@rhinestone/sdk 2.0.0-beta.4 → 2.0.0-beta.40

package/dist/src/execution/utils.js

@@ -1,20 +1,22 @@
 import { concat, createPublicClient, createWalletClient, encodeAbiParameters, encodePacked, hashDomain, hashMessage, hashStruct, hashTypedData, isAddress, keccak256, publicActions, toHex, } from 'viem';
 import { entryPoint07Address, getUserOperationHash, } from 'viem/account-abstraction';
 import { wrapTypedDataSignature } from 'viem/experimental/erc7739';
-import { EoaAccountMustHaveAccountError, EoaSigningMethodNotConfiguredError, FactoryArgsNotAvailableError, getAccountProvider, getAddress, getEip712Domain, getEip1271Signature, getEip7702InitCall, getEmissarySignature, getGuardianSmartAccount, getInitCode, getSmartAccount, getTypedDataPackedSignature, is7702, toErc6492Signature, } from '../accounts/index.js';
+import { EoaAccountMustHaveAccountError, EoaSigningMethodNotConfiguredError, FactoryArgsNotAvailableError, getAccountProvider, getAddress, getEip712Domain, getEip1271Signature, getEip7702InitCall, getEmissarySignature, getInitCode, getSmartAccount, getTypedDataPackedSignature, is7702, toErc6492Signature, } from '../accounts/index.js';
 import { convertOwnerSetToSignerSet } from '../accounts/signing/common.js';
 import { K1_DEFAULT_VALIDATOR_ADDRESS } from '../accounts/startale.js';
 import { createTransport, getBundlerClient, } from '../accounts/utils.js';
 import { createAuthProvider } from '../auth/provider.js';
 import { buildMockSignature, DUMMY_PRECLAIMOP_SELECTOR, DUMMY_PRECLAIMOP_TARGET, getOwnerValidator, getPermissionId, getSmartSessionValidator, isSessionEnabled, } from '../modules/validators/index.js';
-import { getMultiFactorValidator, getSocialRecoveryValidator, getWebAuthnValidator, supportsEip712, } from '../modules/validators/core.js';
+import { getMultiFactorValidator, getWebAuthnValidator, supportsEip712, } from '../modules/validators/core.js';
 import { buildPermit2ClaimPolicyCalldata, } from '../modules/validators/policies/claim/permit2.js';
-import { resolvePermit2ClaimPolicy, } from '../modules/validators/smart-sessions.js';
+import { resolvePermit2ClaimPolicy, selectPermit2ClaimPolicyForMessage, } from '../modules/validators/smart-sessions.js';
 import { getOrchestrator, } from '../orchestrator/index.js';
+import { isNonEvmChainId, toCaip2 } from '../orchestrator/caip2.js';
+import { getChainId, isNonEvmChain, } from '../orchestrator/destinations.js';
 import { getChainById, getTokenAddress, resolveTokenAddress, } from '../orchestrator/registry.js';
-import { SIG_MODE_EMISSARY_EXECUTION_ERC1271, SIG_MODE_ERC1271_EMISSARY, } from '../orchestrator/types.js';
+import { SIG_MODE_EMISSARY_EXECUTION_ERC1271, SIG_MODE_ERC1271, } from '../orchestrator/types.js';
 import { convertBigIntFields } from '../orchestrator/utils.js';
-import { Eip7702InitSignatureRequiredError, QuoteNotInPreparedTransactionError, SignerNotSupportedError, } from './error.js';
+import { Eip7702InitSignatureRequiredError, InvalidSourceCallsError, QuoteNotInPreparedTransactionError, } from './error.js';
 function isResolvedSessionSignerSet(signers) {
     return (signers?.type === 'experimental_session' && 'verifyExecutions' in signers);
 }
@@ -25,16 +27,61 @@ async function resolveSignersForChain(config, signers, chainId) {
     const resolved = resolveSessionForChain(signers, chainId);
     const enabled = await isSessionEnabled(getAddress(config), config.provider, resolved.session, config.useDevContracts);
     const enableData = enabled ? undefined : resolved.enableData;
-    const verifyExecutions = resolved.verifyExecutions ??
