@seedprotocol/publish 0.6.7 → 0.6.8

package/CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- **List-of-relation EAS names:** a list relation such as `staff` (List → Identity) was attested as `bytes32[] staff` or `bytes32[] staff_identity_ids` depending on whether the model was loaded before the item. `getPublishPayload` and `ensureEasSchemasForItem` now derive the name from the property definition with `listRelationEasPropertyName` (exported from `@seedprotocol/sdk`) and ignore a cached `schemaUid` for list relations. `ensureEasSchemasForItem` refuses to register a list-relation schema that doesn't end in `_ids`. Locally, `createMetadata` writes list-relation rows under the storage name (`staffIdentityIds`), and an `ItemProperty` that receives its schema after construction moves to the storage name while `propertyName` stays `staff`. Already-published data (`author_identity_ids` and the like) is unchanged.
+- **Missing property schemas fail publish validation:** when a property's EAS schema can't be found, `getPublishPayload` now reports `publish_schema_not_found` instead of attesting the value under the Version schema. Call `ensureEasSchemasForItem` first, as the publish flow already does.
+- **`parseEasRelationPropertyName`** (`@seedprotocol/query`) pluralizes list names with `pluralize`: `staff_identity_ids` → `staff` (was `staffs`). Single relations return the singular (`cover_image_id` → `cover`).
+- **Failed UserOps on the permissionless / EIP-7702 sender:** a UserOp that failed inside a successful bundle transaction was returned as a success, so publish went on with no attestations. It now throws with the decoded revert reason.
+- **Readable publish failures:** every publish route now simulates `multiPublish` from the sending account before sending, and a call that would revert throws `PUBLISH_PREFLIGHT_FAILED` with the decoded Seed, EAS or `Error(string)` reason (automation keeps `AUTOMATION_PREFLIGHT_FAILED`). Outside automation, a simulation that can't run doesn't block the send. thirdweb's bare `UserOp failed at txHash: 0x…` (usually out of gas) and its undecodable custom-error message are rewritten to say what happened, as `ManagedAccountPublishError` with code `USEROP_FAILED_NO_REASON` (no revert reason; usually out of gas) or `USEROP_REVERTED`, keeping the original as `underlyingCause`. Failed UserOps on the permissionless sender use the same codes.
+- **Publish automation on legacy ManagedAccounts:** `enrollPublishAutomation` no longer fails when the account is an ERC-7504 Router (`Router: function does not exist`) instead of ModularCore. Those accounts cannot `installModule`; enroll adds the module-only session key and attests the sidecar. ModularCore accounts still require the executor module to be installed.
+- **EAS schema lookup:** `ensureEasSchemasForItem` normalizes property data types (`html` → `Html`) before choosing the on-chain schema, so an existing `bytes32 html` schema is reused instead of registering `string html`. `normalizeDataType` is exported from `@seedprotocol/sdk`.
+- **Automation schema registration:** session keys no longer send SchemaRegistry or EAS UserOps when a schema is missing. Publish fails first with `schema "…" is not registered; automation keys can't register schemas`. Register once with the owner wallet via `ensureEasSchemasForItem`.
 - **First-time modular publish:** `isAutomationSessionActive` returns `false` when the ManagedAccount has no bytecode instead of throwing `MODULAR_SIGNER_ACTIVATION_FAILED` on viem `0x` / “not a contract”. Interactive first publish can reach `runModularExecutorPublishPrep` / `autoDeployManagedAccount`. Deployed-account RPC or `isActiveSigner` read failures still throw so unattended automation does not fall through to in-app bootstrap.
 
 ### Added

package/README.md

@@ -12,6 +12,8 @@ The publish flow (ConnectButton, etc.) runs `ensureEasSchemasForItem` before `ge
 
 `uploadApiBaseUrl` is required. Provide either `rpcUrl` or `thirdwebClientId` (RPC falls back to Thirdweb’s edge when only the client id is set).
 
+From Node, a domain-locked client id returns 401. Set `thirdwebSecretKey` (server only) so Thirdweb RPC and the bundler authenticate, and either pass a public `rpcUrl` or pass `thirdwebClientId` together with that secret (`x-secret-key` is attached to viem reads). A secret key alone does not build the viem RPC URL. Call `await PublishManager.ready()` before `createPublish`; that promise is the spawned actor, not the finished publish. eas-sdk’s ESM build named-imports CommonJS `lodash`. Load it with `node --import @seedprotocol/sdk/node-eas-lodash`, which redirects that import to `lodash-es`.
+
 Thirdweb is an **optional** peer. Core publish uses `SeedSigner` + `SeedTxSender` (`PublishWallet`). Import ConnectButton / in-app wallets from `@seedprotocol/publish/thirdweb`.
 
