);
   const wallet = createWalletClient2({
     account: input.owner,
     chain: base3,
@@ -4564,6 +4573,7 @@ async function submitEoa(input) {
   const signature = await wallet.signMessage({ message: { raw: userOpHash } });
   operation = { ...operation, signature };
   await assertOwnerSession(input.state, input.owner);
+  assertIntentFresh(input.expiresAt);
   const userOperation = {
     sender: operation.sender,
     nonce: operation.nonce,
@@ -4641,6 +4651,7 @@ async function submitSmart(input) {
     throw sponsorError("This account cannot use a paymaster on Base.", true);
   await assertOwnerSession(input.state, input.owner);
   let sent;
+  assertIntentFresh(input.expiresAt);
   const requestedId = toHex(globalThis.crypto.getRandomValues(new Uint8Array(32)));
   savePending(input.onPending, { callsId: requestedId }, true);
   await checkpoint(input.onBeforeSubmission, { callsId: requestedId });
@@ -4739,7 +4750,8 @@ async function submitYieldseekerSponsoredWithdrawal(input) {
     action: "withdraw",
     refreshYieldseekerSignature: input.refreshYieldseekerSignature
   });
-  const args = { ...input, owner, rpcUrl };
+  assertIntentFresh(intent.expiresAt);
+  const args = { ...input, owner, rpcUrl, expiresAt: intent.expiresAt };
   return intent.ownerPath === "eoa" ? submitEoa(args) : submitSmart(args);
 }
 async function submitYieldseekerSponsoredUpgrade(input) {
@@ -4759,7 +4771,8 @@ async function submitYieldseekerSponsoredUpgrade(input) {
   });
   if (intent.ownerPath !== "smart")
     throw sponsorError("V1 upgrade sponsorship requires a Base Account owner.", true);
-  return submitSmart({ ...input, owner, rpcUrl });
+  assertIntentFresh(intent.expiresAt);
+  return submitSmart({ ...input, owner, rpcUrl, expiresAt: intent.expiresAt });
 }
 
 // src/agents/yieldseeker/yieldseeker.agent.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owney/sdk",
-  "version": "0.7.25-beta.17",
+  "version": "0.7.25-beta.18",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",