@rhinestone/sdk 2.0.0-beta.9 → 2.1.0

package/dist/src/actions/recovery.js

@@ -1,189 +1,134 @@
-import { createPublicClient, } from 'viem';
-import { getModuleInstallationCalls } from '../accounts/index.js';
-import { createTransport } from '../accounts/json-rpc/index.js';
-import { resolveCallInputs } from '../execution/utils.js';
-import { getSocialRecoveryValidator, OWNABLE_VALIDATOR_ADDRESS, WEBAUTHN_VALIDATOR_ADDRESS, } from '../modules/validators/core.js';
-import { addOwner, changeThreshold, removeOwner } from './ecdsa.js';
-import { addOwner as addPasskeyOwner, changeThreshold as changePasskeyThreshold, removeOwner as removePasskeyOwner, } from './passkeys.js';
+import { isAddressEqual } from 'viem';
+import { OWNABLE_VALIDATOR_ADDRESS } from '../modules/validators/ownable.js';
+import { resolveSocialRecoveryValidator } from '../modules/validators/social-recovery.js';
+import { parseWebauthnPublicKey, WEBAUTHN_VALIDATOR_ADDRESS, } from '../modules/validators/webauthn.js';
+import { addOwnableOwner, changeOwnableThreshold, removeOwnableOwner, } from './ownable.js';
+import { readOwnershipFor, readThresholdFor, resolveValidatorInstallation, } from './runtime.js';
+import { addWebauthnCredential, changeWebauthnThreshold, removeWebauthnCredential, } from './webauthn.js';
+/** Sentinel head of the validator's owner linked list. */
+const SENTINEL_OWNER = '0x0000000000000000000000000000000000000001';
 /**
- * Set up social recovery
- * @param guardians Guardians to use for recovery
- * @param threshold Threshold for the guardians
- * @returns Calls to set up social recovery
+ * Set up social recovery.
+ *
+ * @param guardians Guardians permitted to recover the account
+ * @param threshold Guardian signatures required to recover
+ * @returns Calls to install the social recovery validator
  */
 function enable(guardians, threshold = 1) {
-    const module = getSocialRecoveryValidator(guardians, threshold);
+    const module = resolveSocialRecoveryValidator({
+        guardians: guardians.map((guardian) => guardian.address),
+        threshold,
+    });
     return {
-        async resolve({ config }) {
-            return getModuleInstallationCalls(config, module);
+        async resolve(context) {
+            return resolveValidatorInstallation(context, module);
         },
     };
 }
 /**
- * Recover an account's ownership (ECDSA)
- * @param address Account address
- * @param newOwners New owners
- * @param chain Chain to recover ownership on
- * @param provider Provider to use for the recovery
- * @returns Calls to recover ownership
+ * Build the calls that rotate an account's ECDSA ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous owners stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
  */
-async function recoverEcdsaOwnership(address, newOwners, chain, config) {
-    const publicClient = createPublicClient({
-        chain,
-        transport: createTransport(chain, config.provider),
-    });
-    // Read the existing config
-    const results = await publicClient.multicall({
-        contracts: [
-            {
-                address: OWNABLE_VALIDATOR_ADDRESS,
-                abi: [
-                    {
-                        inputs: [
-                            { internalType: 'address', name: 'account', type: 'address' },
-                        ],
-                        name: 'getOwners',
-                        outputs: [
-                            {
-                                internalType: 'address[]',
-                                name: 'ownersArray',
-                                type: 'address[]',
-                            },
-                        ],
-                        stateMutability: 'view',
-                        type: 'function',
-                    },
-                ],
-                functionName: 'getOwners',
-                args: [address],
-            },
-            {
-                address: OWNABLE_VALIDATOR_ADDRESS,
-                abi: [
-                    {
-                        inputs: [
-                            { internalType: 'address', name: 'account', type: 'address' },
-                        ],
-                        name: 'threshold',
-                        outputs: [{ internalType: 'uint256', name: '', type: 'uint256' }],
-                        stateMutability: 'view',
-                        type: 'function',
-                    },
-                ],
-                functionName: 'threshold',
-                args: [address],
-            },
-        ],
-    });
-    const existingOwnersResult = results[0];
-    const existingThresholdResult = results[1];
