@tollxyz/guard 0.2.0 → 0.3.0

package/README.md

@@ -1,12 +1,26 @@
 # @tollxyz/guard
 
+> **What changed in 0.3.0: every signing method is checked.**
+> - Messages: viem and ethers `signMessage`, and `request()` for `personal_sign` and `eth_sign`.
+> - Typed data: `request()` for `eth_signTypedData_v4` too, any EIP-712 (orders, permits, sign-ins).
+> - Batches: viem `sendCalls` (EIP-5792) and `request()` for `wallet_sendCalls`, each call checked.
+> - Smart accounts: `guardSmartAccount` wraps a viem bundler client's `sendUserOperation` and `prepareUserOperation`;
+>   `guard()` picks it for a bundler client.
+> - EIP-7702: `onAuthorization` now defaults to `"check"`: Toll reads the authorization and decides (a known, verified
+>   delegate is WARN medium and goes ahead under `block-high`; an unknown one is BLOCK). `"block"` and `"allow"` stay.
+>   An authorization Toll cannot read is blocked.
+> - A signature for another chain is blocked (before 0.3.0 it went through as unsupported); `onUnsupported: "allow"`
+>   lets it through.
+> - `eth_sign` always fails closed: it can sign any 32 bytes, a transaction included, so when Toll cannot answer it is
+>   blocked whatever `onUnavailable` says.
+
 > **Defaults changed in 0.2.0.** A WARN with any `high` or `critical` warning is now blocked (`onWarn: "block-high"`,
 > the new default); a WARN with only `medium`/`low` warnings still goes ahead, logged. To keep the 0.1.x behaviour,
 > pass `onWarn: "allow"`. New `strict: true` preset: WARN, unavailable and unsupported all block. Any option you pass
 > explicitly still wins over the preset (`{ strict: true, onUnavailable: "allow" }` stays fail-open).
 
-Toll's live pre-sign check in front of an AI agent's wallet. Before the agent signs a transaction, an EIP-712
-signature or an x402 payment on Robinhood Chain, the guard asks [Toll](https://t0ll.xyz/agents/x402#presign) and
+Toll's live pre-sign check in front of an AI agent's wallet. Before the agent signs a transaction, a message, an
+EIP-712 signature, a batch, a user operation, an EIP-7702 authorization or an x402 payment on Robinhood Chain, the guard asks [Toll](https://t0ll.xyz/agents/x402#presign) and
 gets ALLOW / WARN / BLOCK with the reasons. Zero runtime dependencies, ESM only, Node >= 20.19, with types.
 
 ```sh
@@ -14,7 +28,7 @@ npm install @tollxyz/guard
 ```
 
 ```ts
-const wallet = guard(walletClient);   // viem WalletClient or ethers v6 Signer; same methods, checked first
+const wallet = guard(walletClient);   // viem WalletClient, viem bundler client or ethers v6 Signer; same methods, checked first
 ```
 
 ```ts
@@ -62,23 +76,43 @@ The answer is an [ERC-8265](https://github.com/ethereum/ERCs/pull/1753) RiskAsse
 `{ action, warnings: [{ code, severity, message, "x-toll-evidence" }], scanners, "x-toll": { decoded, link, checked_at, note } }`.
 Critical = BLOCK, high or medium = WARN, low or none = ALLOW.
 
-Robinhood Chain (4663) only for now. A request on another chain, or a contract deployment, is not sent to Toll and
-goes through (`onUnsupported: "block"` to stop it instead).
+Robinhood Chain (4663) only for now. A transaction on another chain, or a contract deployment, is not sent to Toll
+and goes through (`onUnsupported: "block"` to stop it instead). A signature for another chain is blocked
+(`onUnsupported: "allow"` lets it through).
 
 ## API
 
-### `guard(wallet, opts?)`, `guardViem(client, opts?)`, `guardEthers(signer, opts?)`
+### `guard(wallet, opts?)`, `guardViem(client, opts?)`, `guardSmartAccount(bundler, opts?)`, `guardEthers(signer, opts?)`
 
 Returns the same wallet behind a Proxy. Checked first:
 
 - viem WalletClient: `sendTransaction`, `writeContract` (calldata encoded with your viem's `encodeFunctionData`),
-  `signTransaction`, `signTypedData`
-- ethers v6 Signer: `sendTransaction`, `signTransaction`, `signTypedData`
+  `signTransaction`, `signTypedData`, `signMessage`, `sendCalls`, `signAuthorization`, and `request()` for
+  `eth_sendTransaction`, `eth_signTransaction`, `personal_sign`, `eth_sign`, `eth_signTypedData_v4` and
+  `wallet_sendCalls` (every other method passes through)
+- viem bundler client (account abstraction): `sendUserOperation`, `prepareUserOperation`. `calls` are checked one by
+  one as transactions from the smart account's address; a ready `callData` is sent as a user operation with the
+  account's EntryPoint
+- ethers v6 Signer: `sendTransaction`, `signTransaction`, `signTypedData`, `signMessage`, `authorize`
+
+A batch is checked call by call, in order; the first call blocked stops the whole batch.
+
+An EIP-7702 authorization sets the wallet's code to another contract, which can then move everything it holds: a
+transaction with an `authorizationList` on any method above, viem's `signAuthorization`, ethers' `authorize`, a user
+operation's `authorization`. By default (`onAuthorization: "check"`) Toll reads it and decides; if Toll cannot read it
+(unreachable, another chain) it is blocked (TollBlockedError, code `eip7702-authorization`). `"block"` refuses every
+authorization without asking; `"allow"` lets it through unchecked. The account's own sign methods
+(`client.account.sign*`) are not wrapped.
