@rhinestone/sdk 2.0.0-beta.4 → 2.0.0-beta.41

package/dist/src/execution/utils.js

@@ -1,20 +1,22 @@
-import { concat, createPublicClient, createWalletClient, encodeAbiParameters, encodePacked, hashDomain, hashMessage, hashStruct, hashTypedData, isAddress, keccak256, publicActions, toHex, } from 'viem';
+import { concat, createPublicClient, createWalletClient, encodeAbiParameters, encodePacked, hashDomain, hashMessage, hashStruct, hashTypedData, isAddress, keccak256, pad, publicActions, toHex, } from 'viem';
 import { entryPoint07Address, getUserOperationHash, } from 'viem/account-abstraction';
 import { wrapTypedDataSignature } from 'viem/experimental/erc7739';
-import { EoaAccountMustHaveAccountError, EoaSigningMethodNotConfiguredError, FactoryArgsNotAvailableError, getAccountProvider, getAddress, getEip712Domain, getEip1271Signature, getEip7702InitCall, getEmissarySignature, getGuardianSmartAccount, getInitCode, getSmartAccount, getTypedDataPackedSignature, is7702, toErc6492Signature, } from '../accounts/index.js';
-import { convertOwnerSetToSignerSet } from '../accounts/signing/common.js';
+import { EoaAccountMustHaveAccountError, EoaSigningMethodNotConfiguredError, FactoryArgsNotAvailableError, getAccountProvider, getAddress, getEip712Domain, getEip1271Signature, getEip7702InitCall, getEmissarySignature, getInitCode, getOwnerEcdsaSignature, getOwnerPasskeySignature, getSmartAccount, getTypedDataPackedSignature, is7702, packAccountSignature, toErc6492Signature, } from '../accounts/index.js';
+import { convertOwnerSetToSignerSet, packMultiFactorOwnerSignatures, packPasskeyOwnerSignatures, } from '../accounts/signing/common.js';
 import { K1_DEFAULT_VALIDATOR_ADDRESS } from '../accounts/startale.js';
 import { createTransport, getBundlerClient, } from '../accounts/utils.js';
 import { createAuthProvider } from '../auth/provider.js';
 import { buildMockSignature, DUMMY_PRECLAIMOP_SELECTOR, DUMMY_PRECLAIMOP_TARGET, getOwnerValidator, getPermissionId, getSmartSessionValidator, isSessionEnabled, } from '../modules/validators/index.js';
-import { getMultiFactorValidator, getSocialRecoveryValidator, getWebAuthnValidator, supportsEip712, } from '../modules/validators/core.js';
+import { getMultiFactorValidator, getValidator as getValidatorModule, getWebAuthnValidator, supportsEip712, } from '../modules/validators/core.js';
 import { buildPermit2ClaimPolicyCalldata, } from '../modules/validators/policies/claim/permit2.js';
-import { resolvePermit2ClaimPolicy, } from '../modules/validators/smart-sessions.js';
+import { resolvePermit2ClaimPolicy, selectPermit2ClaimPolicyForMessage, } from '../modules/validators/smart-sessions.js';
 import { getOrchestrator, } from '../orchestrator/index.js';
+import { isNonEvmChainId, toCaip2 } from '../orchestrator/caip2.js';
+import { getChainId, isNonEvmChain, } from '../orchestrator/destinations.js';
 import { getChainById, getTokenAddress, resolveTokenAddress, } from '../orchestrator/registry.js';
-import { SIG_MODE_EMISSARY_EXECUTION_ERC1271, SIG_MODE_ERC1271_EMISSARY, } from '../orchestrator/types.js';
+import { SIG_MODE_EMISSARY_EXECUTION_ERC1271, SIG_MODE_ERC1271, } from '../orchestrator/types.js';
 import { convertBigIntFields } from '../orchestrator/utils.js';
-import { Eip7702InitSignatureRequiredError, QuoteNotInPreparedTransactionError, SignerNotSupportedError, } from './error.js';
+import { Eip7702InitSignatureRequiredError, IndependentSigningNotSupportedError, InsufficientOwnerSignaturesError, InvalidOwnerSigningOptionsError, InvalidSourceCallsError, MismatchedOwnerSignaturesError, QuoteNotInPreparedTransactionError, UnknownOwnerError, } from './error.js';
 function isResolvedSessionSignerSet(signers) {
     return (signers?.type === 'experimental_session' && 'verifyExecutions' in signers);
 }
@@ -25,16 +27,61 @@ async function resolveSignersForChain(config, signers, chainId) {
     const resolved = resolveSessionForChain(signers, chainId);
     const enabled = await isSessionEnabled(getAddress(config), config.provider, resolved.session, config.useDevContracts);
     const enableData = enabled ? undefined : resolved.enableData;
-    const verifyExecutions = resolved.verifyExecutions ??
-        signers.verifyExecutions ??
-        resolved.session.hasExplicitPermissions;
     return {
         type: 'experimental_session',
         session: resolved.session,
         enableData,
-        verifyExecutions,
+        // First use of any session must go through the emissary's verifyExecution
+        // path: that's the only mechanism that consumes enableData + calls setConfig
+        // to install the session on-chain. Once installed, steady-state signing can
+        // drop to mode 1 unless the session has explicit permissions to enforce.
+        verifyExecutions: !enabled || resolved.session.hasExplicitPermissions,
     };
 }
+// Picks the single signature mode that matches the bytes shape the SDK will
+// actually sign, so the on-chain dispatcher hits the right validator on the
+// first try instead of falling through a hybrid.