-    if (existingOwnersResult.error || existingThresholdResult.error) {
-        throw new Error('Failed to read existing owners or threshold');
+async function recoverEcdsaOwnership(options) {
+    const configuredValidator = options.config.owners?.type === 'ecdsa'
+        ? (options.config.owners.module ?? OWNABLE_VALIDATOR_ADDRESS)
+        : undefined;
+    const requestedValidator = options.newOwners.module;
+    if (configuredValidator &&
+        requestedValidator &&
+        !isAddressEqual(configuredValidator, requestedValidator)) {
+        throw new Error('Recovery owner validator must match the configured owner validator');
     }
-    const existingOwners = existingOwnersResult.result;
-    const existingThreshold = existingThresholdResult.result;
-    const normalizedExistingOwners = existingOwners.map((owner) => owner.toLowerCase());
-    const callInputs = [];
-    // Convert new owners config to addresses and threshold
-    const newOwnerAddresses = newOwners.accounts
+    const validator = configuredValidator ?? requestedValidator ?? OWNABLE_VALIDATOR_ADDRESS;
+    const existing = await readOwnershipFor(options, options.accountAddress, validator);
+    const newOwners = options.newOwners.accounts
         .map((account) => account.address.toLowerCase())
         .sort();
-    const newThreshold = newOwners.threshold ?? 1;
-    // Check if threshold needs to be updated
-    if (Number(existingThreshold) !== newThreshold) {
-        callInputs.push(changeThreshold(newThreshold));
-    }
-    const ownersToAdd = newOwnerAddresses.filter((owner) => !normalizedExistingOwners.includes(owner));
-    const ownersToRemove = normalizedExistingOwners.filter((owner) => !newOwnerAddresses.includes(owner));
-    // Maintain the list as making changes to keep track of the previous owner for removals
-    // Note: new owners are added to the START of the linked list
-    let currentOwners = [...normalizedExistingOwners];
+    const newThreshold = options.newOwners.threshold ?? 1;
+    const ownersToAdd = newOwners.filter((owner) => !existing.owners.includes(owner));
+    const ownersToRemove = existing.owners.filter((owner) => !newOwners.includes(owner));
+    const calls = [];
+    // Additions run first so the owner count already covers the new threshold:
+    // `setThreshold` reverts while `ownerCount < threshold`. Removals run last
+    // for the same reason, since `removeOwner` reverts once the count would drop
+    // to the threshold.
+    let currentOwners = [...existing.owners];
     for (const owner of ownersToAdd) {
-        callInputs.push(addOwner(owner));
+        calls.push(addOwnableOwner(validator, owner));
+        // The validator pushes new owners onto the front of the linked list.
         currentOwners.unshift(owner);
     }
-    for (const ownerToRemove of ownersToRemove) {
-        const ownerIndex = currentOwners.indexOf(ownerToRemove);
-        let prevOwner;
-        if (ownerIndex === 0) {
-            // If it's the first owner, use the sentinel address
-            prevOwner = '0x0000000000000000000000000000000000000001';
-        }
-        else {
-            prevOwner = currentOwners[ownerIndex - 1];
-        }
-        callInputs.push(removeOwner(prevOwner, ownerToRemove));
-        currentOwners = currentOwners.filter((owner) => owner !== ownerToRemove);
+    if (existing.threshold !== newThreshold) {
+        calls.push(changeOwnableThreshold(validator, newThreshold));
+    }
+    for (const owner of ownersToRemove) {
+        const index = currentOwners.indexOf(owner);
+        const prevOwner = index <= 0 ? SENTINEL_OWNER : currentOwners[index - 1];
+        calls.push(removeOwnableOwner(validator, prevOwner, owner));
+        currentOwners = currentOwners.filter((entry) => entry !== owner);
     }
-    const calls = await resolveCallInputs(callInputs, config, chain, address);
     return calls;
 }
 /**
- * Recover an account's ownership (Passkey)
- * @param address Account address
- * @param oldCredentials Old credentials to be replaced (with pubKeyX, pubKeyY)
- * @param newOwners New passkey owners
- * @param chain Chain to recover ownership on
- * @param provider Provider to use for the recovery
- * @returns Calls to recover ownership
+ * Build the calls that rotate an account's passkey ownership.
+ *
+ * Send each returned call as its own UserOperation, in order: the social
+ * recovery validator authorizes a single `execute` per UserOperation, so
+ * batching them is rejected onchain.
+ *
+ * Ownership is only fully rotated once every call has landed. Until the
+ * removals execute the previous credentials stay valid alongside the new ones.