 
-An EIP-7702 authorization sets the wallet's code to another contract, which can then move everything it holds. Toll
-does not read one yet, so the guard blocks it itself (TollBlockedError, code `eip7702-authorization`) unless
-`onAuthorization: "allow"`: a transaction with an `authorizationList` on any method above, viem's
-`signAuthorization` and ethers' `authorize`. The account's own sign methods (`client.account.sign*`) are not wrapped.
+```ts
+const wallet = guard(walletClient, { origin: "https://app.example" }); // origin: the site asking, for sign-ins
+await wallet.signMessage({ message: "Sign in to app.example" });     // checked as personal_sign
+await wallet.request({ method: "personal_sign", params: [hexMessage, address] });
+await wallet.request({ method: "eth_sign", params: [address, hash] }); // blocked when Toll blocks it, or cannot answer
+
+const smart = guard(bundlerClient);                                    // detected by sendUserOperation
+await smart.sendUserOperation({ calls: [{ to: token, abi: erc20Abi, functionName: "transfer", args: [to, amount] }] });
+```
 
 Everything else passes through unchanged. Wrap last: `client.extend(...)` or `signer.connect(...)` on the wrapped
 wallet returns an unguarded one. viem and ethers are optional peer dependencies, never imported at load time.
@@ -102,8 +136,12 @@ const pay = wrapFetchWithPayment(guardX402Fetch(fetch, { agentId: 123 }), accoun
 
 ### `checkTx(input, opts?)`
 
-The raw call. `input`: `{ chainId, from, to, data, value }` for a transaction, `{ typedData }` for an EIP-712
-request, `{ x402, agentId?, payment? }` for an x402 payment, or several together. Returns the RiskAssessment. When a
+The raw call. `input`: `{ chainId, from, to, data, value, authorizationList? }` for a transaction,
+`{ chainId, from, authorizationList }` for an authorization alone, `{ typedData }` for an EIP-712 request,
+`{ message: { kind: "personal_sign" | "eth_sign", data, from? } }` for a message, `{ rpc: { method, params } }` for a
+wallet request (`personal_sign`, `eth_sign`, `eth_signTypedData_v4`, `eth_sendTransaction`), `{ userOp, entryPoint? }`
+for an ERC-4337 user operation, `{ x402, agentId?, payment? }` for an x402 payment, or several together; `origin` is
+the site asking. Returns the RiskAssessment. When a
 coin is still being read, Toll answers WARN `coin-not-read` with `Retry-After`: `checkTx` asks once more if the wait
 is at most `maxRetryWaitMs` (default 10 s); a coin still not read stays WARN, never ALLOW. Throws
 `TollUnavailableError` when Toll cannot answer.
@@ -116,8 +154,9 @@ is at most `maxRetryWaitMs` (default 10 s); a coin still not read stays WARN, ne
 | `onWarn` | `"block-high"` | `"block-high"` (blocked when any warning is `high` or `critical`, else allowed and logged), `"allow"` (every WARN goes ahead, logged; the 0.1.x default), `"block"`, or `(assessment) => boolean` (true lets it through) |
 | `onBlock` | `"throw"` | `"throw"` (TollBlockedError), or `(assessment) => boolean`, e.g. ask a human; true lets it through |
 | `onUnavailable` | `"allow"` (`strict`: `"block"`) | Toll unreachable, timed out, 5xx, 429, or a request it could not read: `"allow"` (fail-open, logged) or `"block"` (fail-closed, TollUnavailableError) |
-| `onUnsupported` | `"allow"` (`strict`: `"block"`) | another chain, a deployment: `"allow"` or `"block"` |
-| `onAuthorization` | `"block"` | an EIP-7702 authorization: `"block"` (TollBlockedError) or `"allow"` (unchecked, logged) |
+| `onUnsupported` | `"allow"` (`strict`: `"block"`) | a transaction on another chain, a deployment: `"allow"` or `"block"`. A signature for another chain is blocked unless this is `"allow"` explicitly |
+| `onAuthorization` | `"check"` | an EIP-7702 authorization: `"check"` (Toll decides; blocked when Toll cannot read it), `"block"` (TollBlockedError, Toll not asked) or `"allow"` (unchecked, logged) |
+| `origin` | none | the site asking for a signature, sent with messages and typed data |
 | `onReport` | none | `(report) => void`: every decision, with `assessment`, `decision`, `basis`, `paidUrl` |
 | `logger` | `console.warn` | where WARN and unavailable lines go; `false` = silent |
 | `timeoutMs` | `15000` | one request to Toll |
@@ -134,6 +173,9 @@ line and an `onReport` call with `basis: "unavailable"`. The agent must never ge
 free route is rate limited per IP (a busy agent will see 429s). If an unchecked signature is worse for you than a
 stalled agent, set `onUnavailable: "block"` (or `strict: true`, which also blocks every WARN and unsupported request).
 
+Two requests fail closed whatever `onUnavailable` says: `eth_sign` (it signs any 32 bytes, a transaction hash
+included, so an unchecked one could be anything) and an EIP-7702 authorization under `onAuthorization: "check"`.