 ### Recipe 1: EIP-1193 + EOA (no Thirdweb)
@@ -103,6 +105,58 @@ function App() {
 
 You can optionally pass `queryClient` or `queryClientRef` to customize the Seed QueryClient.
 
+### Choosing a chain
+
+Publishing works on any EVM chain with [EAS](https://github.com/ethereum-attestation-service/eas-contracts#deployments) deployed. Pass a viem `chain`; it defaults to Optimism Sepolia. The same chain drives viem reads, transaction routing and the Thirdweb wallet / ConnectButton. When `rpcUrl` is set, Thirdweb uses it too, so Seed's checks and Thirdweb's calls always reach the same node.
+
+```ts
+import { base } from 'viem/chains'
+
+initPublish({
+  uploadApiBaseUrl: import.meta.env.VITE_UPLOAD_API_BASE_URL,
+  rpcUrl: import.meta.env.VITE_RPC_URL,
+  chain: base,
+})
+```
+
+- **Known chains** (`EAS_CHAIN_DEPLOYMENTS`: Ethereum, Sepolia, Optimism, Optimism Sepolia, Base, Base Sepolia, Arbitrum One / Sepolia, Polygon, Scroll, Linea) resolve the EAS and SchemaRegistry addresses automatically.
+- **Other chains** need `easContractAddress` and `schemaRegistryAddress`; `initPublish` throws without them. These options also override the built-in addresses on known chains.
+- **Managed / modular account flows** (Thirdweb ManagedAccount, `useModularExecutor`) need a ManagedAccount factory on the chain. One is built in for Optimism Sepolia only (`MANAGED_ACCOUNT_FACTORY_ADDRESSES`); elsewhere pass `managedAccountFactoryAddress` and an executor module you have deployed. The EOA / direct EAS path needs neither.
+- `ensureEasSchemasForItem` registers missing model and property schemas on first publish. The base schemas (Version and EAS's "Name a Schema") are registered by the protocol for each supported chain (seed-protocol `seed:ensure-schemas`); if one is missing, publishing fails before sending anything.
+- SDK reads (EAS sync, schema lookups) follow the publish chain's easscan indexer automatically. For a chain without a known indexer, or a self-hosted one, set `SeedConfig.eas.indexerUrl`. If the SDK sets `eas.chainId`, it must match `chain.id` or init throws. The `EAS_ENDPOINT` / `NEXT_PUBLIC_EAS_ENDPOINT` env vars still override the chain's default indexer, but one set to another chain's known easscan indexer throws (`SeedConfig.eas.indexerUrl` takes precedence over both).
+- The SDK's local database remembers which chain its attestations came from. Pointing an existing database at a different chain fails at init, sync or publish with a chain-mismatch error rather than mixing data from two chains. Use a separate `filesDir` / database per chain. Databases created before this check are treated as Optimism Sepolia.
+- Before the first publish or revoke, `verifyPublishChain()` checks that the RPC reports `chain.id` and that EAS, the SchemaRegistry and any configured factory / executor module have code on the chain. It throws `PublishChainConfigError` listing every problem. Call it at startup to fail earlier.
+- While `@seedprotocol/publish` is loaded but `initPublish` hasn't run, SDK EAS sync waits (up to 30s) for the publish chain instead of syncing the default chain. Set `SeedConfig.eas.chainId` to skip the wait.
+
+The resolved values are on `getPublishConfig()` (`chain`, `easContractAddress`, `schemaRegistryAddress`, `thirdwebAccountFactoryAddress`, `easChain`).
+
+### Local OP Sepolia twin
+
+The protocol's twin (`seed-protocol`: `bun run twin:up`) is an OP Sepolia fork on chain **31337** with a local bundler (no paymaster) and EAS indexer. Thirdweb's hosted paymaster and EIP-7702 service can't reach it, so the wallets need the `thirdweb` settings below. `seedTwinConfig` reads the endpoints and addresses from `seed-protocol/.twin/twin.json`, which change with each deploy; it ignores the file's test-account keys.
+
+```ts
+import { initPublish, seedTwinConfig } from '@seedprotocol/publish'
+import twinJson from '../seed-protocol/.twin/twin.json'
+
+const twin = seedTwinConfig(twinJson)
+
+initPublish({
+  ...twin.publish, // chain 31337, rpcUrl, addresses, executor, thirdweb: { bundlerUrl, sponsorGas: false, modularWalletMode: 'EOA' }
+  uploadApiBaseUrl: 'http://localhost:3000', // your seed-protocol-server
+  thirdwebClientId, // login stays hosted; allow the local origin
+  useModularExecutor: true,
+})
+
+// SDK
+client.init({ config: { ...config, eas: twin.eas, filesDir: `.seed-${twin.chain.id}` } })
+```
+
+Configuring the twin by hand instead: the twin's bundler goes in `thirdweb.bundlerUrl`, not the top-level `bundlerUrl`. That one feeds the permissionless EIP-7702 sender, needs an EntryPoint v0.8 bundler (the twin's is v0.6) and is rejected when the bundler reports no v0.8 support. On a local chain (31337 / 1337, or a loopback RPC), the Thirdweb wallets throw for `modularWalletMode: 'EIP7702'` and for a missing `thirdweb.bundlerUrl`, since Thirdweb's hosted services can't reach it.
+
+Fund both the ManagedAccount and the in-app EOA before publishing: `bun run twin:fund <managedAddress> <eoaAddress>` in `seed-protocol`. Each `twin:up` resets the chain, so clear the local Seed DB (`filesDir`) and browser storage too.
+
+Twin quirks the SDK handles: automation pre-flight simulations retry with a balance override when the account can't cover OP's up-front L1 fee, EOA sends retry when the fork's pending-nonce lookup lags a block, and `getArweave()` follows the gateway's protocol and port (e.g. `http://localhost:1984`).
+
 ### useIntegerLocalIds
 