+ *
+ * @returns Calls to recover ownership, in the order they must be sent
  */
-async function recoverPasskeyOwnership(address, oldCredentials, newOwners, chain, config) {
-    const publicClient = createPublicClient({
-        chain,
-        transport: createTransport(chain, config.provider),
-    });
-    const existingThreshold = await publicClient.readContract({
-        address: WEBAUTHN_VALIDATOR_ADDRESS,
-        abi: [
-            {
-                inputs: [{ internalType: 'address', name: 'account', type: 'address' }],
-                name: 'threshold',
-                outputs: [{ internalType: 'uint256', name: '', type: 'uint256' }],
-                stateMutability: 'view',
-                type: 'function',
-            },
-        ],
-        functionName: 'threshold',
-        args: [address],
-    });
-    const callInputs = [];
-    // Convert new owners config to credentials and threshold
-    const newCredentials = newOwners.accounts.map((account) => {
-        const publicKey = account.publicKey;
-        // Parse the public key hex string to extract x and y coordinates
-        const publicKeyBytes = publicKey.startsWith('0x')
-            ? publicKey.slice(2)
-            : publicKey;
-        // The public key is 64 bytes: 32 bytes for x, 32 bytes for y
-        const x = BigInt(`0x${publicKeyBytes.slice(0, 64)}`);
-        const y = BigInt(`0x${publicKeyBytes.slice(64, 128)}`);
-        return {
-            pubKeyX: x,
-            pubKeyY: y,
-            requireUV: false, // Default to false for now
-        };
+async function recoverPasskeyOwnership(options) {
+    const configuredValidator = options.config.owners?.type === 'passkey'
+        ? (options.config.owners.module ?? WEBAUTHN_VALIDATOR_ADDRESS)
+        : undefined;
+    const requestedValidator = options.newOwners.module;
+    if (configuredValidator &&
+        requestedValidator &&
+        !isAddressEqual(configuredValidator, requestedValidator)) {
+        throw new Error('Recovery owner validator must match the configured owner validator');
+    }
+    const validator = configuredValidator ?? requestedValidator ?? WEBAUTHN_VALIDATOR_ADDRESS;
+    const existingThreshold = await readThresholdFor(options, options.accountAddress, validator);
+    const newCredentials = options.newOwners.accounts.map((account) => {
+        // Must go through the shared parser: uncompressed SEC1 keys are 65 bytes
+        // with an 0x04 prefix, and slicing from byte 0 shifts both coordinates.
+        const { x, y } = parseWebauthnPublicKey(account.publicKey);
+        return { pubKeyX: x, pubKeyY: y, requireUV: false };
     });
-    const newThreshold = newOwners.threshold ?? 1;
-    // Check if threshold needs to be updated
-    if (Number(existingThreshold) !== newThreshold) {
-        callInputs.push(changePasskeyThreshold(newThreshold));
+    const newThreshold = options.newOwners.threshold ?? 1;
+    const currentKeys = options.currentCredentials.map(credentialKey);
+    const newKeys = newCredentials.map(credentialKey);
+    const credentialsToAdd = newCredentials.filter((credential) => !currentKeys.includes(credentialKey(credential)));
+    const credentialsToRemove = options.currentCredentials.filter((credential) => !newKeys.includes(credentialKey(credential)));
+    const calls = [];
+    // Additions run first so the credential count already covers the new
+    // threshold: `setThreshold` reverts while `credentials < threshold`, and
+    // `removeCredential` reverts once the count would reach the threshold.
+    // Rotating the sole credential of a 1-of-1 account is impossible otherwise.
