@tollxyz/guard 0.1.2 → 0.3.0

package/README.md

@@ -1,7 +1,26 @@
 # @tollxyz/guard
 
-Toll's live pre-sign check in front of an AI agent's wallet. Before the agent signs a transaction, an EIP-712
-signature or an x402 payment on Robinhood Chain, the guard asks [Toll](https://t0ll.xyz/agents/x402#presign) and
+> **What changed in 0.3.0: every signing method is checked.**
+> - Messages: viem and ethers `signMessage`, and `request()` for `personal_sign` and `eth_sign`.
+> - Typed data: `request()` for `eth_signTypedData_v4` too, any EIP-712 (orders, permits, sign-ins).
+> - Batches: viem `sendCalls` (EIP-5792) and `request()` for `wallet_sendCalls`, each call checked.
+> - Smart accounts: `guardSmartAccount` wraps a viem bundler client's `sendUserOperation` and `prepareUserOperation`;
+>   `guard()` picks it for a bundler client.
+> - EIP-7702: `onAuthorization` now defaults to `"check"`: Toll reads the authorization and decides (a known, verified
+>   delegate is WARN medium and goes ahead under `block-high`; an unknown one is BLOCK). `"block"` and `"allow"` stay.
+>   An authorization Toll cannot read is blocked.
+> - A signature for another chain is blocked (before 0.3.0 it went through as unsupported); `onUnsupported: "allow"`
+>   lets it through.
+> - `eth_sign` always fails closed: it can sign any 32 bytes, a transaction included, so when Toll cannot answer it is
+>   blocked whatever `onUnavailable` says.
+
+> **Defaults changed in 0.2.0.** A WARN with any `high` or `critical` warning is now blocked (`onWarn: "block-high"`,
+> the new default); a WARN with only `medium`/`low` warnings still goes ahead, logged. To keep the 0.1.x behaviour,
+> pass `onWarn: "allow"`. New `strict: true` preset: WARN, unavailable and unsupported all block. Any option you pass
+> explicitly still wins over the preset (`{ strict: true, onUnavailable: "allow" }` stays fail-open).
+
+Toll's live pre-sign check in front of an AI agent's wallet. Before the agent signs a transaction, a message, an
+EIP-712 signature, a batch, a user operation, an EIP-7702 authorization or an x402 payment on Robinhood Chain, the guard asks [Toll](https://t0ll.xyz/agents/x402#presign) and
 gets ALLOW / WARN / BLOCK with the reasons. Zero runtime dependencies, ESM only, Node >= 20.19, with types.
 
 ```sh
@@ -9,13 +28,13 @@ npm install @tollxyz/guard
 ```
 
 ```ts
-const wallet = guard(walletClient);   // viem WalletClient or ethers v6 Signer; same methods, checked first
+const wallet = guard(walletClient);   // viem WalletClient, viem bundler client or ethers v6 Signer; same methods, checked first
 ```
 
 ```ts
 import { guard, TollBlockedError } from "@tollxyz/guard";
 
-const wallet = guard(walletClient, { onWarn: "allow", onUnavailable: "allow" });
+const wallet = guard(walletClient, { onWarn: "block-high", onUnavailable: "allow" });
 try {
   await wallet.writeContract({ address: token, abi: erc20Abi, functionName: "approve", args: [spender, maxUint256] });
 } catch (e) {
@@ -57,23 +76,43 @@ The answer is an [ERC-8265](https://github.com/ethereum/ERCs/pull/1753) RiskAsse
 `{ action, warnings: [{ code, severity, message, "x-toll-evidence" }], scanners, "x-toll": { decoded, link, checked_at, note } }`.
 Critical = BLOCK, high or medium = WARN, low or none = ALLOW.
 
-Robinhood Chain (4663) only for now. A request on another chain, or a contract deployment, is not sent to Toll and
-goes through (`onUnsupported: "block"` to stop it instead).
+Robinhood Chain (4663) only for now. A transaction on another chain, or a contract deployment, is not sent to Toll
+and goes through (`onUnsupported: "block"` to stop it instead). A signature for another chain is blocked
+(`onUnsupported: "allow"` lets it through).
 
 ## API
 
-### `guard(wallet, opts?)`, `guardViem(client, opts?)`, `guardEthers(signer, opts?)`
+### `guard(wallet, opts?)`, `guardViem(client, opts?)`, `guardSmartAccount(bundler, opts?)`, `guardEthers(signer, opts?)`
 
 Returns the same wallet behind a Proxy. Checked first:
 
 - viem WalletClient: `sendTransaction`, `writeContract` (calldata encoded with your viem's `encodeFunctionData`),
-  `signTransaction`, `signTypedData`
-- ethers v6 Signer: `sendTransaction`, `signTransaction`, `signTypedData`
+  `signTransaction`, `signTypedData`, `signMessage`, `sendCalls`, `signAuthorization`, and `request()` for
+  `eth_sendTransaction`, `eth_signTransaction`, `personal_sign`, `eth_sign`, `eth_signTypedData_v4` and
+  `wallet_sendCalls` (every other method passes through)
+- viem bundler client (account abstraction): `sendUserOperation`, `prepareUserOperation`. `calls` are checked one by
+  one as transactions from the smart account's address; a ready `callData` is sent as a user operation with the
+  account's EntryPoint
+- ethers v6 Signer: `sendTransaction`, `signTransaction`, `signTypedData`, `signMessage`, `authorize`
+
+A batch is checked call by call, in order; the first call blocked stops the whole batch.
+
+An EIP-7702 authorization sets the wallet's code to another contract, which can then move everything it holds: a
+transaction with an `authorizationList` on any method above, viem's `signAuthorization`, ethers' `authorize`, a user
+operation's `authorization`. By default (`onAuthorization: "check"`) Toll reads it and decides; if Toll cannot read it
+(unreachable, another chain) it is blocked (TollBlockedError, code `eip7702-authorization`). `"block"` refuses every
+authorization without asking; `"allow"` lets it through unchecked. The account's own sign methods
+(`client.account.sign*`) are not wrapped.
 
-An EIP-7702 authorization sets the wallet's code to another contract, which can then move everything it holds. Toll
-does not read one yet, so the guard blocks it itself (TollBlockedError, code `eip7702-authorization`) unless
-`onAuthorization: "allow"`: a transaction with an `authorizationList` on any method above, viem's
-`signAuthorization` and ethers' `authorize`. The account's own sign methods (`client.account.sign*`) are not wrapped.
+```ts
+const wallet = guard(walletClient, { origin: "https://app.example" }); // origin: the site asking, for sign-ins
+await wallet.signMessage({ message: "Sign in to app.example" });     // checked as personal_sign
+await wallet.request({ method: "personal_sign", params: [hexMessage, address] });
+await wallet.request({ method: "eth_sign", params: [address, hash] }); // blocked when Toll blocks it, or cannot answer
+
+const smart = guard(bundlerClient);                                    // detected by sendUserOperation
+await smart.sendUserOperation({ calls: [{ to: token, abi: erc20Abi, functionName: "transfer", args: [to, amount] }] });
+```
 
 Everything else passes through unchanged. Wrap last: `client.extend(...)` or `signer.connect(...)` on the wrapped
 wallet returns an unguarded one. viem and ethers are optional peer dependencies, never imported at load time.