+async function resolveSignatureMode(config, signers, sourceChains, targetChainId, 
+// Optional pre-resolved per-chain signer sets. When supplied, reuse them
+// instead of resolving again — each resolveSignersForChain does an
+// isSessionEnabled RPC, so sharing one map across mockSignatures, sigMode, and
+// preClaim avoids duplicate calls per intent. The map also defines *which*
+// chains carry a session: the caller omits a non-EVM target (it has no session
+// validator), so deriving the chain set from the map's keys keeps us from
+// resolving — and throwing on — a target with no configured session.
+preResolved) {
+    if (config.account?.type === 'eoa') {
+        return SIG_MODE_ERC1271;
+    }
+    if (signers?.type !== 'experimental_session') {
+        return SIG_MODE_ERC1271;
+    }
+    const chainIds = preResolved
+        ? [...preResolved.keys()]
+        : [...new Set([...(sourceChains ?? []).map((c) => c.id), targetChainId])];
+    const resolvedSet = await Promise.all(chainIds.map((chainId) => 
+    // Use has() not `?? resolve` so a cached `undefined` entry is still reused
+    // (get() can't distinguish "missing key" from "present but undefined").
+    preResolved?.has(chainId)
+        ? preResolved.get(chainId)
+        : resolveSignersForChain(config, signers, chainId)));
+    let anyVerifyExecutions = false;
+    for (const resolved of resolvedSet) {
+        if (!isResolvedSessionSignerSet(resolved)) {
+            return SIG_MODE_ERC1271;
+        }
+        // Conservative: one chain with verifyExecutions=true forces mode 5 across
+        // all origin signatures — a single mode field can't describe divergence.
+        if (resolved.verifyExecutions)
+            anyVerifyExecutions = true;
+    }
+    // Mode 4 (pure emissary-execution) is unused: signIntentTypedData always
+    // emits a dual sig for the intent's origin/destination signatures when
+    // verifyExecutions=true, so mode 5 is the right hybrid.
+    return anyVerifyExecutions
+        ? SIG_MODE_EMISSARY_EXECUTION_ERC1271
+        : SIG_MODE_ERC1271;
+}
 function resolveSessionForChain(signers, chainId) {
     if ('sessions' in signers) {
         const config = signers.sessions[chainId];
@@ -46,13 +93,23 @@ function resolveSessionForChain(signers, chainId) {
     return { session: signers.session, enableData: signers.enableData };
 }
 async function prepareTransaction(config, transaction) {
-    const { sourceChains, targetChain, tokenRequests, signers, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, recipient, } = getTransactionParams(transaction);
+    const { sourceChains, targetChain, tokenRequests, signers, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, appFees, account, recipient, sourceCalls, } = getTransactionParams(transaction);
     const accountAddress = getAddress(config);
-    const isUserOpSigner = signers?.type === 'guardians';
-    if (isUserOpSigner) {
-        throw new SignerNotSupportedError();
+    // Destination calls (transaction.calls on a cross-chain transaction) are
+    // executed on the destination chain by the solver/account. For non-EVM
+    // destinations we can't resolve arbitrary EVM calls; assert there are
+    // none and route an empty list through.
+    let resolvedCalls;
+    if (isNonEvmChain(targetChain)) {
+        if (transaction.calls && transaction.calls.length > 0) {
+            throw new Error(`Destination calls are not supported for non-EVM target chain ${targetChain.name} (${targetChain.caip2})`);
+        }
+        resolvedCalls = [];
     }
-    const prepared = await prepareTransactionAsIntent(config, sourceChains, targetChain, await resolveCallInputs(transaction.calls, config, targetChain, accountAddress), transaction.gasLimit, tokenRequests, recipient, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, signers);
+    else {
+        resolvedCalls = await resolveCallInputs(transaction.calls, config, targetChain, accountAddress);
+    }
+    const prepared = await prepareTransactionAsIntent(config, sourceChains, targetChain, resolvedCalls, transaction.gasLimit, tokenRequests, recipient, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, account, signers, sourceCalls, appFees);
     return {
         quotes: prepared.quotes,
         intentInput: prepared.intentInput,
@@ -96,6 +153,9 @@ function getTransactionMessages(_config, preparedTransaction, options) {
     return getIntentMessages(quote.signData);
 }
 async function signTransaction(config, preparedTransaction, options) {
+    if (options && 'owner' in options) {
+        return signTransactionAsOwner(config, preparedTransaction, options);
+    }
     const { signers } = getTransactionParams(preparedTransaction.transaction);
     const quote = resolveQuote(preparedTransaction.quotes, options);
     const targetChain = 'targetChain' in preparedTransaction.transaction
@@ -113,6 +173,349 @@ async function signTransaction(config, preparedTransaction, options) {
         targetExecutionSignature,
     };
 }
+function assertIndependentSigningSupported(config, preparedTransaction) {
+    if (config.account?.type === 'eoa') {
+        throw new IndependentSigningNotSupportedError({
+            context: { reason: 'eoa-account' },
+        });
+    }
+    const { signers } = getTransactionParams(preparedTransaction.transaction);
+    if (signers?.type === 'experimental_session') {
+        throw new IndependentSigningNotSupportedError({
+            context: { reason: 'smart-session' },
+        });
+    }
+    const validator = getOwnerValidator(config);
+    const selectedValidator = getValidator(config, signers);
+    if (!selectedValidator ||
+        selectedValidator.address.toLowerCase() !== validator.address.toLowerCase()) {
+        throw new IndependentSigningNotSupportedError({
+            context: { reason: 'non-owner-validator' },
+        });
+    }
+    if (validator.address.toLowerCase() ===
+        K1_DEFAULT_VALIDATOR_ADDRESS.toLowerCase()) {
+        throw new IndependentSigningNotSupportedError({
+            context: { reason: 'erc7739-validator' },
+        });
+    }
+    if (!config.owners) {
+        throw new IndependentSigningNotSupportedError({
+            context: { reason: 'missing-owner-set' },
+        });
+    }
+    return { owners: config.owners, signers, validator };
+}
+function getValidatorIdKey(id) {
+    if (typeof id === 'number' && (!Number.isSafeInteger(id) || id < 0)) {