+    for (const credential of credentialsToAdd) {
+        calls.push(addWebauthnCredential(validator, credential.pubKeyX, credential.pubKeyY, credential.requireUV));
     }
-    // Compare existing and new credentials to determine what to add/remove
-    const existingCredentialKeys = oldCredentials.map((cred) => `${cred.pubKeyX.toString()}-${cred.pubKeyY.toString()}`);
-    const newCredentialKeys = newCredentials.map((cred) => `${cred.pubKeyX.toString()}-${cred.pubKeyY.toString()}`);
-    // Find credentials to add (new ones not in existing)
-    const credentialsToAdd = newCredentials.filter((cred) => !existingCredentialKeys.includes(`${cred.pubKeyX.toString()}-${cred.pubKeyY.toString()}`));
-    // Find credentials to remove (existing ones not in new)
-    const credentialsToRemove = oldCredentials.filter((cred) => !newCredentialKeys.includes(`${cred.pubKeyX.toString()}-${cred.pubKeyY.toString()}`));
-    // Remove old credentials first (important for security in recovery scenarios)
-    for (const credential of credentialsToRemove) {
-        callInputs.push(removePasskeyOwner(credential.pubKeyX, credential.pubKeyY));
+    if (existingThreshold !== newThreshold) {
+        calls.push(changeWebauthnThreshold(validator, newThreshold));
     }
-    // Then add new credentials
-    for (const credential of credentialsToAdd) {
-        callInputs.push(addPasskeyOwner(credential.pubKeyX, credential.pubKeyY, credential.requireUV));
+    for (const credential of credentialsToRemove) {
+        calls.push(removeWebauthnCredential(validator, credential.pubKeyX, credential.pubKeyY));
     }
-    const calls = await resolveCallInputs(callInputs, config, chain, address);
     return calls;
 }
+function credentialKey(credential) {
+    return `${credential.pubKeyX}-${credential.pubKeyY}`;
+}
 export { enable, recoverEcdsaOwnership, recoverPasskeyOwnership };

package/dist/src/actions/runtime.d.ts

@@ -0,0 +1,17 @@
+import type { CalldataInput, CallResolveContext, Session } from '../config/account.js';
+import type { ResolvedModule } from '../modules/types.js';
+export declare function readOwnershipFor(context: CallResolveContext, account: `0x${string}`, validator: `0x${string}`): Promise<{
+    readonly owners: readonly `0x${string}`[];
+    threshold: number;
+}>;
+export declare function readThresholdFor(context: CallResolveContext, account: `0x${string}`, validator: `0x${string}`): Promise<number>;
+export declare function resolveValidatorInstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;
+export declare function resolveModuleInstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;
+export declare function resolveModuleUninstallation(context: CallResolveContext, module: ResolvedModule): Promise<CalldataInput[]>;
+export declare function resolveSessionDisable(input: {
+    readonly context: CallResolveContext;
+    readonly account: `0x${string}`;
+    readonly session: Session;
+    readonly expires?: Date;
+}): Promise<CalldataInput>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/src/actions/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../actions/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,OAAO,EACR,MAAM,mBAAmB,CAAA;AAU1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAyEtD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,SAAS,EAAE,KAAK,MAAM,EAAE,GACvB,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3E;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,SAAS,EAAE,KAAK,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA4C1B;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAM1B;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA2B1B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CACxB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBzB"}

package/dist/src/actions/runtime.js

@@ -0,0 +1,182 @@
+import { encodeFunctionData, maxUint256, size } from 'viem';
+import { createAccountConstruction } from '../accounts/construction.js';
+import { DefaultValidatorAlreadyInitializedError } from '../accounts/error.js';
+import { createAccountAdapter } from '../accounts/registry.js';
+import { materializeRpcReader } from '../clients/rpc/compatibility.js';
+import { resolveStandaloneAccountConfig } from '../config/resolve.js';
+import { assertAccountOwnersConfigured } from '../config/validate.js';
+import { encodeAccountModuleDeInitData, readInstalledModules, readValidatorInitialized, readValidatorOwnership, readValidatorThreshold, } from '../modules/read-core.js';
+import { OWNABLE_VALIDATOR_ADDRESS } from '../modules/validators/ownable.js';
+import { SESSION_LOCK_TAG } from '../modules/validators/smart-sessions/authorization.js';
+import { encodeDisableSessionCall } from '../modules/validators/smart-sessions/calls.js';
+import { readSessionNonce } from '../modules/validators/smart-sessions/state.js';
+function actionContext(context) {
+    const resolved = resolveStandaloneAccountConfig(context.config, 'current-v2');
+    assertAccountOwnersConfigured(resolved);
+    const module = resolved.sessions.module.source === 'explicit'