@@ -97,8 +136,12 @@ const pay = wrapFetchWithPayment(guardX402Fetch(fetch, { agentId: 123 }), accoun
 
 ### `checkTx(input, opts?)`
 
-The raw call. `input`: `{ chainId, from, to, data, value }` for a transaction, `{ typedData }` for an EIP-712
-request, `{ x402, agentId?, payment? }` for an x402 payment, or several together. Returns the RiskAssessment. When a
+The raw call. `input`: `{ chainId, from, to, data, value, authorizationList? }` for a transaction,
+`{ chainId, from, authorizationList }` for an authorization alone, `{ typedData }` for an EIP-712 request,
+`{ message: { kind: "personal_sign" | "eth_sign", data, from? } }` for a message, `{ rpc: { method, params } }` for a
+wallet request (`personal_sign`, `eth_sign`, `eth_signTypedData_v4`, `eth_sendTransaction`), `{ userOp, entryPoint? }`
+for an ERC-4337 user operation, `{ x402, agentId?, payment? }` for an x402 payment, or several together; `origin` is
+the site asking. Returns the RiskAssessment. When a
 coin is still being read, Toll answers WARN `coin-not-read` with `Retry-After`: `checkTx` asks once more if the wait
 is at most `maxRetryWaitMs` (default 10 s); a coin still not read stays WARN, never ALLOW. Throws
 `TollUnavailableError` when Toll cannot answer.
@@ -107,11 +150,13 @@ is at most `maxRetryWaitMs` (default 10 s); a coin still not read stays WARN, ne
 
 | Option | Default | |
 | --- | --- | --- |
-| `onWarn` | `"allow"` | `"allow"` (logged and reported), `"block"`, or `(assessment) => boolean` (true lets it through) |
+| `strict` | `false` | preset: the defaults of `onWarn`, `onUnavailable` and `onUnsupported` become `"block"`; each one passed explicitly still wins |
+| `onWarn` | `"block-high"` | `"block-high"` (blocked when any warning is `high` or `critical`, else allowed and logged), `"allow"` (every WARN goes ahead, logged; the 0.1.x default), `"block"`, or `(assessment) => boolean` (true lets it through) |
 | `onBlock` | `"throw"` | `"throw"` (TollBlockedError), or `(assessment) => boolean`, e.g. ask a human; true lets it through |
-| `onUnavailable` | `"allow"` | Toll unreachable, timed out, 5xx, 429, or a request it could not read: `"allow"` (fail-open, logged) or `"block"` (fail-closed, TollUnavailableError) |
-| `onUnsupported` | `"allow"` | another chain, a deployment: `"allow"` or `"block"` |
-| `onAuthorization` | `"block"` | an EIP-7702 authorization: `"block"` (TollBlockedError) or `"allow"` (unchecked, logged) |
+| `onUnavailable` | `"allow"` (`strict`: `"block"`) | Toll unreachable, timed out, 5xx, 429, or a request it could not read: `"allow"` (fail-open, logged) or `"block"` (fail-closed, TollUnavailableError) |
+| `onUnsupported` | `"allow"` (`strict`: `"block"`) | a transaction on another chain, a deployment: `"allow"` or `"block"`. A signature for another chain is blocked unless this is `"allow"` explicitly |
+| `onAuthorization` | `"check"` | an EIP-7702 authorization: `"check"` (Toll decides; blocked when Toll cannot read it), `"block"` (TollBlockedError, Toll not asked) or `"allow"` (unchecked, logged) |
+| `origin` | none | the site asking for a signature, sent with messages and typed data |
 | `onReport` | none | `(report) => void`: every decision, with `assessment`, `decision`, `basis`, `paidUrl` |
 | `logger` | `console.warn` | where WARN and unavailable lines go; `false` = silent |
 | `timeoutMs` | `15000` | one request to Toll |
@@ -126,13 +171,16 @@ Errors: `TollBlockedError` (`.assessment`, `.codes`, message lists each code and
 The default is fail-open: if Toll cannot answer, the signature goes ahead, with a `[toll-guard] ... NOT checked`
 line and an `onReport` call with `basis: "unavailable"`. The agent must never get stuck because of Toll, and the
 free route is rate limited per IP (a busy agent will see 429s). If an unchecked signature is worse for you than a
-stalled agent, set `onUnavailable: "block"`.
+stalled agent, set `onUnavailable: "block"` (or `strict: true`, which also blocks every WARN and unsupported request).
+
+Two requests fail closed whatever `onUnavailable` says: `eth_sign` (it signs any 32 bytes, a transaction hash
+included, so an unchecked one could be anything) and an EIP-7702 authorization under `onAuthorization: "check"`.
 
 ## Free limit and the paid route
 
 The check is free, rate limited per IP. The coin a swap buys is read through the same free coins as Toll's coin
 check (10 new coins a day per caller, coins already read stay free); past that the coin is not read and the answer
-is WARN `coin-over-quota` naming the paid route, `https://t0ll.xyz/api/x402/tx` (0.01 USDG over x402, no daily
+is WARN `coin-over-quota` naming the paid route, `https://t0ll.xyz/api/x402/tx` (0.005 USDG over x402, no daily
 limit). The guard never pays: it puts that URL in the log line, in `report.paidUrl` and in `paidUrlOf(assessment)`.
 
 ## Privacy

package/dist/check.d.ts

@@ -5,7 +5,7 @@
 export declare const DEFAULT_BASE_URL = "https://t0ll.xyz";
 /** Robinhood Chain: the only chain the pre-sign check reads for now */
 export declare const TX_CHAIN_ID = 4663;
-/** the paid route without the daily limit (0.01 USDG over x402); the guard never pays it */
+/** the paid route without the daily limit (0.005 USDG over x402); the guard never pays it */
 export declare const PAID_TX_PATH = "/api/x402/tx";
 export declare const PRESIGN_DOCS = "https://t0ll.xyz/agents/x402#presign";
 export declare const DEFAULT_TIMEOUT_MS = 15000;
@@ -61,8 +61,22 @@ export interface TypedDataLike {
     primaryType: string;
     message: Record<string, unknown>;
 }
+/** A personal_sign / eth_sign message: data is hex (the bytes signed) or text. */
+export interface SignMessageLike {
+    kind: "personal_sign" | "eth_sign";
+    data: string;
+    origin?: string;
+    from?: string;
+}
+/** A wallet RPC request Toll reads as the body it stands for: personal_sign, eth_sign, eth_signTypedData_v4, eth_sendTransaction. */
+export interface RpcLike {
+    method: string;
+    params?: readonly unknown[];
+}
 /**
- * What to check. A transaction ({chainId, from, to, data, value}), an EIP-712 request ({typedData}), an x402 payment
+ * What to check. A transaction ({chainId, from, to, data, value}, with an EIP-7702 authorizationList or not), an
+ * authorization list alone ({chainId, from, authorizationList}), an EIP-712 request ({typedData}), a message
+ * ({message}), a wallet request ({rpc}), an ERC-4337 user operation ({userOp, entryPoint?}), an x402 payment
  * ({x402, agentId?, payment?}), or several together.