-        signers.verifyExecutions ??
-        resolved.session.hasExplicitPermissions;
     return {
         type: 'experimental_session',
         session: resolved.session,
         enableData,
-        verifyExecutions,
+        // First use of any session must go through the emissary's verifyExecution
+        // path: that's the only mechanism that consumes enableData + calls setConfig
+        // to install the session on-chain. Once installed, steady-state signing can
+        // drop to mode 1 unless the session has explicit permissions to enforce.
+        verifyExecutions: !enabled || resolved.session.hasExplicitPermissions,
     };
 }
+// Picks the single signature mode that matches the bytes shape the SDK will
+// actually sign, so the on-chain dispatcher hits the right validator on the
+// first try instead of falling through a hybrid.
+async function resolveSignatureMode(config, signers, sourceChains, targetChainId, 
+// Optional pre-resolved per-chain signer sets. When supplied, reuse them
+// instead of resolving again — each resolveSignersForChain does an
+// isSessionEnabled RPC, so sharing one map across mockSignatures, sigMode, and
+// preClaim avoids duplicate calls per intent. The map also defines *which*
+// chains carry a session: the caller omits a non-EVM target (it has no session
+// validator), so deriving the chain set from the map's keys keeps us from
+// resolving — and throwing on — a target with no configured session.
+preResolved) {
+    if (config.account?.type === 'eoa') {
+        return SIG_MODE_ERC1271;
+    }
+    if (signers?.type !== 'experimental_session') {
+        return SIG_MODE_ERC1271;
+    }
+    const chainIds = preResolved
+        ? [...preResolved.keys()]
+        : [...new Set([...(sourceChains ?? []).map((c) => c.id), targetChainId])];
+    const resolvedSet = await Promise.all(chainIds.map((chainId) => 
+    // Use has() not `?? resolve` so a cached `undefined` entry is still reused
+    // (get() can't distinguish "missing key" from "present but undefined").
+    preResolved?.has(chainId)
+        ? preResolved.get(chainId)
+        : resolveSignersForChain(config, signers, chainId)));
+    let anyVerifyExecutions = false;
+    for (const resolved of resolvedSet) {
+        if (!isResolvedSessionSignerSet(resolved)) {
+            return SIG_MODE_ERC1271;
+        }
+        // Conservative: one chain with verifyExecutions=true forces mode 5 across
+        // all origin signatures — a single mode field can't describe divergence.
+        if (resolved.verifyExecutions)
+            anyVerifyExecutions = true;
+    }
+    // Mode 4 (pure emissary-execution) is unused: signIntentTypedData always
+    // emits a dual sig for the intent's origin/destination signatures when
+    // verifyExecutions=true, so mode 5 is the right hybrid.
+    return anyVerifyExecutions
+        ? SIG_MODE_EMISSARY_EXECUTION_ERC1271
+        : SIG_MODE_ERC1271;
+}
 function resolveSessionForChain(signers, chainId) {
     if ('sessions' in signers) {
         const config = signers.sessions[chainId];
@@ -46,13 +93,23 @@ function resolveSessionForChain(signers, chainId) {
     return { session: signers.session, enableData: signers.enableData };
 }
 async function prepareTransaction(config, transaction) {
-    const { sourceChains, targetChain, tokenRequests, signers, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, recipient, } = getTransactionParams(transaction);
+    const { sourceChains, targetChain, tokenRequests, signers, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, appFees, account, recipient, sourceCalls, } = getTransactionParams(transaction);
     const accountAddress = getAddress(config);
-    const isUserOpSigner = signers?.type === 'guardians';
-    if (isUserOpSigner) {
-        throw new SignerNotSupportedError();
+    // Destination calls (transaction.calls on a cross-chain transaction) are
+    // executed on the destination chain by the solver/account. For non-EVM
+    // destinations we can't resolve arbitrary EVM calls; assert there are
+    // none and route an empty list through.