+        return undefined;
+    }
+    try {
+        return pad(toHex(id), { size: 12 }).toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+function getMultiFactorOwnerFactors(owners, signers) {
+    if (signers?.type === 'owner' && signers.kind === 'multi-factor') {
+        return signers.validators.map((factor) => {
+            switch (factor.type) {
+                case 'ecdsa':
+                    return {
+                        id: factor.id,
+                        owners: {
+                            type: 'ecdsa',
+                            accounts: factor.accounts,
+                            threshold: factor.accounts.length,
+                        },
+                    };
+                case 'passkey':
+                    return {
+                        id: factor.id,
+                        owners: {
+                            type: 'passkey',
+                            accounts: factor.accounts,
+                            threshold: factor.accounts.length,
+                        },
+                    };
+            }
+        });
+    }
+    return owners.validators.map((factor, id) => ({ id, owners: factor }));
+}
+function resolveAtomicOwnerSet(owners, validatorId, signers) {
+    if (owners.type !== 'multi-factor') {
+        return validatorId === undefined ? { id: 0, owners } : undefined;
+    }
+    if (validatorId === undefined)
+        return undefined;
+    const key = getValidatorIdKey(validatorId);
+    if (!key)
+        return undefined;
+    return getMultiFactorOwnerFactors(owners, signers).find((factor) => getValidatorIdKey(factor.id) === key);
+}
+function getAtomicOwnerAccounts(owners) {
+    switch (owners.type) {
+        case 'ecdsa':
+        case 'passkey':
+            return owners.accounts;
+        case 'ens':
+            return owners.owners.map(({ account }) => account);
+    }
+}
+function getAtomicOwnerThreshold(owners) {
+    return owners.threshold ?? 1;
+}
+function isWebAuthnAccount(account) {
+    return account.type === 'webAuthn';
+}
+function getAccountIdentity(account) {
+    return isWebAuthnAccount(account)
+        ? account.publicKey.toLowerCase()
+        : account.address.toLowerCase();
+}
+function getAtomicSignatureIdentity(signature) {
+    return signature.kind === 'passkey'
+        ? signature.publicKey.toLowerCase()
+        : signature.signer.toLowerCase();
+}
+function isOwnerMember(owners, account) {
+    if ((owners.type === 'passkey') !== isWebAuthnAccount(account))
+        return false;
+    const identity = getAccountIdentity(account);
+    return getAtomicOwnerAccounts(owners).some((configured) => getAccountIdentity(configured) === identity);
+}
+async function signTransactionAsOwner(config, preparedTransaction, options) {
+    const { owners, signers } = assertIndependentSigningSupported(config, preparedTransaction);
+    const factor = resolveAtomicOwnerSet(owners, options.validatorId, signers);
+    if (!factor) {
+        throw new InvalidOwnerSigningOptionsError({
+            context: { validatorId: options.validatorId },
+        });
+    }
+    const atomicOwners = factor.owners;
+    if (!isOwnerMember(atomicOwners, options.owner)) {
+        throw new UnknownOwnerError({
+            context: {
+                ...(isWebAuthnAccount(options.owner)
+                    ? { publicKey: options.owner.publicKey }
+                    : { signer: options.owner.address }),
+                validatorId: options.validatorId,
+            },
+        });
+    }
+    const quote = resolveQuote(preparedTransaction.quotes, options.intentId === undefined ? undefined : { intentId: options.intentId });
+    const { origin } = getIntentMessages(quote.signData);
+    const atomicSigners = convertOwnerSetToSignerSet(atomicOwners);
+    if (atomicSigners.type !== 'owner' || atomicSigners.kind === 'multi-factor') {
+        throw new IndependentSigningNotSupportedError();
+    }
+    const validatorSupportsEip712 = supportsEip712(getValidatorModule(atomicOwners));
+    let signature;
+    if (atomicSigners.kind === 'ecdsa' && !isWebAuthnAccount(options.owner)) {
+        const signatures = [];
+        for (const typedData of origin) {
+            signatures.push(await getOwnerEcdsaSignature(config, getChainById(typedData.domain?.chainId), typedData, options.owner, atomicSigners.module, validatorSupportsEip712));
+        }
+        signature = {
+            kind: 'ecdsa',
+            signer: options.owner.address,
+            origin: signatures,
+        };
+    }
+    else if (atomicSigners.kind === 'passkey' &&
+        isWebAuthnAccount(options.owner)) {
+        const signatures = [];
+        for (const typedData of origin) {
+            signatures.push(await getOwnerPasskeySignature(config, typedData, options.owner, validatorSupportsEip712));
+        }
+        signature = {
+            kind: 'passkey',
+            publicKey: options.owner.publicKey,
+            origin: signatures,
+        };
+    }
+    else {
+        throw new UnknownOwnerError({
+            context: { validatorId: options.validatorId },
+        });
+    }
+    return owners.type === 'multi-factor'
+        ? {
+            intentId: quote.intentId,
+            kind: 'multi-factor',
+            validatorId: factor.id,
+            signature,
+        }
+        : { intentId: quote.intentId, ...signature };
+}
+function orderAtomicOwnerSignatures(owners, signatures, originCount, validatorId) {
+    const expectedKind = owners.type === 'passkey' ? 'passkey' : 'ecdsa';
+    const byIdentity = new Map();
+    const configuredIdentities = new Set(getAtomicOwnerAccounts(owners).map(getAccountIdentity));
+    for (const signature of signatures) {
+        if (signature.kind !== expectedKind ||
+            signature.origin.length !== originCount) {
+            throw new MismatchedOwnerSignaturesError({
+                context: {
+                    expectedKind,
+                    expectedOriginCount: originCount,
+                    validatorId,
+                },
+            });
+        }
+        const identity = getAtomicSignatureIdentity(signature);
+        if (!configuredIdentities.has(identity)) {
+            throw new UnknownOwnerError({
+                context: {
+                    ...(signature.kind === 'passkey'
+                        ? { publicKey: signature.publicKey }