  */
 export interface CheckInput {
@@ -71,7 +85,17 @@ export interface CheckInput {
     to?: string;
     data?: string;
     value?: Numberish;
+    /** EIP-7702 authorizations: with to/data a type-4 transaction, alone a signAuthorization */
+    authorizationList?: readonly unknown[];
     typedData?: TypedDataLike;
+    message?: SignMessageLike;
+    rpc?: RpcLike;
+    /** an ERC-4337 user operation (v0.6, v0.7 packed or the RPC form) */
+    userOp?: Record<string, unknown>;
+    /** the user operation's EntryPoint */
+    entryPoint?: string;
+    /** the site asking for the signature (a URL or host name) */
+    origin?: string;
     /** the 402's PaymentRequired, or one of its accepts entries */
     x402?: Record<string, unknown>;
     /** the seller's ERC-8004 agent id, when known */

package/dist/check.js

@@ -5,7 +5,7 @@
 export const DEFAULT_BASE_URL = "https://t0ll.xyz";
 /** Robinhood Chain: the only chain the pre-sign check reads for now */
 export const TX_CHAIN_ID = 4663;
-/** the paid route without the daily limit (0.01 USDG over x402); the guard never pays it */
+/** the paid route without the daily limit (0.005 USDG over x402); the guard never pays it */
 export const PAID_TX_PATH = "/api/x402/tx";
 export const PRESIGN_DOCS = "https://t0ll.xyz/agents/x402#presign";
 export const DEFAULT_TIMEOUT_MS = 15_000;
@@ -61,6 +61,7 @@ const trimBase = (b) => b.replace(/\/+$/, "");
 /** the request body as the route reads it (lib/txcheck.ts parseTxCheckBody): payment rides inside x402 */
 export function bodyOf(input) {
     const b = {};
+    const auths = input.authorizationList !== undefined && input.authorizationList !== null && input.authorizationList.length > 0;
     if (input.to !== undefined || input.data !== undefined) {
         if (input.chainId !== undefined)
             b.chainId = input.chainId;
@@ -69,9 +70,30 @@ export function bodyOf(input) {
         b.to = input.to;
         b.data = input.data ?? "0x";
         b.value = input.value ?? 0;
+        if (auths)
+            b.authorizationList = input.authorizationList;
+    }
+    else if (auths) {
+        // a signAuthorization alone: the list and its signer
+        if (input.chainId !== undefined)
+            b.chainId = input.chainId;
+        if (input.from !== undefined)
+            b.from = input.from;
+        b.authorizationList = input.authorizationList;
     }
     if (input.typedData)
         b.typedData = input.typedData;
+    if (input.message)
+        b.message = input.message;
+    if (input.rpc)
+        b.rpc = input.rpc;
+    if (input.userOp) {
+        b.userOp = input.userOp;
+        if (input.entryPoint !== undefined)
+            b.entryPoint = input.entryPoint;
+    }
+    if (input.origin !== undefined)
+        b.origin = input.origin;
     if (input.x402)
         b.x402 = input.payment ? { ...input.x402, payment: input.payment } : input.x402;
     if (input.agentId !== undefined && input.agentId !== null)

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { checkTx, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
-export type { Action, Severity, RiskWarning, ScannerVerdict, TollExtra, RiskAssessment, CheckInput, CheckOptions, TypedDataLike, FetchLike, Hex, Numberish, UnavailableReason, } from "./check.js";
-export { enforce, unsupportedWhy, refuse, gateAuthorization } from "./policy.js";
+export { checkTx, bodyOf, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
+export type { Action, Severity, RiskWarning, ScannerVerdict, TollExtra, RiskAssessment, SignMessageLike, RpcLike, CheckInput, CheckOptions, TypedDataLike, FetchLike, Hex, Numberish, UnavailableReason, } from "./check.js";
+export { enforce, enforceCalls, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning, isSignature, isEthSign } from "./policy.js";
 export type { GuardOptions, GuardReport, GuardKind, WarnPolicy, BlockPolicy } from "./policy.js";
-export { guard, guardViem, guardEthers, isViemClient, primaryTypeOf } from "./wallets.js";
+export { guard, guardViem, guardEthers, guardSmartAccount, isViemClient, isBundlerClient, primaryTypeOf } from "./wallets.js";
 export type { ViemGuardOptions } from "./wallets.js";
 export { guardX402Fetch, readPaymentRequired, readPaymentForms, paymentFormsDiffer } from "./x402.js";
 export type { X402GuardOptions } from "./x402.js";

package/dist/index.js

@@ -1,5 +1,5 @@
-export { checkTx, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
-export { enforce, unsupportedWhy, refuse, gateAuthorization } from "./policy.js";
-export { guard, guardViem, guardEthers, isViemClient, primaryTypeOf } from "./wallets.js";
+export { checkTx, bodyOf, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
+export { enforce, enforceCalls, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning, isSignature, isEthSign } from "./policy.js";
+export { guard, guardViem, guardEthers, guardSmartAccount, isViemClient, isBundlerClient, primaryTypeOf } from "./wallets.js";
 export { guardX402Fetch, readPaymentRequired, readPaymentForms, paymentFormsDiffer } from "./x402.js";
 export { read8470, latestFinding8470, decodeGetObservation, decodeLatestFinding, encodeGetObservation, encodeLatestByToken, encodeLatestFinding, FINDING_KINDS, NOT_READ, OBS_REGISTRY, OBS_DETECTOR, OBS_CHAIN_ID, RH_RPC, } from "./erc8470.js";

package/dist/policy.d.ts

@@ -1,7 +1,7 @@
 import { TollUnavailableError, type CheckInput, type CheckOptions, type RiskAssessment } from "./check.js";
-export type WarnPolicy = "allow" | "block" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
+export type WarnPolicy = "allow" | "block" | "block-high" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
 export type BlockPolicy = "throw" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
-export type GuardKind = "transaction" | "typedData" | "x402";
+export type GuardKind = "transaction" | "typedData" | "x402" | "message" | "userOp" | "calls";
 export interface GuardReport {
     kind: GuardKind;
     /** what was sent to Toll (null when nothing was sent) */
@@ -17,17 +17,25 @@ export interface GuardReport {
     error?: TollUnavailableError;
 }
 export interface GuardOptions extends CheckOptions {
-    /** WARN: "allow" (default, reported and logged), "block", or a function; true lets it through */
+    /**
+     * WARN: "block-high" (default since 0.2.0: blocked when any warning is high or critical, else allowed and logged),
+     * "allow" (every WARN goes ahead, logged; the 0.1.x default), "block", or a function (true lets it through)
+     */
     onWarn?: WarnPolicy;
     /** BLOCK: "throw" (default, TollBlockedError), or a function (e.g. ask a human); true lets it through */
     onBlock?: BlockPolicy;
     /**
      * Toll unreachable, timed out, 5xx, 429, or a request it could not read: "allow" (default, fail-open, logged) or
-     * "block" (fail-closed, throws TollUnavailableError).
+     * "block" (fail-closed, throws TollUnavailableError). `strict` makes "block" the default.
      */
     onUnavailable?: "allow" | "block";
-    /** a request Toll does not read (another chain, a contract deploy): "allow" (default) or "block" */
+    /** a request Toll does not read (another chain, a contract deploy): "allow" (default) or "block"; `strict`: "block" */
     onUnsupported?: "allow" | "block";
+    /**
+     * The strict preset: the defaults become onWarn "block", onUnavailable "block" and onUnsupported "block".
+     * Any of those three passed explicitly (not undefined) still wins over the preset.
+     */
+    strict?: boolean;
     /** every decision, with Toll's answer; errors thrown here are caught and logged */
     onReport?: (report: GuardReport) => void | Promise<void>;
     /** where WARN / unavailable lines go (default console.warn); false = silent */
@@ -36,11 +44,28 @@ export interface GuardOptions extends CheckOptions {
     agentId?: number | string | ((url: string) => number | string | undefined | null);
     /**
      * An EIP-7702 authorization (a transaction's authorizationList, signAuthorization / authorize): it sets the
-     * wallet's code to another contract, which can then move everything the wallet holds. Toll does not read one yet.
-     * "block" (default): TollBlockedError, nothing is signed. "allow": let it through unchecked (logged, reported).
+     * wallet's code to another contract, which can then move everything the wallet holds.