+    let resolvedCalls;
+    if (isNonEvmChain(targetChain)) {
+        if (transaction.calls && transaction.calls.length > 0) {
+            throw new Error(`Destination calls are not supported for non-EVM target chain ${targetChain.name} (${targetChain.caip2})`);
+        }
+        resolvedCalls = [];
     }
-    const prepared = await prepareTransactionAsIntent(config, sourceChains, targetChain, await resolveCallInputs(transaction.calls, config, targetChain, accountAddress), transaction.gasLimit, tokenRequests, recipient, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, signers);
+    else {
+        resolvedCalls = await resolveCallInputs(transaction.calls, config, targetChain, accountAddress);
+    }
+    const prepared = await prepareTransactionAsIntent(config, sourceChains, targetChain, resolvedCalls, transaction.gasLimit, tokenRequests, recipient, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, account, signers, sourceCalls, appFees);
     return {
         quotes: prepared.quotes,
         intentInput: prepared.intentInput,
@@ -131,6 +188,11 @@ async function getTargetExecutionSignature(config, signData, targetChain, signer
     if (!signData.targetExecution) {
         return undefined;
     }
+    // Target executions are EVM-only (smart-session validator on destination).
+    // Non-EVM destinations don't have a validator there to verify the sig.
+    if (isNonEvmChain(targetChain)) {
+        return undefined;
+    }
     const resolvedSigners = await resolveSignersForChain(config, signers, targetChain.id);
     if (!isResolvedSessionSignerSet(resolvedSigners) ||
         !resolvedSigners.verifyExecutions) {
@@ -266,10 +328,16 @@ async function signAuthorizationsInternal(config, context) {
     }
     const accountAddress = getAddress(config);
     const { contract: eip7702Contract } = getEip7702InitCall(config, eip7702InitSignature);
+    // EIP-7702 authorization is EVM-only — there's no contract to delegate
+    // to on Solana / Tron. Skip the destination chain entirely when it's
+    // non-EVM; source chains are always EVM by construction.
     const chains = new Map();
-    for (const chain of [...(context.sourceChains ?? []), context.targetChain]) {
+    for (const chain of context.sourceChains ?? []) {
         chains.set(chain.id, chain);
     }
+    if (!isNonEvmChain(context.targetChain)) {
+        chains.set(context.targetChain.id, context.targetChain);
+    }
     const authorizations = [];
     for (const chain of chains.values()) {
         const walletClient = createWalletClient({
@@ -314,10 +382,11 @@ function getTransactionParams(transaction) {
     const gasLimit = transaction.gasLimit;
     const settlementLayers = transaction.settlementLayers;
     const sourceAssets = transaction.sourceAssets;
-    const feeAsset = transaction.feeAsset;
     const auxiliaryFunds = transaction.auxiliaryFunds;
+    const appFees = transaction.appFees;
     const account = transaction.experimental_accountOverride;
     const recipient = transaction.recipient;
+    const sourceCalls = transaction.sourceCalls;
     const tokenRequests = getTokenRequests(targetChain, initialTokenRequests);
     return {
         sourceChains,
@@ -329,15 +398,23 @@ function getTransactionParams(transaction) {
         gasLimit,
         settlementLayers,
         sourceAssets,
-        feeAsset,
         auxiliaryFunds,
+        appFees,
         account,
         recipient,
+        sourceCalls,
     };
 }
 function getTokenRequests(targetChain, initialTokenRequests) {
-    if (initialTokenRequests) {
-        validateTokenSymbols(targetChain, initialTokenRequests.map((tokenRequest) => tokenRequest.address));
+    // Non-EVM destinations carry SPL mint / Tron T-prefixed addresses that
+    // aren't valid 0x-hex; skip symbol/EVM-address validation here and let
+    // the orchestrator validate per its own schema. EVM destinations keep
+    // the existing strict check so a typo on Optimism still fails fast.