+
 ## Free limit and the paid route
 
 The check is free, rate limited per IP. The coin a swap buys is read through the same free coins as Toll's coin

package/dist/check.d.ts

@@ -61,8 +61,22 @@ export interface TypedDataLike {
     primaryType: string;
     message: Record<string, unknown>;
 }
+/** A personal_sign / eth_sign message: data is hex (the bytes signed) or text. */
+export interface SignMessageLike {
+    kind: "personal_sign" | "eth_sign";
+    data: string;
+    origin?: string;
+    from?: string;
+}
+/** A wallet RPC request Toll reads as the body it stands for: personal_sign, eth_sign, eth_signTypedData_v4, eth_sendTransaction. */
+export interface RpcLike {
+    method: string;
+    params?: readonly unknown[];
+}
 /**
- * What to check. A transaction ({chainId, from, to, data, value}), an EIP-712 request ({typedData}), an x402 payment
+ * What to check. A transaction ({chainId, from, to, data, value}, with an EIP-7702 authorizationList or not), an
+ * authorization list alone ({chainId, from, authorizationList}), an EIP-712 request ({typedData}), a message
+ * ({message}), a wallet request ({rpc}), an ERC-4337 user operation ({userOp, entryPoint?}), an x402 payment
  * ({x402, agentId?, payment?}), or several together.
  */
 export interface CheckInput {
@@ -71,7 +85,17 @@ export interface CheckInput {
     to?: string;
     data?: string;
     value?: Numberish;
+    /** EIP-7702 authorizations: with to/data a type-4 transaction, alone a signAuthorization */
+    authorizationList?: readonly unknown[];
     typedData?: TypedDataLike;
+    message?: SignMessageLike;
+    rpc?: RpcLike;
+    /** an ERC-4337 user operation (v0.6, v0.7 packed or the RPC form) */
+    userOp?: Record<string, unknown>;
+    /** the user operation's EntryPoint */
+    entryPoint?: string;
+    /** the site asking for the signature (a URL or host name) */
+    origin?: string;
     /** the 402's PaymentRequired, or one of its accepts entries */
     x402?: Record<string, unknown>;
     /** the seller's ERC-8004 agent id, when known */

package/dist/check.js

@@ -61,6 +61,7 @@ const trimBase = (b) => b.replace(/\/+$/, "");
 /** the request body as the route reads it (lib/txcheck.ts parseTxCheckBody): payment rides inside x402 */
 export function bodyOf(input) {
     const b = {};
+    const auths = input.authorizationList !== undefined && input.authorizationList !== null && input.authorizationList.length > 0;
     if (input.to !== undefined || input.data !== undefined) {
         if (input.chainId !== undefined)
             b.chainId = input.chainId;
@@ -69,9 +70,30 @@ export function bodyOf(input) {
         b.to = input.to;
         b.data = input.data ?? "0x";
         b.value = input.value ?? 0;
+        if (auths)
+            b.authorizationList = input.authorizationList;
+    }
+    else if (auths) {
+        // a signAuthorization alone: the list and its signer
+        if (input.chainId !== undefined)
+            b.chainId = input.chainId;
+        if (input.from !== undefined)
+            b.from = input.from;
+        b.authorizationList = input.authorizationList;
     }
     if (input.typedData)
         b.typedData = input.typedData;
+    if (input.message)
+        b.message = input.message;
+    if (input.rpc)
+        b.rpc = input.rpc;
+    if (input.userOp) {
+        b.userOp = input.userOp;
+        if (input.entryPoint !== undefined)
+            b.entryPoint = input.entryPoint;
+    }
+    if (input.origin !== undefined)
+        b.origin = input.origin;
     if (input.x402)
         b.x402 = input.payment ? { ...input.x402, payment: input.payment } : input.x402;
     if (input.agentId !== undefined && input.agentId !== null)

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { checkTx, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
-export type { Action, Severity, RiskWarning, ScannerVerdict, TollExtra, RiskAssessment, CheckInput, CheckOptions, TypedDataLike, FetchLike, Hex, Numberish, UnavailableReason, } from "./check.js";
-export { enforce, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning } from "./policy.js";
+export { checkTx, bodyOf, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
+export type { Action, Severity, RiskWarning, ScannerVerdict, TollExtra, RiskAssessment, SignMessageLike, RpcLike, CheckInput, CheckOptions, TypedDataLike, FetchLike, Hex, Numberish, UnavailableReason, } from "./check.js";
+export { enforce, enforceCalls, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning, isSignature, isEthSign } from "./policy.js";
 export type { GuardOptions, GuardReport, GuardKind, WarnPolicy, BlockPolicy } from "./policy.js";
-export { guard, guardViem, guardEthers, isViemClient, primaryTypeOf } from "./wallets.js";
+export { guard, guardViem, guardEthers, guardSmartAccount, isViemClient, isBundlerClient, primaryTypeOf } from "./wallets.js";
 export type { ViemGuardOptions } from "./wallets.js";
 export { guardX402Fetch, readPaymentRequired, readPaymentForms, paymentFormsDiffer } from "./x402.js";
 export type { X402GuardOptions } from "./x402.js";

package/dist/index.js

@@ -1,5 +1,5 @@
-export { checkTx, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
-export { enforce, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning } from "./policy.js";