+     * "check" (default since 0.3.0): Toll reads it and decides (a known, verified delegate comes back WARN medium and
+     * passes under onWarn "block-high"; an unknown one comes back BLOCK). It fails closed: when Toll cannot read it
+     * (unreachable, another chain, a request it refuses) it is blocked, whatever onUnavailable / onUnsupported say.
+     * "block": TollBlockedError, nothing is signed, Toll is not asked. "allow": let it through unchecked (logged, reported).
      */
-    onAuthorization?: "block" | "allow";
+    onAuthorization?: "check" | "block" | "allow";
+    /** the site asking for a signature (a URL or host name), sent with messages so Toll can match a sign-in's domain */
+    origin?: string;
 }
+/** the effective policy: explicit options win, then the strict preset, then the defaults */
+export declare function resolvePolicy(o?: GuardOptions): {
+    onWarn: WarnPolicy;
+    onUnavailable: "allow" | "block";
+    onUnsupported: "allow" | "block";
+};
+/** true when any warning is high or critical */
+export declare const hasHighWarning: (a: RiskAssessment) => boolean;
+/** true for a signature request (typed data, a message, a signing RPC) rather than a transaction or an x402 payment */
+export declare const isSignature: (input: CheckInput | null | undefined) => boolean;
+/** true for eth_sign: it signs any 32 bytes (a transaction hash included), so it fails closed when Toll cannot answer */
+export declare const isEthSign: (input: CheckInput | null | undefined) => boolean;
 /** why Toll would not read this request, or null when it does */
 export declare function unsupportedWhy(input: CheckInput): string | null;
 /**
@@ -54,5 +79,15 @@ export declare function enforce(kind: GuardKind, build: () => CheckInput | Promi
  * disagree): reported as a BLOCK with one critical warning, then TollBlockedError. Nothing is sent to Toll.
  */
 export declare function refuse(kind: GuardKind, input: CheckInput | null, code: string, message: string, o?: GuardOptions): Promise<never>;
-/** the onAuthorization policy for an EIP-7702 authorization: resolves when it may go ahead, else throws */
-export declare function gateAuthorization(kind: GuardKind, where: string, input: CheckInput | null, o?: GuardOptions): Promise<void>;
+/**
+ * The onAuthorization policy for an EIP-7702 authorization. Resolves true when Toll checked the whole request (the
+ * "check" default: the caller asks nothing more), false when "allow" let it through unchecked (the caller still checks
+ * the rest of the request); throws when it is blocked. `input` is the request with its authorizationList, or a function
+ * that builds it; under "check", null is blocked (nothing to send).
+ */
+export declare function gateAuthorization(kind: GuardKind, where: string, input: CheckInput | null | (() => CheckInput | Promise<CheckInput>), o?: GuardOptions): Promise<boolean>;
+/**
+ * A batch (EIP-5792 sendCalls, wallet_sendCalls, a smart account's calls): each call is checked as its own transaction
+ * from the batch's sender, in order; the first one blocked stops the batch. Reports carry kind "calls".
+ */
+export declare function enforceCalls(build: () => CheckInput[] | Promise<CheckInput[]>, o?: GuardOptions): Promise<GuardReport[]>;

package/dist/policy.js

@@ -1,4 +1,16 @@
 import { TX_CHAIN_ID, TollBlockedError, TollUnavailableError, checkTx, chainIdOf, paidUrlOf, } from "./check.js";
+/** the effective policy: explicit options win, then the strict preset, then the defaults */
+export function resolvePolicy(o = {}) {
+    const strict = o.strict === true;
+    return {
+        onWarn: o.onWarn ?? (strict ? "block" : "block-high"),
+        onUnavailable: o.onUnavailable ?? (strict ? "block" : "allow"),
+        onUnsupported: o.onUnsupported ?? (strict ? "block" : "allow"),
+    };
+}
+const HIGH = new Set(["high", "critical"]);
+/** true when any warning is high or critical */
+export const hasHighWarning = (a) => (a.warnings ?? []).some((w) => HIGH.has(String(w?.severity).toLowerCase()));
 const say = (o, msg) => {
     if (o.logger === false)
         return;
@@ -19,9 +31,49 @@ async function report(o, r) {
         say(o, `onReport threw: ${e?.message ?? e}`);
     }
 }
+const SIGN_RPC = new Set(["personal_sign", "eth_sign", "eth_signTypedData_v4"]);
+/** the typed data a request signs: its typedData, or an eth_signTypedData_v4 request's params[1] (JSON or object) */
+function typedOf(input) {
+    if (input.typedData)
+        return input.typedData;
+    if (input.rpc?.method !== "eth_signTypedData_v4")
+        return null;
+    let td = input.rpc.params?.[1];
+    if (typeof td === "string") {
+        try {
+            td = JSON.parse(td);
+        }
+        catch {
+            return null;
+        }
+    }
+    return td && typeof td === "object" ? td : null;
+}
+/** true for a signature request (typed data, a message, a signing RPC) rather than a transaction or an x402 payment */
+export const isSignature = (input) => !!input && !input.x402 && (!!input.typedData || !!input.message || SIGN_RPC.has(String(input.rpc?.method)));
+/** true for eth_sign: it signs any 32 bytes (a transaction hash included), so it fails closed when Toll cannot answer */
+export const isEthSign = (input) => input?.message?.kind === "eth_sign" || input?.rpc?.method === "eth_sign";
+/** the other chain a typed-data signature names (its domain chainId), or null (Robinhood Chain, none, or an x402 payment) */
+function otherChainSignature(input) {
+    if (input.x402)
+        return null;
+    const c = typedOf(input)?.domain?.chainId;
+    const cid = c === undefined || c === null ? null : chainIdOf(c);
+    return cid !== null && cid !== TX_CHAIN_ID ? cid : null;
+}
+/** Toll's 400 for a request on another chain ("... chainId N is not read ...") */
+const OTHER_CHAIN_400 = /chainId \d+ is not read/;
 /** why Toll would not read this request, or null when it does */
 export function unsupportedWhy(input) {
     const tx = input.to !== undefined || input.data !== undefined;
+    const auths = !!input.authorizationList && input.authorizationList.length > 0;
+    if (!tx && auths) {
+        const cid = input.chainId === undefined ? null : chainIdOf(input.chainId);
+        if (input.chainId !== undefined && cid === null)
+            return "the chain id could not be read";
+        if (cid !== null && cid !== TX_CHAIN_ID)
+            return `chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
+    }
     if (tx) {
         if (input.to === undefined || input.to === null)
             return "a contract deployment (no `to`) is not read";
@@ -31,13 +83,10 @@ export function unsupportedWhy(input) {
         if (cid !== null && cid !== TX_CHAIN_ID)
             return `chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
     }
-    if (input.typedData && !input.x402) {
-        const c = input.typedData.domain?.chainId;
-        const cid = c === undefined || c === null ? null : chainIdOf(c);
-        if (cid !== null && cid !== TX_CHAIN_ID)
-            return `a signature for chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
-    }
-    if (!tx && !input.typedData && !input.x402)
+    const other = otherChainSignature(input);
+    if (other !== null)
+        return `a signature for chain ${other} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
+    if (!tx && !auths && !input.typedData && !input.x402 && !input.message && !input.rpc && !input.userOp)
         return "nothing to check";
     return null;
 }
@@ -56,12 +105,16 @@ export async function enforce(kind, build, o = {}) {
         return unavailable(kind, null, err, o);
     }
     const why = unsupportedWhy(input);
+    // a signature for another chain is not "unsupported -> allow": an off-chain signature Toll cannot read is refused