+                        : { signer: signature.signer }),
+                    validatorId,
+                },
+            });
+        }
+        if (!byIdentity.has(identity))
+            byIdentity.set(identity, signature);
+    }
+    const ordered = [...configuredIdentities].flatMap((identity) => {
+        const signature = byIdentity.get(identity);
+        return signature ? [signature] : [];
+    });
+    const required = getAtomicOwnerThreshold(owners);
+    if (ordered.length < required) {
+        throw new InsufficientOwnerSignaturesError({
+            required,
+            provided: ordered.length,
+            validatorId,
+        });
+    }
+    return ordered;
+}
+function packAtomicOwnerSignatures(owners, signatures, originIndex, chain, accountAddress) {
+    const signers = convertOwnerSetToSignerSet(owners);
+    if (owners.type === 'passkey' &&
+        signers.type === 'owner' &&
+        signers.kind === 'passkey') {
+        const passkeySignatures = signatures.map((signature) => {
+            if (signature.kind !== 'passkey') {
+                throw new MismatchedOwnerSignaturesError();
+            }
+            return {
+                publicKey: signature.publicKey,
+                signature: signature.origin[originIndex],
+            };
+        });
+        return packPasskeyOwnerSignatures(chain, accountAddress, passkeySignatures.map(({ publicKey }) => publicKey), passkeySignatures.map(({ signature }) => signature), signers.module);
+    }
+    return concat(signatures.map((signature) => {
+        if (signature.kind !== 'ecdsa') {
+            throw new MismatchedOwnerSignaturesError();
+        }
+        return signature.origin[originIndex];
+    }));
+}
+async function assembleTransaction(config, preparedTransaction, signatures) {
+    const { owners, signers, validator } = assertIndependentSigningSupported(config, preparedTransaction);
+    if (signatures.length === 0) {
+        throw new InsufficientOwnerSignaturesError({
+            required: owners.threshold ?? 1,
+            provided: 0,
+        });
+    }
+    const intentIds = [...new Set(signatures.map(({ intentId }) => intentId))];
+    if (intentIds.length !== 1) {
+        throw new MismatchedOwnerSignaturesError({ context: { intentIds } });
+    }
+    const quote = resolveQuote(preparedTransaction.quotes, {
+        intentId: intentIds[0],
+    });
+    const { origin } = getIntentMessages(quote.signData);
+    const accountAddress = getAddress(config);
+    const validatorConfig = {
+        address: validator.address,
+        isRoot: true,
+    };
+    let directSignatures;
+    let factorSignatures;
+    if (owners.type === 'multi-factor') {
+        const factors = getMultiFactorOwnerFactors(owners, signers);
+        const factorsById = new Map(factors.flatMap((factor) => {
+            const key = getValidatorIdKey(factor.id);
+            return key ? [[key, factor]] : [];
+        }));
+        const grouped = new Map();
+        for (const signature of signatures) {
+            if (signature.kind !== 'multi-factor') {
+                throw new MismatchedOwnerSignaturesError({
+                    context: { expectedKind: 'multi-factor' },
+                });
+            }
+            const key = getValidatorIdKey(signature.validatorId);
+            if (!key || !factorsById.has(key)) {
+                throw new MismatchedOwnerSignaturesError({
+                    context: { validatorId: signature.validatorId },
+                });
+            }
+            const current = grouped.get(key) ?? [];
+            current.push(signature.signature);
+            grouped.set(key, current);
+        }
+        factorSignatures = factors.flatMap((factor) => {
+            const key = getValidatorIdKey(factor.id);
+            const groupedSignatures = key ? grouped.get(key) : undefined;
+            if (!groupedSignatures)
+                return [];
+            return [
+                {
+                    id: factor.id,
+                    owners: factor.owners,
+                    signatures: orderAtomicOwnerSignatures(factor.owners, groupedSignatures, origin.length, factor.id),
+                },
+            ];
+        });
+        const required = owners.threshold ?? 1;
+        if (factorSignatures.length < required) {
+            throw new InsufficientOwnerSignaturesError({
+                required,
+                provided: factorSignatures.length,
+            });
+        }
+    }
+    else {
+        directSignatures = orderAtomicOwnerSignatures(owners, signatures.map((signature) => {
+            if (signature.kind === 'multi-factor') {
+                throw new MismatchedOwnerSignaturesError({
+                    context: { expectedKind: owners.type },
+                });
+            }
+            const { intentId: _, ...atomicSignature } = signature;
+            return atomicSignature;
+        }), origin.length);
+    }
+    const originSignatures = [];
+    for (const [originIndex, typedData] of origin.entries()) {
+        const chain = getChainById(typedData.domain?.chainId);
+        const validatorSignature = factorSignatures
+            ? packMultiFactorOwnerSignatures(factorSignatures.map((factor) => ({
+                id: factor.id,
+                validatorAddress: getValidatorModule(factor.owners).address,
+                signature: packAtomicOwnerSignatures(factor.owners, factor.signatures, originIndex, chain, accountAddress),
+            })))
+            : packAtomicOwnerSignatures(owners, directSignatures, originIndex, chain, accountAddress);
+        originSignatures.push(await packAccountSignature(config, validatorSignature, validatorConfig));
+    }
+    return {
+        quote,
+        quotes: preparedTransaction.quotes,
+        intentInput: preparedTransaction.intentInput,
+        transaction: preparedTransaction.transaction,
+        originSignatures,
+        destinationSignature: originSignatures.at(-1) ?? '0x',
+        targetExecutionSignature: undefined,
+    };
+}
 function resolveQuote(quotes, options) {
     if (!options)
         return quotes.best;
@@ -131,6 +534,11 @@ async function getTargetExecutionSignature(config, signData, targetChain, signer
     if (!signData.targetExecution) {
         return undefined;
     }
+    // Target executions are EVM-only (smart-session validator on destination).