-export { guard, guardViem, guardEthers, isViemClient, primaryTypeOf } from "./wallets.js";
+export { checkTx, bodyOf, chainIdOf, paidUrlOf, isAssessment, TollBlockedError, TollUnavailableError, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRY_WAIT_MS, PAID_TX_PATH, PRESIGN_DOCS, TX_CHAIN_ID, } from "./check.js";
+export { enforce, enforceCalls, unsupportedWhy, refuse, gateAuthorization, resolvePolicy, hasHighWarning, isSignature, isEthSign } from "./policy.js";
+export { guard, guardViem, guardEthers, guardSmartAccount, isViemClient, isBundlerClient, primaryTypeOf } from "./wallets.js";
 export { guardX402Fetch, readPaymentRequired, readPaymentForms, paymentFormsDiffer } from "./x402.js";
 export { read8470, latestFinding8470, decodeGetObservation, decodeLatestFinding, encodeGetObservation, encodeLatestByToken, encodeLatestFinding, FINDING_KINDS, NOT_READ, OBS_REGISTRY, OBS_DETECTOR, OBS_CHAIN_ID, RH_RPC, } from "./erc8470.js";

package/dist/policy.d.ts

@@ -1,7 +1,7 @@
 import { TollUnavailableError, type CheckInput, type CheckOptions, type RiskAssessment } from "./check.js";
 export type WarnPolicy = "allow" | "block" | "block-high" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
 export type BlockPolicy = "throw" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
-export type GuardKind = "transaction" | "typedData" | "x402";
+export type GuardKind = "transaction" | "typedData" | "x402" | "message" | "userOp" | "calls";
 export interface GuardReport {
     kind: GuardKind;
     /** what was sent to Toll (null when nothing was sent) */
@@ -44,10 +44,15 @@ export interface GuardOptions extends CheckOptions {
     agentId?: number | string | ((url: string) => number | string | undefined | null);
     /**
      * An EIP-7702 authorization (a transaction's authorizationList, signAuthorization / authorize): it sets the
-     * wallet's code to another contract, which can then move everything the wallet holds. Toll does not read one yet.
-     * "block" (default): TollBlockedError, nothing is signed. "allow": let it through unchecked (logged, reported).
+     * wallet's code to another contract, which can then move everything the wallet holds.
+     * "check" (default since 0.3.0): Toll reads it and decides (a known, verified delegate comes back WARN medium and
+     * passes under onWarn "block-high"; an unknown one comes back BLOCK). It fails closed: when Toll cannot read it
+     * (unreachable, another chain, a request it refuses) it is blocked, whatever onUnavailable / onUnsupported say.
+     * "block": TollBlockedError, nothing is signed, Toll is not asked. "allow": let it through unchecked (logged, reported).
      */
-    onAuthorization?: "block" | "allow";
+    onAuthorization?: "check" | "block" | "allow";
+    /** the site asking for a signature (a URL or host name), sent with messages so Toll can match a sign-in's domain */
+    origin?: string;
 }
 /** the effective policy: explicit options win, then the strict preset, then the defaults */
 export declare function resolvePolicy(o?: GuardOptions): {
@@ -57,6 +62,10 @@ export declare function resolvePolicy(o?: GuardOptions): {
 };
 /** true when any warning is high or critical */
 export declare const hasHighWarning: (a: RiskAssessment) => boolean;
+/** true for a signature request (typed data, a message, a signing RPC) rather than a transaction or an x402 payment */
+export declare const isSignature: (input: CheckInput | null | undefined) => boolean;
+/** true for eth_sign: it signs any 32 bytes (a transaction hash included), so it fails closed when Toll cannot answer */
+export declare const isEthSign: (input: CheckInput | null | undefined) => boolean;
 /** why Toll would not read this request, or null when it does */
 export declare function unsupportedWhy(input: CheckInput): string | null;
 /**
@@ -70,5 +79,15 @@ export declare function enforce(kind: GuardKind, build: () => CheckInput | Promi
  * disagree): reported as a BLOCK with one critical warning, then TollBlockedError. Nothing is sent to Toll.
  */
 export declare function refuse(kind: GuardKind, input: CheckInput | null, code: string, message: string, o?: GuardOptions): Promise<never>;
-/** the onAuthorization policy for an EIP-7702 authorization: resolves when it may go ahead, else throws */
-export declare function gateAuthorization(kind: GuardKind, where: string, input: CheckInput | null, o?: GuardOptions): Promise<void>;
+/**
+ * The onAuthorization policy for an EIP-7702 authorization. Resolves true when Toll checked the whole request (the
+ * "check" default: the caller asks nothing more), false when "allow" let it through unchecked (the caller still checks
+ * the rest of the request); throws when it is blocked. `input` is the request with its authorizationList, or a function
+ * that builds it; under "check", null is blocked (nothing to send).
+ */
+export declare function gateAuthorization(kind: GuardKind, where: string, input: CheckInput | null | (() => CheckInput | Promise<CheckInput>), o?: GuardOptions): Promise<boolean>;
+/**
+ * A batch (EIP-5792 sendCalls, wallet_sendCalls, a smart account's calls): each call is checked as its own transaction
+ * from the batch's sender, in order; the first one blocked stops the batch. Reports carry kind "calls".