+    if (why && isSignature(input) && otherChainSignature(input) !== null && o.onUnsupported !== "allow") {
+        return refuse(kind, input, "signature-other-chain", `Not signed: ${why}. A signature Toll cannot read could hand over anything; onUnsupported: "allow" lets it through unchecked.`, o);
+    }
     if (why) {
-        const blocked = o.onUnsupported === "block";
+        const blocked = resolvePolicy(o).onUnsupported === "block";
         const r = { kind, input, assessment: null, decision: blocked ? "blocked" : "allowed", basis: "unsupported", paidUrl: null };
         await report(o, r);
         if (blocked)
-            throw new TollUnavailableError(`Not checked by Toll: ${why}. onUnsupported is "block".`, { reason: "unsupported" });
+            throw new TollUnavailableError(`Not checked by Toll: ${why}. onUnsupported is "block"${o.strict === true && o.onUnsupported === undefined ? " (strict)" : ""}.`, { reason: "unsupported" });
         return r;
     }
     let a;
@@ -70,6 +123,10 @@ export async function enforce(kind, build, o = {}) {
     }
     catch (e) {
         const err = e instanceof TollUnavailableError ? e : new TollUnavailableError(`Toll's check failed: ${e?.message ?? e}`, { reason: "network", cause: e });
+        // Toll's 400 for a signature on another chain: blocked, never "unsupported -> allow"
+        if (err.reason === "bad-request" && isSignature(input) && OTHER_CHAIN_400.test(err.message) && o.onUnsupported !== "allow") {
+            return refuse(kind, input, "signature-other-chain", `Not signed: Toll does not read a signature for another chain (${err.message}). onUnsupported: "allow" lets it through unchecked.`, o);
+        }
         return unavailable(kind, input, err, o);
     }
     const paidUrl = paidUrlOf(a);
@@ -90,8 +147,8 @@ export async function enforce(kind, build, o = {}) {
         throw new TollBlockedError(a, "BLOCK");
     }
     // WARN, and anything that is not one of the three actions: never treated as an ALLOW
-    const p = o.onWarn ?? "allow";
-    const ok = p === "allow" ? true : p === "block" ? false : (await p(a)) === true;
+    const p = resolvePolicy(o).onWarn;
+    const ok = p === "allow" ? true : p === "block" ? false : p === "block-high" ? !hasHighWarning(a) : (await p(a)) === true;
     if (ok) {
         say(o, `WARN (${kind}), going ahead: ${a.warnings.map((w) => `${w.code}: ${w.message}`).join(" | ")}${paidUrl ? ` Paid, no daily limit: ${paidUrl}` : ""}`);
         return done("allowed", "WARN");
@@ -100,7 +157,8 @@ export async function enforce(kind, build, o = {}) {
     throw new TollBlockedError(a, "WARN");
 }
 async function unavailable(kind, input, err, o) {
-    const blocked = o.onUnavailable === "block";
+    // eth_sign signs any 32 bytes (a transaction hash included): it always fails closed
+    const blocked = resolvePolicy(o).onUnavailable === "block" || isEthSign(input);
     const r = { kind, input, assessment: null, decision: blocked ? "blocked" : "allowed", basis: "unavailable", paidUrl: err.paidUrl, error: err };
     await report(o, r);
     if (blocked)
@@ -117,12 +175,53 @@ export async function refuse(kind, input, code, message, o = {}) {
     await report(o, { kind, input, assessment: a, decision: "blocked", basis: "BLOCK", paidUrl: null });
     throw new TollBlockedError(a, "BLOCK");
 }
-/** the onAuthorization policy for an EIP-7702 authorization: resolves when it may go ahead, else throws */
+/**
+ * The onAuthorization policy for an EIP-7702 authorization. Resolves true when Toll checked the whole request (the
+ * "check" default: the caller asks nothing more), false when "allow" let it through unchecked (the caller still checks
+ * the rest of the request); throws when it is blocked. `input` is the request with its authorizationList, or a function
+ * that builds it; under "check", null is blocked (nothing to send).
+ */
 export async function gateAuthorization(kind, where, input, o = {}) {
-    if (o.onAuthorization === "allow") {
+    const p = o.onAuthorization ?? "check";
+    const shown = typeof input === "function" ? null : input;
+    if (p === "allow") {
         say(o, `EIP-7702 authorization (${where}) NOT checked, going ahead (onAuthorization "allow")`);
-        await report(o, { kind, input, assessment: null, decision: "allowed", basis: "unsupported", paidUrl: null });
-        return;
+        await report(o, { kind, input: shown, assessment: null, decision: "allowed", basis: "unsupported", paidUrl: null });
+        return false;
+    }
+    const what = `${where} carries an EIP-7702 authorization, which sets this wallet's code to another contract that can then move everything it holds.`;
+    if (p === "block" || input === null) {
+        return refuse(kind, shown, "eip7702-authorization", `${what} ${p === "block" ? 'onAuthorization is "block"' : "It could not be read for Toll's check"}; onAuthorization: "allow" lets it through unchecked.`, o);
+    }
+    const build = typeof input === "function" ? input : () => input;
+    try {
+        // fail closed: an authorization Toll could not read is not signed
+        await enforce(kind, build, { ...o, onUnavailable: "block", onUnsupported: "block" });
+    }
+    catch (e) {
+        if (!(e instanceof TollUnavailableError))
+            throw e;
+        return refuse(kind, null, "eip7702-authorization", `${what} Toll could not read it (${e.message}), so it is not signed; onAuthorization: "allow" lets it through unchecked.`, o);
+    }
+    return true;
+}
+/**
+ * A batch (EIP-5792 sendCalls, wallet_sendCalls, a smart account's calls): each call is checked as its own transaction
+ * from the batch's sender, in order; the first one blocked stops the batch. Reports carry kind "calls".
+ */
+export async function enforceCalls(build, o = {}) {
+    let calls;
+    try {
+        calls = await build();
+    }
+    catch (e) {
+        const err = e instanceof TollUnavailableError ? e : new TollUnavailableError(`The batch could not be read for Toll's check: ${e?.message ?? e}`, { reason: "encode", cause: e });
+        return [await unavailable("calls", null, err, o)];
     }
-    await refuse(kind, input, "eip7702-authorization", `${where} carries an EIP-7702 authorization, which sets this wallet's code to another contract that can then move everything it holds. Toll does not read authorizations yet; onAuthorization: "allow" lets it through unchecked.`, o);
+    if (!calls.length)
+        return [await enforce("calls", () => ({}), o)];
+    const out = [];
+    for (const c of calls)
+        out.push(await enforce("calls", () => c, o));
+    return out;
 }

package/dist/wallets.d.ts

@@ -6,8 +6,8 @@ import { type Hex } from "./check.js";
 import { type GuardOptions } from "./policy.js";
 export interface ViemGuardOptions extends GuardOptions {
     /**
-     * Encodes writeContract calldata. Default: viem's own encodeFunctionData, loaded on first use (viem is installed
-     * wherever a viem WalletClient is).
+     * Encodes writeContract (and contract-call batch) calldata. Default: viem's own encodeFunctionData, loaded on first
+     * use (viem is installed wherever a viem client is).
      */
     encodeFunctionData?: (args: {
         abi: unknown;
@@ -16,27 +16,36 @@ export interface ViemGuardOptions extends GuardOptions {
     }) => Hex | string;
 }
 /**
- * Wraps a viem WalletClient: sendTransaction, writeContract, signTransaction and signTypedData ask Toll first. An
- * EIP-7702 authorization (an authorizationList on any of them, or signAuthorization) goes to onAuthorization
- * (default: blocked). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded client, and the
- * account's own sign methods (client.account.sign*) are not wrapped.