+        ? resolved.sessions.module.address
+        : undefined;
+    const compatibilityFallback = resolved.sessions.compatibilityFallback.source === 'explicit'
+        ? resolved.sessions.compatibilityFallback.address
+        : undefined;
+    const chain = {
+        kind: 'evm',
+        id: context.chain.id,
+        caip2: `eip155:${context.chain.id}`,
+    };
+    const construction = createAccountConstruction({
+        material: {
+            account: resolved.account,
+            ...(resolved.owners ? { owner: resolved.owners } : {}),
+            modules: resolved.modules,
+            ...(resolved.initData ? { initData: resolved.initData } : {}),
+            ...(resolved.eoa ? { eoa: resolved.eoa } : {}),
+            sessions: {
+                enabled: resolved.sessions.enabled,
+                environment: context.config.useDevContracts === true
+                    ? 'development'
+                    : 'production',
+                ...(module ? { module } : {}),
+                ...(compatibilityFallback ? { compatibilityFallback } : {}),
+            },
+        },
+        chain,
+        deployed: false,
+    });
+    const adapter = createAccountAdapter(construction);
+    return {
+        resolved,
+        construction,
+        adapter,
+        address: adapter.getIdentity(construction).address,
+    };
+}
+function calls(target, encoded) {
+    return encoded.map((data) => ({ to: target, value: 0n, data }));
+}
+function defaultValidatorConfigured(context, validator) {
+    return (!context.resolved.initData &&
+        context.construction.setup.validators.some((module) => module.address.toLowerCase() === validator.toLowerCase() &&
+            size(module.initData) > 0));
+}
+export async function readOwnershipFor(context, account, validator) {
+    const reader = materializeRpcReader({
+        chain: context.chain,
+        provider: context.config.provider,
+    });
+    return readValidatorOwnership({
+        rpc: reader.rpc,
+        chain: reader.chain,
+        account,
+        validator,
+    });
+}
+export async function readThresholdFor(context, account, validator) {
+    const reader = materializeRpcReader({
+        chain: context.chain,
+        provider: context.config.provider,
+    });
+    return readValidatorThreshold({
+        rpc: reader.rpc,
+        chain: reader.chain,
+        account,
+        validator,
+    });
+}
+export async function resolveValidatorInstallation(context, module) {
+    const runtime = actionContext(context);
+    if (runtime.construction.account.kind === 'nexus') {
+        const defaultValidator = OWNABLE_VALIDATOR_ADDRESS;
+        if (module.address.toLowerCase() === defaultValidator.toLowerCase()) {
+            let initialized = defaultValidatorConfigured(runtime, defaultValidator);
+            if (!initialized) {
+                const reader = materializeRpcReader({
+                    chain: context.chain,
+                    provider: context.config.provider,
+                });
+                initialized = await readValidatorInitialized({
+                    rpc: reader.rpc,
+                    chain: reader.chain,
+                    account: runtime.address,
+                    validator: defaultValidator,
+                });
+            }
+            if (initialized)
+                throw new DefaultValidatorAlreadyInitializedError();
+            return [
+                {
+                    to: defaultValidator,
+                    value: 0n,
+                    data: encodeFunctionData({
+                        abi: [
+                            {
+                                type: 'function',
+                                name: 'onInstall',
+                                inputs: [{ type: 'bytes', name: 'data' }],
+                                outputs: [],
+                                stateMutability: 'nonpayable',
+                            },
+                        ],
+                        functionName: 'onInstall',
+                        args: [module.initData],
+                    }),
+                },
+            ];
+        }
+    }
+    return calls(runtime.address, runtime.adapter.encodeModuleInstallation(module));
+}
+export async function resolveModuleInstallation(context, module) {
+    const runtime = actionContext(context);
+    return calls(runtime.address, runtime.adapter.encodeModuleInstallation(module));
+}
+export async function resolveModuleUninstallation(context, module) {
+    const runtime = actionContext(context);
+    let deInitData = module.deInitData;
+    if (module.kind === 'validator' &&
+        ['nexus', 'safe', 'startale'].includes(runtime.construction.account.kind)) {
+        const reader = materializeRpcReader({
+            chain: context.chain,
+            provider: context.config.provider,
+        });
+        const installed = await readInstalledModules({
+            rpc: reader.rpc,
+            chain: reader.chain,
+            accountKind: runtime.construction.account.kind,