+    if (initialTokenRequests && !isNonEvmChain(targetChain)) {
+        // Inside this branch targetChain is a viem `Chain`, which excludes the
+        // non-EVM transaction variant — token requests are EVM-typed here.
+        const evmRequests = initialTokenRequests;
+        validateTokenSymbols(targetChain, evmRequests.map((tokenRequest) => tokenRequest.address));
     }
     return initialTokenRequests ?? [];
 }
@@ -386,12 +463,46 @@ function getIntentAccount(config, eip7702InitSignature, account) {
         delegations,
     };
 }
-async function prepareTransactionAsIntent(config, sourceChains, targetChain, callInputs, gasLimit, tokenRequests, recipientInput, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, signers) {
-    const calls = parseCalls(callInputs, targetChain.id);
+function cloneAuxiliaryFunds(auxiliaryFunds) {
+    if (!auxiliaryFunds)
+        return undefined;
+    return Object.fromEntries(Object.entries(auxiliaryFunds).map(([chainId, funds]) => [
+        Number(chainId),
+        { ...funds },
+    ]));
+}
+function toCallInput(sourceCall) {
+    const { provides: _provides, ...call } = sourceCall;
+    return call;
+}
+function addProvidedFunds(auxiliaryFunds, chainId, calls) {
+    let next = auxiliaryFunds;
+    for (const call of calls) {
+        for (const provided of call.provides ?? []) {
+            next ??= {};
+            next[chainId] ??= {};
+            const token = provided.token;
+            next[chainId][token] = (next[chainId][token] ?? 0n) + provided.amount;
+        }
+    }
+    return next;
+}
+async function prepareTransactionAsIntent(config, sourceChains, targetChain, callInputs, gasLimit, tokenRequests, recipientInput, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, account, signers, sourceCalls, appFees) {
+    const targetChainId = getChainId(targetChain);
+    const calls = parseCalls(callInputs, targetChainId);
     const accountAccessList = createAccountAccessList(sourceChains, sourceAssets);
     function getRecipient(recipient) {
         if (typeof recipient === 'string') {
-            // Passed as an address, assume it's an EOA
+            // Non-EVM-addressed recipients (Solana base58 / Tron T-prefix) carry no
+            // EVM smart-account semantics; the orchestrator schema requires
+            // accountType / setupOps to be unset. Emit just the address. HyperCore
+            // is EVM-addressed (eip155:1337) so it falls through to the EOA
+            // passthrough below — the orchestrator's HyperCore gate requires
+            // accountType: 'EOA'.
+            if (isNonEvmChainId(targetChainId)) {
+                return { address: recipient };
+            }
+            // EVM (and HyperCore) passthrough — assume EOA.
             return {
                 address: recipient,
                 accountType: 'EOA',
@@ -404,25 +515,65 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
         }
         return getIntentAccount(recipient, eip7702InitSignature, account);
     }
+    // Resolve per-chain signer state once (each resolveSignersForChain does an
+    // isSessionEnabled RPC) and reuse it for mock signatures, the signature mode,
+    // and preClaim ops. Exclude a non-EVM destination — it has no session
+    // validator, so resolving it would waste an RPC (or throw for per-chain
+    // session signers). resolveSignatureMode derives its chain set from this map's
+    // keys, so the excluded non-EVM target is never resolved there either.
+    const sessionChainIds = [
+        ...new Set([
+            ...(sourceChains ?? []).map((c) => c.id),
+            ...(isNonEvmChain(targetChain) ? [] : [targetChainId]),
+        ]),
+    ];
+    const resolvedByChain = signers?.type === 'experimental_session'
+        ? new Map(await Promise.all(sessionChainIds.map(async (chainId) => [
+            chainId,
+            await resolveSignersForChain(config, signers, chainId),
+        ])))
+        : undefined;
+    // Per-chain mock signatures: enables accurate per-chain session validation gas
+    // simulation. Non-EVM destinations are excluded — they have no destination-side
+    // session validator. Each chain's mock sig carries that chain's own resolved
+    // shape (ENABLE / USE / ERC-1271). Note these are per-chain and may differ in
+    // shape, whereas `signatureMode` (below) is a single global value resolved
+    // conservatively (anyVerifyExecutions across chains → mode 5) — so in mixed
+    // states a chain's mock shape need not match the global signatureMode.