+ * Wraps a viem WalletClient. Asks Toll first: sendTransaction, writeContract, signTransaction, signTypedData,
+ * signMessage, sendCalls (EIP-5792, each call), signAuthorization, and request() for eth_sendTransaction,
+ * eth_signTransaction, personal_sign, eth_sign, eth_signTypedData_v4 and wallet_sendCalls. An EIP-7702 authorization
+ * goes to onAuthorization (default "check"). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded
+ * client, and the account's own sign methods (client.account.sign*) are not wrapped.
  */
 export declare function guardViem<T extends object>(client: T, opts?: ViemGuardOptions): T;
+/**
+ * Wraps a viem bundler client (account abstraction): sendUserOperation and prepareUserOperation ask Toll first.
+ * `calls` are checked one by one as transactions from the smart account's address; a ready `callData` is sent as a
+ * user operation with the account's EntryPoint. An EIP-7702 `authorization` goes to onAuthorization.
+ */
+export declare function guardSmartAccount<T extends object>(client: T, opts?: ViemGuardOptions): T;
 /** the EIP-712 primary type: the one type no other type refers to (as ethers' TypedDataEncoder.getPrimaryType) */
 export declare function primaryTypeOf(types: Record<string, Array<{
     name: string;
     type: string;
 }>>): string;
 /**
- * Wraps an ethers v6 Signer: sendTransaction, signTransaction and signTypedData ask Toll first. An EIP-7702
- * authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization (default: blocked).
- * `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
+ * Wraps an ethers v6 Signer: sendTransaction, signTransaction, signTypedData, signMessage and authorize() ask Toll
+ * first. An EIP-7702 authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization
+ * (default "check"). `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
  */
 export declare function guardEthers<T extends object>(signer: T, opts?: GuardOptions): T;
 /** true for a viem WalletClient (has `extend` and `request`), false for an ethers Signer */
 export declare const isViemClient: (x: unknown) => boolean;
+/** true for a viem bundler client (account abstraction): it has sendUserOperation */
+export declare const isBundlerClient: (x: unknown) => boolean;
 /**
- * Puts Toll's pre-sign check in front of a wallet. A viem WalletClient or an ethers v6 Signer; the wrapped wallet has
- * the same type and methods.
+ * Puts Toll's pre-sign check in front of a wallet: a viem bundler client (smart account), a viem WalletClient or an
+ * ethers v6 Signer; the wrapped wallet has the same type and methods.
  */
 export declare function guard<T extends object>(wallet: T, opts?: ViemGuardOptions): T;

package/dist/wallets.js

@@ -2,8 +2,8 @@
  * The wallet wrappers. Duck-typed: viem and ethers are optional peer dependencies, never imported at load time.
  * The wrapper is a Proxy: every other method and field of the client passes through unchanged.
  */
-import { isAddress } from "./check.js";
-import { enforce, gateAuthorization } from "./policy.js";
+import { chainIdOf, isAddress } from "./check.js";
+import { enforce, enforceCalls, gateAuthorization } from "./policy.js";
 /** wraps an object's methods; everything else passes through, bound to the original */
 function proxy(target, wrapped) {
     return new Proxy(target, {
@@ -26,6 +26,32 @@ const addrOf = (account) => {
     const a = account?.address;
     return isAddress(a) ? a : undefined;
 };
+/** a chain id as a number when it can be read, else as given (the check then calls it unreadable) */
+const chainOut = (v) => (v === undefined || v === null ? undefined : (chainIdOf(v) ?? v));
+const HEXDIGITS = "0123456789abcdef";
+const bytesHex = (b) => {
+    let s = "0x";
+    for (const x of b)
+        s += HEXDIGITS[x >> 4] + HEXDIGITS[x & 15];
+    return s;
+};
+/** a text message as the bytes a wallet signs (UTF-8), hex */
+const utf8Hex = (s) => bytesHex(new TextEncoder().encode(s));
+/** the request without its authorizationList (what is checked when onAuthorization "allow" let the list through) */
+const withoutAuths = (i) => {
+    const { authorizationList: _drop, ...rest } = i;
+    return rest;
+};
+/**
+ * One transaction: when it carries an authorizationList, onAuthorization decides first ("check": one Toll check of the
+ * whole transaction with its list, fail-closed; "block": refused; "allow": the list is let through and the rest is
+ * checked as usual).
+ */
+async function gateTx(where, build, auths, o) {
+    if (auths && (await gateAuthorization("transaction", where, build, o)))
+        return;
+    await enforce("transaction", async () => withoutAuths(await build()), o);
+}
 /* ------------------------------------------------------------------ viem */
 let viemEncode = null;
 async function loadViemEncode() {
@@ -38,11 +64,38 @@ async function loadViemEncode() {
     viemEncode = m.encodeFunctionData;
     return viemEncode;
 }
+/** a batch's calls as transactions: {to, data?, value?} or a contract call {to | address, abi, functionName, args} */
+async function callsOf(calls, chainId, from, o) {
+    if (!Array.isArray(calls))
+        throw new Error("calls must be an array");
+    const out = [];
+    for (const raw of calls) {
+        const k = (raw ?? {});
+        let data = typeof k.data === "string" ? k.data : "0x";
+        if (k.abi !== undefined && typeof k.functionName === "string") {
+            const enc = o.encodeFunctionData ?? (await loadViemEncode());
+            data = String(enc({ abi: k.abi, functionName: k.functionName, args: k.args }));
+            if (typeof k.dataSuffix === "string")
+                data += k.dataSuffix.replace(/^0x/, "");
+        }
+        out.push({ chainId: chainOut(chainId), from, to: k.to ?? k.address ?? undefined, data, value: k.value ?? 0n });
+    }
+    return out;
+}
+/** a viem / EIP-7702 authorization request as Toll reads it: one entry, the signer, the chain */
+function authInput(a, chainId, from) {
+    const address = a?.contractAddress ?? a?.address;
+    const entry = { address, chainId: chainOut(a?.chainId ?? chainId) };
+    if (a?.nonce !== undefined && a?.nonce !== null)
+        entry.nonce = a.nonce;
+    return { ...(chainId !== undefined && chainId !== null ? { chainId: chainOut(chainId) } : {}), from, authorizationList: [entry] };
+}
 /**
- * Wraps a viem WalletClient: sendTransaction, writeContract, signTransaction and signTypedData ask Toll first. An
- * EIP-7702 authorization (an authorizationList on any of them, or signAuthorization) goes to onAuthorization
- * (default: blocked). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded client, and the
- * account's own sign methods (client.account.sign*) are not wrapped.
+ * Wraps a viem WalletClient. Asks Toll first: sendTransaction, writeContract, signTransaction, signTypedData,
+ * signMessage, sendCalls (EIP-5792, each call), signAuthorization, and request() for eth_sendTransaction,
+ * eth_signTransaction, personal_sign, eth_sign, eth_signTypedData_v4 and wallet_sendCalls. An EIP-7702 authorization
+ * goes to onAuthorization (default "check"). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded
+ * client, and the account's own sign methods (client.account.sign*) are not wrapped.