 When using the new contract that expects `uint256` localIdIndex/publishLocalIdIndex instead of string localId/publishLocalId (gas-efficient), set `useIntegerLocalIds: true`:
@@ -202,25 +256,29 @@ Apps can enroll a server-held session key to publish/revoke on a user’s Manage
 
 APIs live on `@seedprotocol/publish` (sidecar attest/revoke) and `@seedprotocol/publish/thirdweb` (`enrollPublishAutomation`, `revokePublishAutomation`, session-key helpers, `assertStorageBoundToIdentity`).
 
-### Modular executor (`useModularExecutor`) and EIP-7702
+### Modular executor (`useModularExecutor`)
+
+With **`useModularExecutor`**, two Thirdweb in-app wallets share one login:
+
+- **Managed wallet** (`getManagedAccountWallet`, EIP-4337): the user's **ManagedAccount** smart account, created by the ManagedAccount factory with the user's in-app EOA as admin. It is the attester, and it publishes.
+- **Modular wallet** (`getModularAccountWallet`): that same in-app EOA. It signs DataItems and sends the few **admin-only** transactions, such as `installSeedExecutor`. `thirdweb.modularWalletMode` picks EIP-7702 through Thirdweb (default; gas-sponsored unless `thirdweb.sponsorGas` is `false`) or a plain funded EOA (`'EOA'`); the address is the same either way.
 
-When **`useModularExecutor`** is enabled, `multiPublish` is sent **from** the user’s **Thirdweb in-app modular wallet** (EIP-7702 execution mode) against their **ManagedAccount** contract. Before the first on-chain publish, `createAttestations` runs **`ensureEip7702ModularAccountReady()`**, which checks Optimism Sepolia bytecode at the modular wallet address (EIP-7702 delegation / minimal account). If bytecode is still empty and **`autoDeployEip7702ModularAccount`** is true (the default when `useModularExecutor` is on), it calls Thirdweb’s **`deploySmartAccount`** bootstrap (no-op if already upgraded). Set **`autoDeployEip7702ModularAccount: false`** to surface **`Eip7702ModularAccountPublishError`** instead of auto-deploying.
+**Publishing.** `createAttestations` sends interactive `multiPublish` as a **UserOp from the managed smart account**, calling the account itself (`execute(account, multiPublish)`). The Seed extension accepts that self-call; direct calls from session keys or other non-admins revert with `Unauthorized`. Before the first publish, `ensureModularPublishBootstrap`:
 
-**`ensureSmartWalletThenPublish`:** With **`useModularExecutor`**, the publish machine’s **`account`** and default **`dataItemSigner`** come from **`getConnectedModularAccount()`** (the modular EIP-7702 in-app wallet), not from **`resolveSmartWalletForPublish`** or the **`activeAccount`** argument (that parameter is ignored on this path for API compatibility). **`ensureEip7702ModularAccountReady()`** runs once before **`createPublish`** so EIP-7702 readiness failures surface before the publish actor starts; `createAttestations` still calls it again (no-op when already deployed).
+1. Connects the managed wallet and checks it is the publishing account.
+2. Checks the account's `getEas()` against `easContractAddress`. Current Seed extensions fix EAS at deployment, so a mismatch is a config error. Only pre-rollout accounts that report no EAS get `setEas`, sent by the admin EOA.
 