+    // Non-EVM destinations don't have a validator there to verify the sig.
+    if (isNonEvmChain(targetChain)) {
+        return undefined;
+    }
     const resolvedSigners = await resolveSignersForChain(config, signers, targetChain.id);
     if (!isResolvedSessionSignerSet(resolvedSigners) ||
         !resolvedSigners.verifyExecutions) {
@@ -266,10 +674,16 @@ async function signAuthorizationsInternal(config, context) {
     }
     const accountAddress = getAddress(config);
     const { contract: eip7702Contract } = getEip7702InitCall(config, eip7702InitSignature);
+    // EIP-7702 authorization is EVM-only — there's no contract to delegate
+    // to on Solana / Tron. Skip the destination chain entirely when it's
+    // non-EVM; source chains are always EVM by construction.
     const chains = new Map();
-    for (const chain of [...(context.sourceChains ?? []), context.targetChain]) {
+    for (const chain of context.sourceChains ?? []) {
         chains.set(chain.id, chain);
     }
+    if (!isNonEvmChain(context.targetChain)) {
+        chains.set(context.targetChain.id, context.targetChain);
+    }
     const authorizations = [];
     for (const chain of chains.values()) {
         const walletClient = createWalletClient({
@@ -314,10 +728,11 @@ function getTransactionParams(transaction) {
     const gasLimit = transaction.gasLimit;
     const settlementLayers = transaction.settlementLayers;
     const sourceAssets = transaction.sourceAssets;
-    const feeAsset = transaction.feeAsset;
     const auxiliaryFunds = transaction.auxiliaryFunds;
+    const appFees = transaction.appFees;
     const account = transaction.experimental_accountOverride;
     const recipient = transaction.recipient;
+    const sourceCalls = transaction.sourceCalls;
     const tokenRequests = getTokenRequests(targetChain, initialTokenRequests);
     return {
         sourceChains,
@@ -329,15 +744,23 @@ function getTransactionParams(transaction) {
         gasLimit,
         settlementLayers,
         sourceAssets,
-        feeAsset,
         auxiliaryFunds,
+        appFees,
         account,
         recipient,
+        sourceCalls,
     };
 }
 function getTokenRequests(targetChain, initialTokenRequests) {
-    if (initialTokenRequests) {
-        validateTokenSymbols(targetChain, initialTokenRequests.map((tokenRequest) => tokenRequest.address));
+    // Non-EVM destinations carry SPL mint / Tron T-prefixed addresses that
+    // aren't valid 0x-hex; skip symbol/EVM-address validation here and let
+    // the orchestrator validate per its own schema. EVM destinations keep
+    // the existing strict check so a typo on Optimism still fails fast.
+    if (initialTokenRequests && !isNonEvmChain(targetChain)) {
+        // Inside this branch targetChain is a viem `Chain`, which excludes the
+        // non-EVM transaction variant — token requests are EVM-typed here.
+        const evmRequests = initialTokenRequests;
+        validateTokenSymbols(targetChain, evmRequests.map((tokenRequest) => tokenRequest.address));
     }
     return initialTokenRequests ?? [];
 }
@@ -386,12 +809,46 @@ function getIntentAccount(config, eip7702InitSignature, account) {
         delegations,
     };
 }
-async function prepareTransactionAsIntent(config, sourceChains, targetChain, callInputs, gasLimit, tokenRequests, recipientInput, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, feeAsset, auxiliaryFunds, account, signers) {
-    const calls = parseCalls(callInputs, targetChain.id);
+function cloneAuxiliaryFunds(auxiliaryFunds) {
+    if (!auxiliaryFunds)
+        return undefined;
+    return Object.fromEntries(Object.entries(auxiliaryFunds).map(([chainId, funds]) => [
+        Number(chainId),
+        { ...funds },
+    ]));
+}
+function toCallInput(sourceCall) {
+    const { provides: _provides, ...call } = sourceCall;
+    return call;
+}
+function addProvidedFunds(auxiliaryFunds, chainId, calls) {
+    let next = auxiliaryFunds;
+    for (const call of calls) {
+        for (const provided of call.provides ?? []) {
+            next ??= {};
+            next[chainId] ??= {};
+            const token = provided.token;
+            next[chainId][token] = (next[chainId][token] ?? 0n) + provided.amount;
+        }
+    }
+    return next;
+}
+async function prepareTransactionAsIntent(config, sourceChains, targetChain, callInputs, gasLimit, tokenRequests, recipientInput, sponsored, eip7702InitSignature, settlementLayers, sourceAssets, auxiliaryFunds, account, signers, sourceCalls, appFees) {
+    const targetChainId = getChainId(targetChain);
+    const calls = parseCalls(callInputs, targetChainId);
     const accountAccessList = createAccountAccessList(sourceChains, sourceAssets);
     function getRecipient(recipient) {
         if (typeof recipient === 'string') {
-            // Passed as an address, assume it's an EOA
+            // Non-EVM-addressed recipients (Solana base58 / Tron T-prefix) carry no
+            // EVM smart-account semantics; the orchestrator schema requires
+            // accountType / setupOps to be unset. Emit just the address. HyperCore
+            // is EVM-addressed (eip155:1337) so it falls through to the EOA
+            // passthrough below — the orchestrator's HyperCore gate requires
+            // accountType: 'EOA'.