+ */
+export declare function enforceCalls(build: () => CheckInput[] | Promise<CheckInput[]>, o?: GuardOptions): Promise<GuardReport[]>;

package/dist/policy.js

@@ -31,9 +31,49 @@ async function report(o, r) {
         say(o, `onReport threw: ${e?.message ?? e}`);
     }
 }
+const SIGN_RPC = new Set(["personal_sign", "eth_sign", "eth_signTypedData_v4"]);
+/** the typed data a request signs: its typedData, or an eth_signTypedData_v4 request's params[1] (JSON or object) */
+function typedOf(input) {
+    if (input.typedData)
+        return input.typedData;
+    if (input.rpc?.method !== "eth_signTypedData_v4")
+        return null;
+    let td = input.rpc.params?.[1];
+    if (typeof td === "string") {
+        try {
+            td = JSON.parse(td);
+        }
+        catch {
+            return null;
+        }
+    }
+    return td && typeof td === "object" ? td : null;
+}
+/** true for a signature request (typed data, a message, a signing RPC) rather than a transaction or an x402 payment */
+export const isSignature = (input) => !!input && !input.x402 && (!!input.typedData || !!input.message || SIGN_RPC.has(String(input.rpc?.method)));
+/** true for eth_sign: it signs any 32 bytes (a transaction hash included), so it fails closed when Toll cannot answer */
+export const isEthSign = (input) => input?.message?.kind === "eth_sign" || input?.rpc?.method === "eth_sign";
+/** the other chain a typed-data signature names (its domain chainId), or null (Robinhood Chain, none, or an x402 payment) */
+function otherChainSignature(input) {
+    if (input.x402)
+        return null;
+    const c = typedOf(input)?.domain?.chainId;
+    const cid = c === undefined || c === null ? null : chainIdOf(c);
+    return cid !== null && cid !== TX_CHAIN_ID ? cid : null;
+}
+/** Toll's 400 for a request on another chain ("... chainId N is not read ...") */
+const OTHER_CHAIN_400 = /chainId \d+ is not read/;
 /** why Toll would not read this request, or null when it does */
 export function unsupportedWhy(input) {
     const tx = input.to !== undefined || input.data !== undefined;
+    const auths = !!input.authorizationList && input.authorizationList.length > 0;
+    if (!tx && auths) {
+        const cid = input.chainId === undefined ? null : chainIdOf(input.chainId);
+        if (input.chainId !== undefined && cid === null)
+            return "the chain id could not be read";
+        if (cid !== null && cid !== TX_CHAIN_ID)
+            return `chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
+    }
     if (tx) {
         if (input.to === undefined || input.to === null)
             return "a contract deployment (no `to`) is not read";
@@ -43,13 +83,10 @@ export function unsupportedWhy(input) {
         if (cid !== null && cid !== TX_CHAIN_ID)
             return `chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
     }
-    if (input.typedData && !input.x402) {
-        const c = input.typedData.domain?.chainId;
-        const cid = c === undefined || c === null ? null : chainIdOf(c);
-        if (cid !== null && cid !== TX_CHAIN_ID)
-            return `a signature for chain ${cid} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
-    }
-    if (!tx && !input.typedData && !input.x402)
+    const other = otherChainSignature(input);
+    if (other !== null)
+        return `a signature for chain ${other} is not read (Robinhood Chain ${TX_CHAIN_ID} only for now)`;
+    if (!tx && !auths && !input.typedData && !input.x402 && !input.message && !input.rpc && !input.userOp)
         return "nothing to check";
     return null;
 }
@@ -68,6 +105,10 @@ export async function enforce(kind, build, o = {}) {
         return unavailable(kind, null, err, o);
     }
     const why = unsupportedWhy(input);
+    // a signature for another chain is not "unsupported -> allow": an off-chain signature Toll cannot read is refused
+    if (why && isSignature(input) && otherChainSignature(input) !== null && o.onUnsupported !== "allow") {
+        return refuse(kind, input, "signature-other-chain", `Not signed: ${why}. A signature Toll cannot read could hand over anything; onUnsupported: "allow" lets it through unchecked.`, o);
+    }
     if (why) {
         const blocked = resolvePolicy(o).onUnsupported === "block";
         const r = { kind, input, assessment: null, decision: blocked ? "blocked" : "allowed", basis: "unsupported", paidUrl: null };
@@ -82,6 +123,10 @@ export async function enforce(kind, build, o = {}) {
     }
     catch (e) {
         const err = e instanceof TollUnavailableError ? e : new TollUnavailableError(`Toll's check failed: ${e?.message ?? e}`, { reason: "network", cause: e });
+        // Toll's 400 for a signature on another chain: blocked, never "unsupported -> allow"
+        if (err.reason === "bad-request" && isSignature(input) && OTHER_CHAIN_400.test(err.message) && o.onUnsupported !== "allow") {
+            return refuse(kind, input, "signature-other-chain", `Not signed: Toll does not read a signature for another chain (${err.message}). onUnsupported: "allow" lets it through unchecked.`, o);
+        }
         return unavailable(kind, input, err, o);
     }
     const paidUrl = paidUrlOf(a);
@@ -112,7 +157,8 @@ export async function enforce(kind, build, o = {}) {
     throw new TollBlockedError(a, "WARN");
 }
 async function unavailable(kind, input, err, o) {
-    const blocked = resolvePolicy(o).onUnavailable === "block";
+    // eth_sign signs any 32 bytes (a transaction hash included): it always fails closed
+    const blocked = resolvePolicy(o).onUnavailable === "block" || isEthSign(input);
     const r = { kind, input, assessment: null, decision: blocked ? "blocked" : "allowed", basis: "unavailable", paidUrl: err.paidUrl, error: err };
     await report(o, r);
     if (blocked)
@@ -129,12 +175,53 @@ export async function refuse(kind, input, code, message, o = {}) {
     await report(o, { kind, input, assessment: a, decision: "blocked", basis: "BLOCK", paidUrl: null });
     throw new TollBlockedError(a, "BLOCK");
 }
-/** the onAuthorization policy for an EIP-7702 authorization: resolves when it may go ahead, else throws */
+/**
+ * The onAuthorization policy for an EIP-7702 authorization. Resolves true when Toll checked the whole request (the
+ * "check" default: the caller asks nothing more), false when "allow" let it through unchecked (the caller still checks
+ * the rest of the request); throws when it is blocked. `input` is the request with its authorizationList, or a function
+ * that builds it; under "check", null is blocked (nothing to send).