-**Routing (important):** `multiPublish` calldata uses the ABI generated from the reference deployment `MULTI_PUBLISH_ABI_REFERENCE_ADDRESS_OP_SEPOLIA` (`0xcd8c…` — same hex as the deprecated `SEED_PROTOCOL_CONTRACT_ADDRESS_OP_SEPOLIA` alias). The transaction **`to` / `getContract` address** is the user’s on-chain publisher: **managed account** for interactive modular publish (`runModularExecutorPublishPrep().managedAddress`), or the **executor module** when an automation session key is detected (`routeToExecutorModule`). Non-modular publish targets the **deployed publisher contract**. **EOAs** (no contract at `address`) never use `multiPublish`; the publish machine routes them to **direct EAS** (`createAttestationsDirectToEas`). Set **`useDirectEas: true`** to force that path even when the publisher is a deployed contract. Receipt parsing uses `modularAccountModuleContract` when configured, otherwise the managed / publisher address.
+**Executor.** `runModularExecutorPublishPrep()` ensures the ManagedAccount is deployed and, when `modularAccountModuleContract` is set, tries to install the Seed executor: `installSeedExecutor()` from the admin EOA on Router accounts with the `SeedExecutorRouterExtension`, `installModule` on ModularCore accounts. Interactive publishing doesn't use the executor, so a failed install (for example, `modularAccountModuleContract` naming a different executor than the one the account's extension pins) only logs a warning. `enrollPublishAutomation` requires the install and fails with `EXECUTOR_MODULE_NOT_INSTALLED`.
 
-**Managed account:** `runModularExecutorPublishPrep()` still ensures the **EIP-4337 managed** publishing contract exists on Optimism Sepolia (and optionally installs the executor module). That is separate from the modular wallet’s EIP-7702 upgrade.
+**Session keys** may only target the executor (`approvedTargetsForAutomationPublish`). `ensureManagedSignerSessionKey` and `defaultApprovedTargetsForModularPublish` are deprecated: interactive publishing needs no session key, and both now grant the executor only, never the account (which would allow any self-call) or EAS.
 
-Before the first `multiPublish` on that path, `createAttestations` runs **`ensureModularPublishBootstrap`**, which:
+**Automation** session keys publish through the executor only (see [PUBLISH_AUTOMATION.md](../../docs/PUBLISH_AUTOMATION.md)) and cannot revoke. **Revocation** is owner-only: `revokeAttestations` sends `multiRevoke` to EAS from the publishing account.
 
-1. Provisions the modular wallet as a **session signer** on the ManagedAccount (`ensureManagedSignerSessionKey` — `addSessionKey` signed by the managed EIP-4337 wallet when needed).
-2. Ensures the ManagedAccount EAS pointer matches config (`ensureManagedAccountEasConfigured`).
-3. Falls back to **`ensureEip7702ModularAccountReady`** only when session-key setup fails and `autoDeployEip7702ModularAccount` is enabled.
+**Routing:** `multiPublish` calldata uses the ABI generated from the reference deployment `MULTI_PUBLISH_ABI_REFERENCE_ADDRESS_OP_SEPOLIA` (`0xcd8c…`). The transaction `to` is the managed account for interactive publish, or the executor module for automation keys. Non-modular publish targets the deployed publisher contract. **EOAs** (no contract at `address`) never use `multiPublish`; they attest on EAS directly (`createAttestationsDirectToEas`). Set **`useDirectEas: true`** to force that path.
 
-**Diagnostic helper:** **`defaultApprovedTargetsForModularPublish(managedAddress)`** remains exported for apps that build custom permission flows.
+**`ensureSmartWalletThenPublish`:** with `useModularExecutor`, the default `dataItemSigner` comes from `getConnectedModularAccount()`; the `activeAccount` argument is ignored on this path.
 
-**Resolved config:** Use **`getPublishConfig()`** after `initPublish` / `PublishProvider` for **`autoDeployEip7702ModularAccount`** and other resolved defaults—not only `usePublishConfig()`, which returns the raw `PublishConfig` object.
+**Resolved config:** use **`getPublishConfig()`** after `initPublish` / `PublishProvider` for resolved defaults, not only `usePublishConfig()`, which returns the raw `PublishConfig`.
 
 ## Development