+            if (isNonEvmChainId(targetChainId)) {
+                return { address: recipient };
+            }
+            // EVM (and HyperCore) passthrough — assume EOA.
             return {
                 address: recipient,
                 accountType: 'EOA',
@@ -404,25 +861,65 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
         }
         return getIntentAccount(recipient, eip7702InitSignature, account);
     }
+    // Resolve per-chain signer state once (each resolveSignersForChain does an
+    // isSessionEnabled RPC) and reuse it for mock signatures, the signature mode,
+    // and preClaim ops. Exclude a non-EVM destination — it has no session
+    // validator, so resolving it would waste an RPC (or throw for per-chain
+    // session signers). resolveSignatureMode derives its chain set from this map's
+    // keys, so the excluded non-EVM target is never resolved there either.
+    const sessionChainIds = [
+        ...new Set([
+            ...(sourceChains ?? []).map((c) => c.id),
+            ...(isNonEvmChain(targetChain) ? [] : [targetChainId]),
+        ]),
+    ];
+    const resolvedByChain = signers?.type === 'experimental_session'
+        ? new Map(await Promise.all(sessionChainIds.map(async (chainId) => [
+            chainId,
+            await resolveSignersForChain(config, signers, chainId),
+        ])))
+        : undefined;
+    // Per-chain mock signatures: enables accurate per-chain session validation gas
+    // simulation. Non-EVM destinations are excluded — they have no destination-side
+    // session validator. Each chain's mock sig carries that chain's own resolved
+    // shape (ENABLE / USE / ERC-1271). Note these are per-chain and may differ in
+    // shape, whereas `signatureMode` (below) is a single global value resolved
+    // conservatively (anyVerifyExecutions across chains → mode 5) — so in mixed
+    // states a chain's mock shape need not match the global signatureMode.
+    let mockSignatures;
+    if (resolvedByChain) {
+        const entries = [...resolvedByChain.entries()].flatMap(([chainId, resolved]) => {
+            // resolvedByChain is keyed by sessionChainIds, which already excludes a
+            // non-EVM target — so no per-entry target guard is needed here.
+            if (!isResolvedSessionSignerSet(resolved))
+                return [];
+            // Match the mock shape to what the real sig will be: ERC-1271 when not
+            // verifying executions; otherwise ENABLE if the session still needs
+            // installing (enableData present), else USE (already enabled, e.g.
+            // explicit permissions — its real sig is MODE_USE with no enableData).
+            const shape = !resolved.verifyExecutions
+                ? 'erc1271'
+                : resolved.enableData !== undefined
+                    ? 'enable'
+                    : 'use';
+            return [
+                [
+                    String(chainId),
+                    buildMockSignature(resolved.session, config.useDevContracts, sourceChains?.length ?? 1, chainId, shape),
+                ],
+            ];
+        });
+        // Leave mockSignatures undefined (not {}) when there are no eligible chains,
+        // so downstream consumers can treat presence as "per-chain sigs provided".
+        if (entries.length > 0)
+            mockSignatures = Object.fromEntries(entries);
+    }
     const intentAccount = {
         ...getIntentAccount(config, eip7702InitSignature, account),
-        ...(signers?.type === 'experimental_session' && {
-            // Per-chain map: enables accurate per-chain session validation gas simulation
-            mockSignatures: Object.fromEntries([
-                ...new Set([
-                    ...(sourceChains ?? []).map((c) => c.id),
-                    targetChain.id,
-                ]),
-            ].map((chainId) => [
-                String(chainId),
-                buildMockSignature(resolveSessionForChain(signers, chainId).session, config.useDevContracts, sourceChains?.length ?? 1, chainId),
-            ])),
-        }),
+        ...(mockSignatures && { mockSignatures }),
     };
     const recipient = getRecipient(recipientInput);
-    const signatureMode = signers?.type === 'experimental_session'
-        ? SIG_MODE_EMISSARY_EXECUTION_ERC1271
-        : SIG_MODE_ERC1271_EMISSARY;
+    const signatureMode = await resolveSignatureMode(config, signers, sourceChains, targetChainId, resolvedByChain);
     // For session signers that need enabling, pass a dummy preclaimop per source chain
     // so the orchestrator bakes it into the bundle before computing its HMAC. The filler
     // executes the op via verifyExecution in ENABLE mode, enabling the session on-chain
@@ -430,11 +927,11 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
     // post-facto — because the orchestrator HMAC covers preClaimOps.
     const preClaimExecutions = {};
     if (signers?.type === 'experimental_session' && sourceChains) {
-        const resolvedPerChain = await Promise.all(sourceChains.map(async (chain) => ({
-            chainId: chain.id,
-            resolved: await resolveSignersForChain(config, signers, chain.id),
-        })));
-        for (const { chainId, resolved } of resolvedPerChain) {
+        // Reuse the shared per-chain resolution (source chains are a subset of
+        // sessionChainIds) instead of resolving — and re-doing isSessionEnabled — again.
+        for (const chain of sourceChains) {
+            const chainId = chain.id;
+            const resolved = resolvedByChain?.get(chainId);
             if (!isResolvedSessionSignerSet(resolved))
                 continue;
             const { enableData, verifyExecutions } = resolved;
@@ -449,10 +946,40 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
             ];
         }
     }
+    let combinedAuxiliaryFunds = cloneAuxiliaryFunds(auxiliaryFunds);
+    if (sourceCalls) {
+        const accountAddress = getAddress(config);
+        const allowedChainIds = new Set([
+            ...(sourceChains ?? []).map((c) => c.id),
+            ...(!isNonEvmChain(targetChain) ? [targetChainId] : []),
+        ]);
+        for (const [chainIdStr, calls] of Object.entries(sourceCalls)) {
+            const chainId = Number(chainIdStr);
+            if (!allowedChainIds.has(chainId)) {
+                throw new InvalidSourceCallsError({ chainId });
+            }
+            const chain = sourceChains?.find((c) => c.id === chainId) ??