+ */
 export async function gateAuthorization(kind, where, input, o = {}) {
-    if (o.onAuthorization === "allow") {
+    const p = o.onAuthorization ?? "check";
+    const shown = typeof input === "function" ? null : input;
+    if (p === "allow") {
         say(o, `EIP-7702 authorization (${where}) NOT checked, going ahead (onAuthorization "allow")`);
-        await report(o, { kind, input, assessment: null, decision: "allowed", basis: "unsupported", paidUrl: null });
-        return;
+        await report(o, { kind, input: shown, assessment: null, decision: "allowed", basis: "unsupported", paidUrl: null });
+        return false;
+    }
+    const what = `${where} carries an EIP-7702 authorization, which sets this wallet's code to another contract that can then move everything it holds.`;
+    if (p === "block" || input === null) {
+        return refuse(kind, shown, "eip7702-authorization", `${what} ${p === "block" ? 'onAuthorization is "block"' : "It could not be read for Toll's check"}; onAuthorization: "allow" lets it through unchecked.`, o);
+    }
+    const build = typeof input === "function" ? input : () => input;
+    try {
+        // fail closed: an authorization Toll could not read is not signed
+        await enforce(kind, build, { ...o, onUnavailable: "block", onUnsupported: "block" });
+    }
+    catch (e) {
+        if (!(e instanceof TollUnavailableError))
+            throw e;
+        return refuse(kind, null, "eip7702-authorization", `${what} Toll could not read it (${e.message}), so it is not signed; onAuthorization: "allow" lets it through unchecked.`, o);
+    }
+    return true;
+}
+/**
+ * A batch (EIP-5792 sendCalls, wallet_sendCalls, a smart account's calls): each call is checked as its own transaction
+ * from the batch's sender, in order; the first one blocked stops the batch. Reports carry kind "calls".
+ */
+export async function enforceCalls(build, o = {}) {
+    let calls;
+    try {
+        calls = await build();
+    }
+    catch (e) {
+        const err = e instanceof TollUnavailableError ? e : new TollUnavailableError(`The batch could not be read for Toll's check: ${e?.message ?? e}`, { reason: "encode", cause: e });
+        return [await unavailable("calls", null, err, o)];
     }
-    await refuse(kind, input, "eip7702-authorization", `${where} carries an EIP-7702 authorization, which sets this wallet's code to another contract that can then move everything it holds. Toll does not read authorizations yet; onAuthorization: "allow" lets it through unchecked.`, o);
+    if (!calls.length)
+        return [await enforce("calls", () => ({}), o)];
+    const out = [];
+    for (const c of calls)
+        out.push(await enforce("calls", () => c, o));
+    return out;
 }

package/dist/wallets.d.ts

@@ -6,8 +6,8 @@ import { type Hex } from "./check.js";
 import { type GuardOptions } from "./policy.js";
 export interface ViemGuardOptions extends GuardOptions {
     /**
-     * Encodes writeContract calldata. Default: viem's own encodeFunctionData, loaded on first use (viem is installed
-     * wherever a viem WalletClient is).
+     * Encodes writeContract (and contract-call batch) calldata. Default: viem's own encodeFunctionData, loaded on first
+     * use (viem is installed wherever a viem client is).
      */
     encodeFunctionData?: (args: {
         abi: unknown;
@@ -16,27 +16,36 @@ export interface ViemGuardOptions extends GuardOptions {
     }) => Hex | string;
 }
 /**
- * Wraps a viem WalletClient: sendTransaction, writeContract, signTransaction and signTypedData ask Toll first. An
- * EIP-7702 authorization (an authorizationList on any of them, or signAuthorization) goes to onAuthorization
- * (default: blocked). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded client, and the
- * account's own sign methods (client.account.sign*) are not wrapped.
+ * Wraps a viem WalletClient. Asks Toll first: sendTransaction, writeContract, signTransaction, signTypedData,
+ * signMessage, sendCalls (EIP-5792, each call), signAuthorization, and request() for eth_sendTransaction,
+ * eth_signTransaction, personal_sign, eth_sign, eth_signTypedData_v4 and wallet_sendCalls. An EIP-7702 authorization
+ * goes to onAuthorization (default "check"). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded
+ * client, and the account's own sign methods (client.account.sign*) are not wrapped.
  */
 export declare function guardViem<T extends object>(client: T, opts?: ViemGuardOptions): T;
+/**
+ * Wraps a viem bundler client (account abstraction): sendUserOperation and prepareUserOperation ask Toll first.
+ * `calls` are checked one by one as transactions from the smart account's address; a ready `callData` is sent as a
+ * user operation with the account's EntryPoint. An EIP-7702 `authorization` goes to onAuthorization.
+ */
+export declare function guardSmartAccount<T extends object>(client: T, opts?: ViemGuardOptions): T;
 /** the EIP-712 primary type: the one type no other type refers to (as ethers' TypedDataEncoder.getPrimaryType) */
 export declare function primaryTypeOf(types: Record<string, Array<{
     name: string;
     type: string;
 }>>): string;
 /**
- * Wraps an ethers v6 Signer: sendTransaction, signTransaction and signTypedData ask Toll first. An EIP-7702
- * authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization (default: blocked).