+    let mockSignatures;
+    if (resolvedByChain) {
+        const entries = [...resolvedByChain.entries()].flatMap(([chainId, resolved]) => {
+            // resolvedByChain is keyed by sessionChainIds, which already excludes a
+            // non-EVM target — so no per-entry target guard is needed here.
+            if (!isResolvedSessionSignerSet(resolved))
+                return [];
+            // Match the mock shape to what the real sig will be: ERC-1271 when not
+            // verifying executions; otherwise ENABLE if the session still needs
+            // installing (enableData present), else USE (already enabled, e.g.
+            // explicit permissions — its real sig is MODE_USE with no enableData).
+            const shape = !resolved.verifyExecutions
+                ? 'erc1271'
+                : resolved.enableData !== undefined
+                    ? 'enable'
+                    : 'use';
+            return [
+                [
+                    String(chainId),
+                    buildMockSignature(resolved.session, config.useDevContracts, sourceChains?.length ?? 1, chainId, shape),
+                ],
+            ];
+        });
+        // Leave mockSignatures undefined (not {}) when there are no eligible chains,
+        // so downstream consumers can treat presence as "per-chain sigs provided".
+        if (entries.length > 0)
+            mockSignatures = Object.fromEntries(entries);
+    }
     const intentAccount = {
         ...getIntentAccount(config, eip7702InitSignature, account),
-        ...(signers?.type === 'experimental_session' && {
-            // Per-chain map: enables accurate per-chain session validation gas simulation
-            mockSignatures: Object.fromEntries([
-                ...new Set([
-                    ...(sourceChains ?? []).map((c) => c.id),
-                    targetChain.id,
-                ]),
-            ].map((chainId) => [
-                String(chainId),
-                buildMockSignature(resolveSessionForChain(signers, chainId).session, config.useDevContracts, sourceChains?.length ?? 1, chainId),
-            ])),
-        }),
+        ...(mockSignatures && { mockSignatures }),
     };
     const recipient = getRecipient(recipientInput);
-    const signatureMode = signers?.type === 'experimental_session'
-        ? SIG_MODE_EMISSARY_EXECUTION_ERC1271
-        : SIG_MODE_ERC1271_EMISSARY;
+    const signatureMode = await resolveSignatureMode(config, signers, sourceChains, targetChainId, resolvedByChain);
     // For session signers that need enabling, pass a dummy preclaimop per source chain
     // so the orchestrator bakes it into the bundle before computing its HMAC. The filler
     // executes the op via verifyExecution in ENABLE mode, enabling the session on-chain
@@ -430,11 +581,11 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
     // post-facto — because the orchestrator HMAC covers preClaimOps.
     const preClaimExecutions = {};
     if (signers?.type === 'experimental_session' && sourceChains) {
-        const resolvedPerChain = await Promise.all(sourceChains.map(async (chain) => ({
-            chainId: chain.id,
-            resolved: await resolveSignersForChain(config, signers, chain.id),
-        })));
-        for (const { chainId, resolved } of resolvedPerChain) {
+        // Reuse the shared per-chain resolution (source chains are a subset of
+        // sessionChainIds) instead of resolving — and re-doing isSessionEnabled — again.