+                (!isNonEvmChain(targetChain) && targetChainId === chainId
+                    ? targetChain
+                    : undefined);
+            if (!chain) {
+                throw new InvalidSourceCallsError({ chainId });
+            }
+            combinedAuxiliaryFunds = addProvidedFunds(combinedAuxiliaryFunds, chainId, calls);
+            const resolved = await resolveCallInputs(calls.map(toCallInput), config, chain, accountAddress);
+            const userExecutions = parseCalls(resolved, chainId);
+            if (userExecutions.length === 0)
+                continue;
+            preClaimExecutions[chainId] = [
+                ...(preClaimExecutions[chainId] ?? []),
+                ...userExecutions,
+            ];
+        }
+    }
     const metaIntent = {
-        destinationChainId: targetChain.id,
+        destinationChainId: targetChainId,
         tokenRequests: tokenRequests.map((tokenRequest) => ({
-            tokenAddress: resolveTokenAddress(tokenRequest.address, targetChain.id),
+            tokenAddress: resolveTokenAddress(tokenRequest.address, targetChainId),
             amount: tokenRequest.amount,
         })),
         recipient,
@@ -461,7 +988,6 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
         destinationGasUnits: gasLimit,
         accountAccessList,
         options: {
-            feeToken: feeAsset,
             sponsorSettings: sponsored
                 ? typeof sponsored === 'object'
                     ? {
@@ -477,19 +1003,20 @@ async function prepareTransactionAsIntent(config, sourceChains, targetChain, cal
                 : undefined,
             settlementLayers,
             signatureMode,
-            auxiliaryFunds,
+            auxiliaryFunds: combinedAuxiliaryFunds,
+            appFees,
         },
         ...(Object.keys(preClaimExecutions).length > 0 && { preClaimExecutions }),
     };
     const serializedIntent = convertBigIntFields(metaIntent);
     const orchestrator = getOrchestrator(config._authProvider ?? createAuthProvider(config), config.endpointUrl, config.headers);
-    const { routes } = await orchestrator.createQuote(metaIntent);
+    const { routes, traceId } = await orchestrator.createQuote(metaIntent);
     const best = routes[0];
     if (!best) {
         throw new Error('Orchestrator returned no quote');
     }
     return {
-        quotes: { best, all: routes },
+        quotes: { traceId, best, all: routes },
         intentInput: serializedIntent,
     };
 }
@@ -529,7 +1056,14 @@ async function signIntent(config, signData, targetChain, signers, targetExecutio
         const signature = await signIntentTypedData(config, originSigners, validator, isRoot, typedData, chain, targetExecution ?? false);
         originSignatures.push(signature);
     }
-    const destinationSigners = await resolveSignersForChain(config, signers, targetChain.id);
+    // Non-EVM destinations have no destination-side validator, so there's no
+    // session to resolve and no signer to derive. Skipping here matters for
+    // per-chain experimental sessions: `resolveSessionForChain` would throw
+    // `No session configured for chain {synthetic-id}` since users never
+    // configure a session keyed by the synthetic Solana/Tron chain id.
+    const destinationSigners = isNonEvmChain(targetChain)
+        ? undefined
+        : await resolveSignersForChain(config, signers, targetChain.id);
     const destinationSignature = await getDestinationSignature(config, destinationSigners, validator, isRoot, targetChain, destination, originSignatures, targetExecution ?? false);
     return {
         originSignatures,
@@ -537,18 +1071,25 @@ async function signIntent(config, signData, targetChain, signers, targetExecutio
     };
 }
 async function getDestinationSignature(config, signers, validator, isRoot, targetChain, destination, originSignatures, targetExecution) {
-    // Smart sessions require a separate destination signature because the
-    // session enable data differs per chain
-    if (signers?.type === 'experimental_session') {
-        return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
-    }
-    // ERC-7739 with K1 validator requires a separate destination signature because
-    // the account's eip712Domain() returns the target chain's chainId, which differs
-    // from the origin chain used for the last origin signature
-    const isK1Validator = validator.address.toLowerCase() ===
-        K1_DEFAULT_VALIDATOR_ADDRESS.toLowerCase();
-    if (isK1Validator && supportsEip712(validator)) {
-        return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+    // Non-EVM destinations have no destination-side validator, no
+    // eip712Domain(), no smart session enable data. Settlement is solver-
+    // mediated on the orchestrator side and the origin signatures alone
+    // authorize the bundle. Fall through to the "reuse last origin sig"
+    // branch instead of trying to sign on Solana / Tron.
+    if (!isNonEvmChain(targetChain)) {
+        // Smart sessions require a separate destination signature because the
+        // session enable data differs per chain
+        if (signers?.type === 'experimental_session') {
+            return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+        }
+        // ERC-7739 with K1 validator requires a separate destination signature because
+        // the account's eip712Domain() returns the target chain's chainId, which differs
+        // from the origin chain used for the last origin signature
+        const isK1Validator = validator.address.toLowerCase() ===
+            K1_DEFAULT_VALIDATOR_ADDRESS.toLowerCase();
+        if (isK1Validator && supportsEip712(validator)) {
+            return await signDestinationSeparately(config, signers, validator, isRoot, targetChain, destination, targetExecution);
+        }
     }
     const lastOriginSignature = originSignatures.at(-1);
     return typeof lastOriginSignature === 'object'
@@ -628,7 +1169,17 @@ function resolveClaimPolicyData(signers, parameters) {
         typeof msg.deadline !== 'bigint') {
         return undefined;
     }
-    return buildPermit2ClaimPolicyCalldata(resolvePermit2ClaimPolicy(signers.session.claimPolicies[0]), parameters.message);
+    const message = parameters.message;
+    // A session may carry several claim policies (a user policy plus one or
+    // more synthesized cross-chain permits). The on-chain emissary validates
+    // against the policy that matches this Permit2 message, and the calldata
+    // layout is policy-specific — so we must build it from the matching policy,
+    // not blindly `claimPolicies[0]`.