  */
 export function guardViem(client, opts = {}) {
     const c = client;
@@ -54,50 +107,164 @@ export function guardViem(client, opts = {}) {
         to: args?.to ?? undefined,
         data: data ?? "0x",
         value: args?.value ?? 0n,
+        ...(hasAuthorizations(args) ? { authorizationList: args.authorizationList } : {}),
     });
+    const origin = opts.origin !== undefined ? { origin: opts.origin } : {};
     const wrapped = {};
-    if (typeof c.sendTransaction === "function") {
-        wrapped.sendTransaction = async (args, ...rest) => {
+    for (const m of ["sendTransaction", "signTransaction"]) {
+        if (typeof c[m] !== "function")
+            continue;
+        wrapped[m] = async (args, ...rest) => {
             // a deployment (no `to`) goes to the unsupported policy
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "sendTransaction", txInput(args, args?.data), opts);
-            await enforce("transaction", () => txInput(args, args?.data), opts);
-            return c.sendTransaction(args, ...rest);
-        };
-    }
-    if (typeof c.signTransaction === "function") {
-        wrapped.signTransaction = async (args, ...rest) => {
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "signTransaction", txInput(args, args?.data), opts);
-            await enforce("transaction", () => txInput(args, args?.data), opts);
-            return c.signTransaction(args, ...rest);
+            await gateTx(m, () => txInput(args, args?.data), hasAuthorizations(args), opts);
+            return c[m](args, ...rest);
         };
     }
     if (typeof c.writeContract === "function") {
         wrapped.writeContract = async (args, ...rest) => {
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "writeContract", null, opts);
-            await enforce("transaction", async () => {
+            await gateTx("writeContract", async () => {
                 const enc = opts.encodeFunctionData ?? (await loadViemEncode());
                 let data = String(enc({ abi: args.abi, functionName: args.functionName, args: args.args }));
                 if (typeof args.dataSuffix === "string")
                     data += args.dataSuffix.replace(/^0x/, "");
                 return txInput({ ...args, to: args.address }, data);
-            }, opts);
+            }, hasAuthorizations(args), opts);
             return c.writeContract(args, ...rest);
         };
     }
     if (typeof c.signTypedData === "function") {
         wrapped.signTypedData = async (args, ...rest) => {
             const td = { domain: args?.domain ?? {}, types: args?.types ?? {}, primaryType: args?.primaryType, message: args?.message ?? {} };
-            await enforce("typedData", () => ({ typedData: td }), opts);
+            await enforce("typedData", () => ({ typedData: td, ...origin }), opts);
             return c.signTypedData(args, ...rest);
         };
     }
+    if (typeof c.signMessage === "function") {
+        wrapped.signMessage = async (args, ...rest) => {
+            await enforce("message", () => {
+                const m = args?.message;
+                const raw = m && typeof m === "object" ? m.raw : undefined;
+                const data = typeof m === "string" ? utf8Hex(m) : typeof raw === "string" ? raw : raw instanceof Uint8Array ? bytesHex(raw) : null;
+                if (data === null)
+                    throw new Error("signMessage: message must be a string or {raw}");
+                const from = fromOf(args);
+                return { message: { kind: "personal_sign", data, ...(from ? { from } : {}) }, ...origin };
+            }, opts);
+            return c.signMessage(args, ...rest);
+        };
+    }
+    if (typeof c.sendCalls === "function") {
+        wrapped.sendCalls = async (args, ...rest) => {
+            await enforceCalls(() => callsOf(args?.calls, chainOf(args), fromOf(args), opts), opts);
+            return c.sendCalls(args, ...rest);
+        };
+    }
     if (typeof c.signAuthorization === "function") {
-        wrapped.signAuthorization = async (...args) => {
-            await gateAuthorization("transaction", "signAuthorization", null, opts);
-            return c.signAuthorization(...args);
+        wrapped.signAuthorization = async (args, ...rest) => {
+            await gateAuthorization("transaction", "signAuthorization", () => authInput(args, c.chain?.id, fromOf(args)), opts);
+            return c.signAuthorization(args, ...rest);
+        };
+    }
+    if (typeof c.request === "function") {
+        wrapped.request = async (args, ...rest) => {
+            await checkRequest(args, c, fromOf({}), opts);
+            return c.request(args, ...rest);
+        };
+    }
+    return proxy(client, wrapped);
+}
+/** the wallet RPC methods that sign: each asks Toll first; every other method passes through unchecked */
+async function checkRequest(args, c, from, o) {
+    const method = args?.method;
+    const params = Array.isArray(args?.params) ? args.params : [];
+    const origin = o.origin !== undefined ? { origin: o.origin } : {};
+    switch (method) {
+        case "personal_sign":
+        case "eth_sign":
+            await enforce("message", () => ({ rpc: { method, params }, ...origin }), o);
+            return;
+        case "eth_signTypedData_v4":
+            await enforce("typedData", () => ({ rpc: { method, params }, ...origin }), o);
+            return;
+        case "eth_sendTransaction":
+        case "eth_signTransaction": {
+            const tx = (params[0] ?? {});
+            const build = () => ({
+                chainId: chainOut(tx.chainId ?? c.chain?.id),
+                from: isAddress(tx.from) ? tx.from : from,
+                to: tx.to ?? undefined,
+                data: typeof tx.data === "string" ? tx.data : typeof tx.input === "string" ? tx.input : "0x",
+                value: tx.value ?? 0,
+                ...(hasAuthorizations(tx) ? { authorizationList: tx.authorizationList } : {}),
+            });
+            await gateTx(method, build, hasAuthorizations(tx), o);
+            return;
+        }
+        case "wallet_sendCalls": {
+            const p = (params[0] ?? {});
+            await enforceCalls(() => callsOf(p.calls, p.chainId ?? c.chain?.id, isAddress(p.from) ? p.from : from, o), o);
+            return;
+        }
+        default:
+            return;
+    }
+}
+/* ------------------------------------------------------------------ ERC-4337 smart accounts (viem account abstraction) */
+/** the user-operation fields passed on to Toll as given (bigints become decimal strings) */
+const USEROP_FIELDS = [
+    "factory",
+    "factoryData",
+    "initCode",
+    "paymaster",
+    "paymasterData",
+    "paymasterAndData",
+    "paymasterVerificationGasLimit",
+    "paymasterPostOpGasLimit",
+    "callGasLimit",
+    "verificationGasLimit",
+    "preVerificationGas",
+    "maxFeePerGas",
+    "maxPriorityFeePerGas",
+    "signature",
+];
+/**
+ * Wraps a viem bundler client (account abstraction): sendUserOperation and prepareUserOperation ask Toll first.
+ * `calls` are checked one by one as transactions from the smart account's address; a ready `callData` is sent as a
+ * user operation with the account's EntryPoint. An EIP-7702 `authorization` goes to onAuthorization.