+            account: runtime.address,
+            kind: 'validator',
+        });
+        deInitData = encodeAccountModuleDeInitData({
+            accountKind: runtime.construction.account.kind,
+            module,
+            installed,
+        });
+    }
+    return calls(runtime.address, [
+        runtime.adapter.encodeModuleUninstallation({ ...module, deInitData }),
+    ]);
+}
+export async function resolveSessionDisable(input) {
+    const reader = materializeRpcReader({
+        chain: input.session.chain,
+        provider: input.context.config.provider,
+    });
+    const runtimeEnvironment = input.context.config.useDevContracts === true ? 'development' : 'production';
+    const nonce = await readSessionNonce({
+        rpc: reader.rpc,
+        chain: reader.chain,
+        account: input.account,
+        lockTag: SESSION_LOCK_TAG,
+        environment: runtimeEnvironment,
+    });
+    const call = encodeDisableSessionCall({
+        account: input.account,
+        session: input.session,
+        expires: input.expires
+            ? BigInt(Math.floor(input.expires.getTime() / 1000))
+            : maxUint256,
+        nonce,
+        environment: runtimeEnvironment,
+    });
+    return { to: call.target, value: call.value, data: call.data };
+}

package/dist/src/actions/smart-sessions.d.ts

@@ -1,23 +1,47 @@
 import type { Hex } from 'viem';
-import type { LazyCallInput, SessionInput } from '../types.js';
+import type { LazyCallInput, Session } from '../config/account.js';
 /**
  * Enable smart sessions
  * @returns Calls to enable smart sessions
  */
-declare function experimental_enable(): LazyCallInput;
+declare function enable(): LazyCallInput;
 /**
  * Disable smart sessions
  * @returns Calls to disable smart sessions
  */
-declare function experimental_disable(): LazyCallInput;
+declare function disable(): LazyCallInput;
 /**
  * Enable a smart session
- * @param session session to enable
+ *
+ * The `session` must be a resolved `Session` (the return value of
+ * `toSession(...)`). Re-resolving it here would drop the explicit
+ * `permissions` — a `Session` only carries the derived `actions`, not the
+ * original `SessionDefinition.permissions` — which makes the on-chain digest
+ * computed by `SmartSessionLens.getAndVerifyDigest` diverge from the one
+ * signed in `getSessionDetails`, causing the emissary to reject the enable.
+ *
+ * @param session resolved session to enable
  * @returns Calls to enable the smart session
  */
-declare function experimental_enableSession(session: SessionInput, enableSessionSignature: Hex, hashesAndChainIds: {
+declare function enableSession(session: Session, enableSessionSignature: Hex, hashesAndChainIds: {
     chainId: bigint;
     sessionDigest: Hex;
 }[], sessionToEnableIndex: number): LazyCallInput;
-export { experimental_disable, experimental_enable, experimental_enableSession };
+/**
+ * Disable a smart session
+ *
+ * Removes a single session from the smart-session emissary via `removeConfig`.
+ * The account executes the call itself, so the emissary skips the disable
+ * user-signature — the user authorizes it by signing the outer transaction as
+ * usual (no separate, blind session-digest signature). The `session` must be a
+ * resolved `Session` (the return value of `toSession(...)`) on the chain where
+ * the session is being disabled.
+ *
+ * @param session resolved session to disable
+ * @param expires optional deadline after which this disable call is no longer
+ *   valid; must be in the future. Omit for no expiry.
+ * @returns Calls to disable the smart session
+ */
+declare function disableSession(session: Session, expires?: Date): LazyCallInput;
+export { disable, disableSession, enable, enableSession };
 //# sourceMappingURL=smart-sessions.d.ts.map

package/dist/src/actions/smart-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smart-sessions.d.ts","sourceRoot":"","sources":["../../../actions/smart-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAU/B,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;GAGG;AACH,iBAAS,mBAAmB,IAAI,aAAa,CAU5C;AAED;;;GAGG;AACH,iBAAS,oBAAoB,IAAI,aAAa,CAU7C;AAED;;;;GAIG;AACH,iBAAS,0BAA0B,CACjC,OAAO,EAAE,YAAY,EACrB,sBAAsB,EAAE,GAAG,EAC3B,iBAAiB,EAAE;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB,EAAE,EACH,oBAAoB,EAAE,MAAM,GAC3B,aAAa,CAmBf;AAED,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,CAAA"}
+{"version":3,"file":"smart-sessions.d.ts","sourceRoot":"","sources":["../../../actions/smart-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAwB/D;;;GAGG;AACH,iBAAS,MAAM,IAAI,aAAa,CAU/B;AAED;;;GAGG;AACH,iBAAS,OAAO,IAAI,aAAa,CAUhC;AAED;;;;;;;;;;;;GAYG;AACH,iBAAS,aAAa,CACpB,OAAO,EAAE,OAAO,EAChB,sBAAsB,EAAE,GAAG,EAC3B,iBAAiB,EAAE;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,GAAG,CAAA;CACnB,EAAE,EACH,oBAAoB,EAAE,MAAM,GAC3B,aAAa,CAcf;AAED;;;;;;;;;;;;;;GAcG;AACH,iBAAS,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG,aAAa,CAWvE;AAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA"}