+    const claimPolicy = selectPermit2ClaimPolicyForMessage(signers.session.claimPolicies, message);
+    if (!claimPolicy) {
+        return undefined;
+    }
+    return buildPermit2ClaimPolicyCalldata(resolvePermit2ClaimPolicy(claimPolicy), message);
 }
 async function signIntentTypedData(config, signers, validator, isRoot, parameters, chain, targetExecution) {
     if (supportsEip712(validator)) {
@@ -757,7 +1308,7 @@ async function submitIntentInternal(config, sourceChains, targetChain, quote, or
         ...(authorizations.length > 0 && {
             authorizations: {
                 sponsor: authorizations.map((authorization) => ({
-                    chainId: authorization.chainId,
+                    chainId: toCaip2(authorization.chainId),
                     address: authorization.address,
                     nonce: authorization.nonce,
                     yParity: authorization.yParity ?? 0,
@@ -774,8 +1325,9 @@ async function submitIntentInternal(config, sourceChains, targetChain, quote, or
     return {
         type: 'intent',
         id: response.intentId,
+        traceId: response.traceId,
         sourceChains: sourceChains?.map((chain) => chain.id),
-        targetChain: targetChain.id,
+        targetChain: getChainId(targetChain),
     };
 }
 async function getValidatorAccount(config, signers, publicClient, chain) {
@@ -787,13 +1339,7 @@ async function getValidatorAccount(config, signers, publicClient, chain) {
     if (withOwner) {
         return getSmartAccount(config, publicClient, chain);
     }
-    const withGuardians = signers.type === 'guardians' ? signers : null;
-    return withGuardians
-        ? await getGuardianSmartAccount(config, publicClient, chain, {
-            type: 'ecdsa',
-            accounts: withGuardians.guardians,
-        })
-        : null;
+    return null;
 }
 function getValidator(config, signers) {
     if (!signers) {
@@ -812,11 +1358,11 @@ function getValidator(config, signers) {
             return getWebAuthnValidator(1, withOwner.accounts.map((account) => ({
                 pubKey: account.publicKey,
                 authenticatorId: account.id,
-            })));
+            })), withOwner.module);
         }
         // Multi-factor
         if (withOwner.kind === 'multi-factor') {
-            return getMultiFactorValidator(1, withOwner.validators);
+            return getMultiFactorValidator(1, withOwner.validators, withOwner.module);
         }
     }
     // Smart sessions
@@ -824,15 +1370,12 @@ function getValidator(config, signers) {
     if (withSession) {
         return getSmartSessionValidator(config);
     }
-    // Guardians (social recovery)
-    const withGuardians = signers.type === 'guardians' ? signers : null;
-    if (withGuardians) {
-        return getSocialRecoveryValidator(withGuardians.guardians);
-    }
     // Fallback
     return undefined;
 }
 function parseCalls(calls, chainId) {
+    // Destination calls only run on EVM chains (non-EVM destinations reject
+    // calls upstream), so the resolved `to` is always a viem `Address` here.
     return calls.map((call) => ({
         data: call.data ?? '0x',
         value: call.value ?? 0n,
@@ -852,6 +1395,8 @@ function createAccountAccessList(sourceChains, sourceAssets) {
             const chainTokenAmounts = {};
             for (const config of sourceAssets) {
                 const chainId = config.chain.id;
+                // Source assets live on viem `Chain`s, which are always EVM, so the
+                // resolved value is a viem `Address`.
                 const tokenAddress = resolveTokenAddress(config.address, config.chain.id);
                 if (config.amount !== undefined) {
                     if (!chainTokenAmounts[chainId])
@@ -999,7 +1544,9 @@ function hashErc7739TypedDataForSolady({ domain, types, primaryType, message, ve
         deps.delete(primary);
         const sorted = [primary, ...Array.from(deps).sort()];
         return sorted
-            .map((t) => `${t}(${allTypes[t].map((f) => `${f.type} ${f.name}`).join(',')})`)
+            .map((t) => `${t}(${allTypes[t]
+            .map((f) => `${f.type} ${f.name}`)
+            .join(',')})`)
             .join('');
     }
     const contentsType = encodeTypeString(primaryType, types);
@@ -1051,4 +1598,4 @@ function hashErc7739TypedDataForSolady({ domain, types, primaryType, message, ve
     // Final hash: keccak256("\x19\x01" || appDomainSep || structHash)
     return keccak256(concat(['0x1901', appDomainSeparator, structHash]));
 }
-export { prepareTransaction, getTransactionMessages, signTransaction, signAuthorizations, signAuthorizationsInternal, signMessage, signTypedData, submitTransaction, prepareUserOperation, signUserOperation, submitUserOperation, signIntent, prepareTransactionAsIntent, submitIntentInternal, getValidatorAccount, parseCalls, getTokenRequests, resolveCallInputs, getIntentAccount, getTargetExecutionSignature, hashErc7739TypedDataForSolady, resolveSessionForChain, };
+export { prepareTransaction, getTransactionMessages, signTransaction, assembleTransaction, signAuthorizations, signAuthorizationsInternal, signMessage, signTypedData, submitTransaction, prepareUserOperation, signUserOperation, submitUserOperation, signIntent, prepareTransactionAsIntent, submitIntentInternal, getValidatorAccount, parseCalls, getTokenRequests, resolveCallInputs, getIntentAccount, getTargetExecutionSignature, hashErc7739TypedDataForSolady, resolveSessionForChain, resolveSignatureMode, };