+        for (const chain of sourceChains) {
+            const chainId = chain.id;
+            const resolved = resolvedByChain?.get(chainId);
             if (!isResolvedSessionSignerSet(resolved))
                 continue;
             const { enableData, verifyExecutions } = resolved;
@@ -449,10 +600,40 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
             ];
         }
     }
+    let combinedAuxiliaryFunds = cloneAuxiliaryFunds(auxiliaryFunds);
+    if (sourceCalls) {
+        const accountAddress = getAddress(config);
+        const allowedChainIds = new Set([
+            ...(sourceChains ?? []).map((c) => c.id),
+            ...(!isNonEvmChain(targetChain) ? [targetChainId] : []),
+        ]);
+        for (const [chainIdStr, calls] of Object.entries(sourceCalls)) {
+            const chainId = Number(chainIdStr);
+            if (!allowedChainIds.has(chainId)) {
+                throw new InvalidSourceCallsError({ chainId });
+            }
+            const chain = sourceChains?.find((c) => c.id === chainId) ??
+                (!isNonEvmChain(targetChain) && targetChainId === chainId
+                    ? targetChain
+                    : undefined);
+            if (!chain) {
+                throw new InvalidSourceCallsError({ chainId });
+            }
+            combinedAuxiliaryFunds = addProvidedFunds(combinedAuxiliaryFunds, chainId, calls);
+            const resolved = await resolveCallInputs(calls.map(toCallInput), config, chain, accountAddress);
+            const userExecutions = parseCalls(resolved, chainId);
+            if (userExecutions.length === 0)
+                continue;
+            preClaimExecutions[chainId] = [
+                ...(preClaimExecutions[chainId] ?? []),
+                ...userExecutions,
+            ];
+        }
+    }
     const metaIntent = {
-        destinationChainId: targetChain.id,
+        destinationChainId: targetChainId,
         tokenRequests: tokenRequests.map((tokenRequest) => ({
-            tokenAddress: resolveTokenAddress(tokenRequest.address, targetChain.id),
+            tokenAddress: resolveTokenAddress(tokenRequest.address, targetChainId),
             amount: tokenRequest.amount,
         })),
         recipient,
@@ -461,7 +642,6 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
         destinationGasUnits: gasLimit,
         accountAccessList,
         options: {
-            feeToken: feeAsset,
             sponsorSettings: sponsored
                 ? typeof sponsored === 'object'
                     ? {
@@ -477,19 +657,20 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
                 : undefined,
             settlementLayers,
             signatureMode,
-            auxiliaryFunds,
+            auxiliaryFunds: combinedAuxiliaryFunds,
+            appFees,
         },
         ...(Object.keys(preClaimExecutions).length > 0 && { preClaimExecutions }),
     };
     const serializedIntent = convertBigIntFields(metaIntent);
     const orchestrator = getOrchestrator(config._authProvider ?? createAuthProvider(config), config.endpointUrl, config.headers);
-    const { routes } = await orchestrator.createQuote(metaIntent);
+    const { routes, traceId } = await orchestrator.createQuote(metaIntent);
     const best = routes[0];
     if (!best) {
         throw new Error('Orchestrator returned no quote');
     }
     return {
-        quotes: { best, all: routes },
+        quotes: { traceId, best, all: routes },
         intentInput: serializedIntent,
     };
 }
@@ -529,7 +710,14 @@ async function signIntent(config, signData, targetChain, signers, targetExecutio
         const signature = await signIntentTypedData(config, originSigners, validator, isRoot, typedData, chain, targetExecution ?? false);
         originSignatures.push(signature);
     }
-    const destinationSigners = await resolveSignersForChain(config, signers, targetChain.id);
+    // Non-EVM destinations have no destination-side validator, so there's no
+    // session to resolve and no signer to derive. Skipping here matters for
+    // per-chain experimental sessions: `resolveSessionForChain` would throw
+    // `No session configured for chain {synthetic-id}` since users never
+    // configure a session keyed by the synthetic Solana/Tron chain id.