- * `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
+ * Wraps an ethers v6 Signer: sendTransaction, signTransaction, signTypedData, signMessage and authorize() ask Toll
+ * first. An EIP-7702 authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization
+ * (default "check"). `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
  */
 export declare function guardEthers<T extends object>(signer: T, opts?: GuardOptions): T;
 /** true for a viem WalletClient (has `extend` and `request`), false for an ethers Signer */
 export declare const isViemClient: (x: unknown) => boolean;
+/** true for a viem bundler client (account abstraction): it has sendUserOperation */
+export declare const isBundlerClient: (x: unknown) => boolean;
 /**
- * Puts Toll's pre-sign check in front of a wallet. A viem WalletClient or an ethers v6 Signer; the wrapped wallet has
- * the same type and methods.
+ * Puts Toll's pre-sign check in front of a wallet: a viem bundler client (smart account), a viem WalletClient or an
+ * ethers v6 Signer; the wrapped wallet has the same type and methods.
  */
 export declare function guard<T extends object>(wallet: T, opts?: ViemGuardOptions): T;

package/dist/wallets.js

@@ -2,8 +2,8 @@
  * The wallet wrappers. Duck-typed: viem and ethers are optional peer dependencies, never imported at load time.
  * The wrapper is a Proxy: every other method and field of the client passes through unchanged.
  */
-import { isAddress } from "./check.js";
-import { enforce, gateAuthorization } from "./policy.js";
+import { chainIdOf, isAddress } from "./check.js";
+import { enforce, enforceCalls, gateAuthorization } from "./policy.js";
 /** wraps an object's methods; everything else passes through, bound to the original */
 function proxy(target, wrapped) {
     return new Proxy(target, {
@@ -26,6 +26,32 @@ const addrOf = (account) => {
     const a = account?.address;
     return isAddress(a) ? a : undefined;
 };
+/** a chain id as a number when it can be read, else as given (the check then calls it unreadable) */
+const chainOut = (v) => (v === undefined || v === null ? undefined : (chainIdOf(v) ?? v));
+const HEXDIGITS = "0123456789abcdef";
+const bytesHex = (b) => {
+    let s = "0x";
+    for (const x of b)
+        s += HEXDIGITS[x >> 4] + HEXDIGITS[x & 15];
+    return s;
+};
+/** a text message as the bytes a wallet signs (UTF-8), hex */
+const utf8Hex = (s) => bytesHex(new TextEncoder().encode(s));
+/** the request without its authorizationList (what is checked when onAuthorization "allow" let the list through) */
+const withoutAuths = (i) => {
+    const { authorizationList: _drop, ...rest } = i;
+    return rest;
+};
+/**
+ * One transaction: when it carries an authorizationList, onAuthorization decides first ("check": one Toll check of the
+ * whole transaction with its list, fail-closed; "block": refused; "allow": the list is let through and the rest is
+ * checked as usual).
+ */
+async function gateTx(where, build, auths, o) {
+    if (auths && (await gateAuthorization("transaction", where, build, o)))
+        return;
+    await enforce("transaction", async () => withoutAuths(await build()), o);
+}
 /* ------------------------------------------------------------------ viem */
 let viemEncode = null;
 async function loadViemEncode() {
@@ -38,11 +64,38 @@ async function loadViemEncode() {
     viemEncode = m.encodeFunctionData;
     return viemEncode;
 }
+/** a batch's calls as transactions: {to, data?, value?} or a contract call {to | address, abi, functionName, args} */
+async function callsOf(calls, chainId, from, o) {
+    if (!Array.isArray(calls))
+        throw new Error("calls must be an array");
+    const out = [];
+    for (const raw of calls) {
+        const k = (raw ?? {});
+        let data = typeof k.data === "string" ? k.data : "0x";
+        if (k.abi !== undefined && typeof k.functionName === "string") {
+            const enc = o.encodeFunctionData ?? (await loadViemEncode());
+            data = String(enc({ abi: k.abi, functionName: k.functionName, args: k.args }));
+            if (typeof k.dataSuffix === "string")
+                data += k.dataSuffix.replace(/^0x/, "");
+        }
+        out.push({ chainId: chainOut(chainId), from, to: k.to ?? k.address ?? undefined, data, value: k.value ?? 0n });
+    }
+    return out;
+}
+/** a viem / EIP-7702 authorization request as Toll reads it: one entry, the signer, the chain */
+function authInput(a, chainId, from) {
+    const address = a?.contractAddress ?? a?.address;
+    const entry = { address, chainId: chainOut(a?.chainId ?? chainId) };
+    if (a?.nonce !== undefined && a?.nonce !== null)
+        entry.nonce = a.nonce;
+    return { ...(chainId !== undefined && chainId !== null ? { chainId: chainOut(chainId) } : {}), from, authorizationList: [entry] };
+}
 /**
- * Wraps a viem WalletClient: sendTransaction, writeContract, signTransaction and signTypedData ask Toll first. An
- * EIP-7702 authorization (an authorizationList on any of them, or signAuthorization) goes to onAuthorization
- * (default: blocked). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded client, and the
- * account's own sign methods (client.account.sign*) are not wrapped.