+ */
+export function guardSmartAccount(client, opts = {}) {
+    const c = client;
+    const check = async (where, args) => {
+        const acct = args?.account ?? c.account;
+        const sender = addrOf(acct);
+        const chainId = args?.chain?.id ?? c.chain?.id;
+        if (args?.authorization)
+            await gateAuthorization("userOp", where, () => authInput(args.authorization, chainId, sender), opts);
+        if (Array.isArray(args?.calls)) {
+            await enforceCalls(() => callsOf(args.calls, chainId, sender, opts), opts);
+            return;
+        }
+        await enforce("userOp", async () => {
+            if (typeof args?.callData !== "string")
+                return {};
+            let nonce = args.nonce;
+            if ((nonce === undefined || nonce === null) && typeof acct?.getNonce === "function")
+                nonce = await acct.getNonce();
+            const op = { sender: isAddress(args.sender) ? args.sender : sender, nonce: nonce ?? 0n, callData: args.callData };
+            for (const k of USEROP_FIELDS)
+                if (args[k] !== undefined && args[k] !== null)
+                    op[k] = args[k];
+            const ep = acct?.entryPoint?.address ?? args.entryPointAddress;
+            return { userOp: op, ...(isAddress(ep) ? { entryPoint: ep } : {}) };
+        }, opts);
+    };
+    const wrapped = {};
+    for (const m of ["sendUserOperation", "prepareUserOperation"]) {
+        if (typeof c[m] !== "function")
+            continue;
+        wrapped[m] = async (args, ...rest) => {
+            await check(m, args);
+            return c[m](args, ...rest);
         };
     }
     return proxy(client, wrapped);
@@ -115,6 +282,10 @@ export function primaryTypeOf(types) {
         throw new Error(roots.length ? `ambiguous primary type: ${roots.join(", ")}` : "no primary type");
     return roots[0];
 }
+async function ethersChainId(signer) {
+    const net = typeof signer.provider?.getNetwork === "function" ? await signer.provider.getNetwork() : null;
+    return net?.chainId ?? undefined;
+}
 async function ethersTx(signer, tx) {
     let to = tx?.to;
     if (to && typeof to === "object" && typeof to.getAddress === "function")
@@ -127,10 +298,8 @@ async function ethersTx(signer, tx) {
         to = r;
     }
     let chainId = tx?.chainId;
-    if (chainId === undefined || chainId === null) {
-        const net = typeof signer.provider?.getNetwork === "function" ? await signer.provider.getNetwork() : null;
-        chainId = net?.chainId ?? undefined;
-    }
+    if (chainId === undefined || chainId === null)
+        chainId = await ethersChainId(signer);
     let from = tx?.from;
     if (from && typeof from === "object" && typeof from.getAddress === "function")
         from = await from.getAddress();
@@ -142,58 +311,74 @@ async function ethersTx(signer, tx) {
         to: (to ?? undefined),
         data: typeof tx?.data === "string" ? tx.data : "0x",
         value: tx?.value ?? 0n,
+        ...(hasAuthorizations(tx) ? { authorizationList: tx.authorizationList } : {}),
     };
 }
 /**
- * Wraps an ethers v6 Signer: sendTransaction, signTransaction and signTypedData ask Toll first. An EIP-7702
- * authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization (default: blocked).
- * `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
+ * Wraps an ethers v6 Signer: sendTransaction, signTransaction, signTypedData, signMessage and authorize() ask Toll
+ * first. An EIP-7702 authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization
+ * (default "check"). `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
  */
 export function guardEthers(signer, opts = {}) {
     const s = signer;
+    const origin = opts.origin !== undefined ? { origin: opts.origin } : {};
     const wrapped = {};
-    if (typeof s.sendTransaction === "function") {
-        wrapped.sendTransaction = async (tx, ...rest) => {
-            if (hasAuthorizations(tx))
-                await gateAuthorization("transaction", "sendTransaction", null, opts);
-            await enforce("transaction", () => ethersTx(s, tx), opts);
-            return s.sendTransaction(tx, ...rest);
-        };
-    }
-    if (typeof s.signTransaction === "function") {
-        wrapped.signTransaction = async (tx, ...rest) => {
-            if (hasAuthorizations(tx))
-                await gateAuthorization("transaction", "signTransaction", null, opts);
-            await enforce("transaction", () => ethersTx(s, tx), opts);
-            return s.signTransaction(tx, ...rest);
+    for (const m of ["sendTransaction", "signTransaction"]) {
+        if (typeof s[m] !== "function")
+            continue;
+        wrapped[m] = async (tx, ...rest) => {
+            await gateTx(m, () => ethersTx(s, tx), hasAuthorizations(tx), opts);
+            return s[m](tx, ...rest);
         };
     }
     if (typeof s.signTypedData === "function") {
         wrapped.signTypedData = async (domain, types, value, ...rest) => {
-            await enforce("typedData", () => ({ typedData: { domain: domain ?? {}, types: types ?? {}, primaryType: primaryTypeOf(types ?? {}), message: value ?? {} } }), opts);
+            await enforce("typedData", () => ({ typedData: { domain: domain ?? {}, types: types ?? {}, primaryType: primaryTypeOf(types ?? {}), message: value ?? {} }, ...origin }), opts);
             return s.signTypedData(domain, types, value, ...rest);
         };
     }
+    if (typeof s.signMessage === "function") {
+        wrapped.signMessage = async (message, ...rest) => {
+            await enforce("message", async () => {
+                // ethers signs a string as its UTF-8 bytes, even one that looks like hex
+                const data = typeof message === "string" ? utf8Hex(message) : message instanceof Uint8Array ? bytesHex(message) : null;
+                if (data === null)
+                    throw new Error("signMessage: message must be a string or bytes");
+                const from = typeof s.getAddress === "function" ? await s.getAddress() : undefined;
+                return { message: { kind: "personal_sign", data, ...(isAddress(from) ? { from } : {}) }, ...origin };
+            }, opts);
+            return s.signMessage(message, ...rest);
+        };
+    }
     if (typeof s.authorize === "function") {
-        wrapped.authorize = async (...args) => {
-            await gateAuthorization("transaction", "authorize", null, opts);
-            return s.authorize(...args);
+        wrapped.authorize = async (auth, ...rest) => {
+            await gateAuthorization("transaction", "authorize", async () => {
+                const chainId = chainOut(await ethersChainId(s));
+                const from = typeof s.getAddress === "function" ? await s.getAddress() : undefined;
+                return authInput(auth ?? {}, chainId, isAddress(from) ? from : undefined);
+            }, opts);
+            return s.authorize(auth, ...rest);
         };
     }
     return proxy(signer, wrapped);
 }
-/* ------------------------------------------------------------------ either */
+/* ------------------------------------------------------------------ any */
 /** true for a viem WalletClient (has `extend` and `request`), false for an ethers Signer */
 export const isViemClient = (x) => !!x && typeof x.extend === "function" && typeof x.request === "function";
+/** true for a viem bundler client (account abstraction): it has sendUserOperation */
+export const isBundlerClient = (x) => !!x && typeof x.sendUserOperation === "function";
 /**
- * Puts Toll's pre-sign check in front of a wallet. A viem WalletClient or an ethers v6 Signer; the wrapped wallet has
- * the same type and methods.
+ * Puts Toll's pre-sign check in front of a wallet: a viem bundler client (smart account), a viem WalletClient or an
+ * ethers v6 Signer; the wrapped wallet has the same type and methods.
  */
 export function guard(wallet, opts = {}) {
+    // a bundler client is also a viem client: it is detected first
+    if (isBundlerClient(wallet))
+        return guardSmartAccount(wallet, opts);
     if (isViemClient(wallet))
         return guardViem(wallet, opts);
     if (typeof wallet.getAddress === "function" && (typeof wallet.sendTransaction === "function" || typeof wallet.signTypedData === "function")) {
         return guardEthers(wallet, opts);
     }
-    throw new TypeError("guard(): pass a viem WalletClient or an ethers v6 Signer (or use guardViem / guardEthers).");
+    throw new TypeError("guard(): pass a viem WalletClient, a viem bundler client or an ethers v6 Signer (or use guardViem / guardSmartAccount / guardEthers).");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tollxyz/guard",
-  "version": "0.1.2",
-  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain. Zero runtime dependencies.",
+  "version": "0.3.0",
+  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, viem smart-account, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain: transactions, messages, typed data, batches, user operations, EIP-7702 authorizations. Zero runtime dependencies.",
   "license": "MIT",
   "author": "Toll",
   "type": "module",