+    const destinationSigners = isNonEvmChain(targetChain)
+        ? undefined
+        : await resolveSignersForChain(config, signers, targetChain.id);
     const destinationSignature = await getDestinationSignature(config, destinationSigners, validator, isRoot, targetChain, destination, originSignatures, targetExecution ?? false);
     return {
         originSignatures,
@@ -537,18 +725,25 @@ async function signIntent(config, signData, targetChain, signers, targetExecutio
     };
 }
 async function getDestinationSignature(config, signers, validator, isRoot, targetChain, destination, originSignatures, targetExecution) {
-    // Smart sessions require a separate destination signature because the
-    // session enable data differs per chain
-    if (signers?.type === 'experimental_session') {
-        return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
-    }
-    // ERC-7739 with K1 validator requires a separate destination signature because
-    // the account's eip712Domain() returns the target chain's chainId, which differs
-    // from the origin chain used for the last origin signature
-    const isK1Validator = validator.address.toLowerCase() ===
-        K1_DEFAULT_VALIDATOR_ADDRESS.toLowerCase();
-    if (isK1Validator && supportsEip712(validator)) {
-        return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+    // Non-EVM destinations have no destination-side validator, no
+    // eip712Domain(), no smart session enable data. Settlement is solver-
+    // mediated on the orchestrator side and the origin signatures alone
+    // authorize the bundle. Fall through to the "reuse last origin sig"
+    // branch instead of trying to sign on Solana / Tron.
+    if (!isNonEvmChain(targetChain)) {
+        // Smart sessions require a separate destination signature because the
+        // session enable data differs per chain
+        if (signers?.type === 'experimental_session') {
+            return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+        }
+        // ERC-7739 with K1 validator requires a separate destination signature because
+        // the account's eip712Domain() returns the target chain's chainId, which differs
+        // from the origin chain used for the last origin signature
+        const isK1Validator = validator.address.toLowerCase() ===
+            K1_DEFAULT_VALIDATOR_ADDRESS.toLowerCase();
+        if (isK1Validator && supportsEip712(validator)) {
+            return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+        }
     }
     const lastOriginSignature = originSignatures.at(-1);
     return typeof lastOriginSignature === 'object'
@@ -628,7 +823,17 @@ function resolveClaimPolicyData(signers, parameters) {
         typeof msg.deadline !== 'bigint') {
         return undefined;
     }
-    return buildPermit2ClaimPolicyCalldata(resolvePermit2ClaimPolicy(signers.session.claimPolicies[0]), parameters.message);
+    const message = parameters.message;
+    // A session may carry several claim policies (a user policy plus one or
+    // more synthesized cross-chain permits). The on-chain emissary validates
+    // against the policy that matches this Permit2 message, and the calldata
+    // layout is policy-specific — so we must build it from the matching policy,
+    // not blindly `claimPolicies[0]`.
+    const claimPolicy = selectPermit2ClaimPolicyForMessage(signers.session.claimPolicies, message);
+    if (!claimPolicy) {
+        return undefined;
+    }
+    return buildPermit2ClaimPolicyCalldata(resolvePermit2ClaimPolicy(claimPolicy), message);
 }
 async function signIntentTypedData(config, signers, validator, isRoot, parameters, chain, targetExecution) {
     if (supportsEip712(validator)) {
@@ -757,7 +962,7 @@ async function submitIntentInternal(config, sourceChains, targetChain, quote, or
         ...(authorizations.length > 0 && {
             authorizations: {
                 sponsor: authorizations.map((authorization) => ({
-                    chainId: authorization.chainId,
+                    chainId: toCaip2(authorization.chainId),
                     address: authorization.address,
                     nonce: authorization.nonce,
                     yParity: authorization.yParity ?? 0,
@@ -774,8 +979,9 @@ async function submitIntentInternal(config, sourceChains, targetChain, quote, or
     return {
         type: 'intent',
         id: response.intentId,
+        traceId: response.traceId,
         sourceChains: sourceChains?.map((chain) => chain.id),
-        targetChain: targetChain.id,
+        targetChain: getChainId(targetChain),
     };
 }
 async function getValidatorAccount(config, signers, publicClient, chain) {
@@ -787,13 +993,7 @@ async function getValidatorAccount(config, signers, publicClient, chain) {
     if (withOwner) {
         return getSmartAccount(config, publicClient, chain);
     }
-    const withGuardians = signers.type === 'guardians' ? signers : null;
-    return withGuardians
-        ? await getGuardianSmartAccount(config, publicClient, chain, {
-            type: 'ecdsa',
-            accounts: withGuardians.guardians,
-        })
-        : null;
+    return null;
 }
 function getValidator(config, signers) {
     if (!signers) {
@@ -812,11 +1012,11 @@ function getValidator(config, signers) {
             return getWebAuthnValidator(1, withOwner.accounts.map((account) => ({
                 pubKey: account.publicKey,
                 authenticatorId: account.id,
-            })));
+            })), withOwner.module);
         }
         // Multi-factor
         if (withOwner.kind === 'multi-factor') {
-            return getMultiFactorValidator(1, withOwner.validators);
+            return getMultiFactorValidator(1, withOwner.validators, withOwner.module);
         }
     }
     // Smart sessions
@@ -824,15 +1024,12 @@ function getValidator(config, signers) {
     if (withSession) {
         return getSmartSessionValidator(config);
     }
-    // Guardians (social recovery)
-    const withGuardians = signers.type === 'guardians' ? signers : null;
-    if (withGuardians) {
-        return getSocialRecoveryValidator(withGuardians.guardians);
-    }
     // Fallback
     return undefined;
 }
 function parseCalls(calls, chainId) {
+    // Destination calls only run on EVM chains (non-EVM destinations reject
+    // calls upstream), so the resolved `to` is always a viem `Address` here.
     return calls.map((call) => ({
         data: call.data ?? '0x',
         value: call.value ?? 0n,
@@ -852,6 +1049,8 @@ function createAccountAccessList(sourceChains, sourceAssets) {
             const chainTokenAmounts = {};
             for (const config of sourceAssets) {
                 const chainId = config.chain.id;
+                // Source assets live on viem `Chain`s, which are always EVM, so the
+                // resolved value is a viem `Address`.
                 const tokenAddress = resolveTokenAddress(config.address, config.chain.id);
                 if (config.amount !== undefined) {
                     if (!chainTokenAmounts[chainId])
@@ -999,7 +1198,9 @@ function hashErc7739TypedDataForSolady({ domain, types, primaryType, message, ve
         deps.delete(primary);
         const sorted = [primary, ...Array.from(deps).sort()];
         return sorted
-            .map((t) => `${t}(${allTypes[t].map((f) => `${f.type} ${f.name}`).join(',')})`)
+            .map((t) => `${t}(${allTypes[t]
+            .map((f) => `${f.type} ${f.name}`)
+            .join(',')})`)
             .join('');
     }
     const contentsType = encodeTypeString(primaryType, types);
@@ -1051,4 +1252,4 @@ function hashErc7739TypedDataForSolady({ domain, types, primaryType, message, ve
     // Final hash: keccak256("\x19\x01" || appDomainSep || structHash)
     return keccak256(concat(['0x1901', appDomainSeparator, structHash]));
 }
-export { prepareTransaction, getTransactionMessages, signTransaction, signAuthorizations, signAuthorizationsInternal, signMessage, signTypedData, submitTransaction, prepareUserOperation, signUserOperation, submitUserOperation, signIntent, prepareTransactionAsIntent, submitIntentInternal, getValidatorAccount, parseCalls, getTokenRequests, resolveCallInputs, getIntentAccount, getTargetExecutionSignature, hashErc7739TypedDataForSolady, resolveSessionForChain, };
+export { prepareTransaction, getTransactionMessages, signTransaction, signAuthorizations, signAuthorizationsInternal, signMessage, signTypedData, submitTransaction, prepareUserOperation, signUserOperation, submitUserOperation, signIntent, prepareTransactionAsIntent, submitIntentInternal, getValidatorAccount, parseCalls, getTokenRequests, resolveCallInputs, getIntentAccount, getTargetExecutionSignature, hashErc7739TypedDataForSolady, resolveSessionForChain, resolveSignatureMode, };