+ * Wraps a viem WalletClient. Asks Toll first: sendTransaction, writeContract, signTransaction, signTypedData,
+ * signMessage, sendCalls (EIP-5792, each call), signAuthorization, and request() for eth_sendTransaction,
+ * eth_signTransaction, personal_sign, eth_sign, eth_signTypedData_v4 and wallet_sendCalls. An EIP-7702 authorization
+ * goes to onAuthorization (default "check"). Wrap last: `client.extend(...)` on the wrapped client returns an unguarded
+ * client, and the account's own sign methods (client.account.sign*) are not wrapped.
  */
 export function guardViem(client, opts = {}) {
     const c = client;
@@ -54,50 +107,164 @@ export function guardViem(client, opts = {}) {
         to: args?.to ?? undefined,
         data: data ?? "0x",
         value: args?.value ?? 0n,
+        ...(hasAuthorizations(args) ? { authorizationList: args.authorizationList } : {}),
     });
+    const origin = opts.origin !== undefined ? { origin: opts.origin } : {};
     const wrapped = {};
-    if (typeof c.sendTransaction === "function") {
-        wrapped.sendTransaction = async (args, ...rest) => {
+    for (const m of ["sendTransaction", "signTransaction"]) {
+        if (typeof c[m] !== "function")
+            continue;
+        wrapped[m] = async (args, ...rest) => {
             // a deployment (no `to`) goes to the unsupported policy
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "sendTransaction", txInput(args, args?.data), opts);
-            await enforce("transaction", () => txInput(args, args?.data), opts);
-            return c.sendTransaction(args, ...rest);
-        };
-    }
-    if (typeof c.signTransaction === "function") {
-        wrapped.signTransaction = async (args, ...rest) => {
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "signTransaction", txInput(args, args?.data), opts);
-            await enforce("transaction", () => txInput(args, args?.data), opts);
-            return c.signTransaction(args, ...rest);
+            await gateTx(m, () => txInput(args, args?.data), hasAuthorizations(args), opts);
+            return c[m](args, ...rest);
         };
     }
     if (typeof c.writeContract === "function") {
         wrapped.writeContract = async (args, ...rest) => {
-            if (hasAuthorizations(args))
-                await gateAuthorization("transaction", "writeContract", null, opts);
-            await enforce("transaction", async () => {
+            await gateTx("writeContract", async () => {
                 const enc = opts.encodeFunctionData ?? (await loadViemEncode());
                 let data = String(enc({ abi: args.abi, functionName: args.functionName, args: args.args }));
                 if (typeof args.dataSuffix === "string")
                     data += args.dataSuffix.replace(/^0x/, "");
                 return txInput({ ...args, to: args.address }, data);
-            }, opts);
+            }, hasAuthorizations(args), opts);
             return c.writeContract(args, ...rest);
         };
     }
     if (typeof c.signTypedData === "function") {
         wrapped.signTypedData = async (args, ...rest) => {
             const td = { domain: args?.domain ?? {}, types: args?.types ?? {}, primaryType: args?.primaryType, message: args?.message ?? {} };
-            await enforce("typedData", () => ({ typedData: td }), opts);
+            await enforce("typedData", () => ({ typedData: td, ...origin }), opts);
             return c.signTypedData(args, ...rest);
         };
     }
+    if (typeof c.signMessage === "function") {
+        wrapped.signMessage = async (args, ...rest) => {
+            await enforce("message", () => {
+                const m = args?.message;
+                const raw = m && typeof m === "object" ? m.raw : undefined;
+                const data = typeof m === "string" ? utf8Hex(m) : typeof raw === "string" ? raw : raw instanceof Uint8Array ? bytesHex(raw) : null;
+                if (data === null)
+                    throw new Error("signMessage: message must be a string or {raw}");
+                const from = fromOf(args);
+                return { message: { kind: "personal_sign", data, ...(from ? { from } : {}) }, ...origin };
+            }, opts);
+            return c.signMessage(args, ...rest);
+        };
+    }
+    if (typeof c.sendCalls === "function") {
+        wrapped.sendCalls = async (args, ...rest) => {
+            await enforceCalls(() => callsOf(args?.calls, chainOf(args), fromOf(args), opts), opts);
+            return c.sendCalls(args, ...rest);
+        };
+    }
     if (typeof c.signAuthorization === "function") {
-        wrapped.signAuthorization = async (...args) => {
-            await gateAuthorization("transaction", "signAuthorization", null, opts);
-            return c.signAuthorization(...args);
+        wrapped.signAuthorization = async (args, ...rest) => {
+            await gateAuthorization("transaction", "signAuthorization", () => authInput(args, c.chain?.id, fromOf(args)), opts);
+            return c.signAuthorization(args, ...rest);
+        };
+    }
+    if (typeof c.request === "function") {
+        wrapped.request = async (args, ...rest) => {
+            await checkRequest(args, c, fromOf({}), opts);
+            return c.request(args, ...rest);
+        };
+    }
+    return proxy(client, wrapped);
+}
+/** the wallet RPC methods that sign: each asks Toll first; every other method passes through unchecked */
+async function checkRequest(args, c, from, o) {
+    const method = args?.method;
+    const params = Array.isArray(args?.params) ? args.params : [];
+    const origin = o.origin !== undefined ? { origin: o.origin } : {};
+    switch (method) {
+        case "personal_sign":
+        case "eth_sign":
+            await enforce("message", () => ({ rpc: { method, params }, ...origin }), o);
+            return;
+        case "eth_signTypedData_v4":
+            await enforce("typedData", () => ({ rpc: { method, params }, ...origin }), o);
+            return;
+        case "eth_sendTransaction":
+        case "eth_signTransaction": {
+            const tx = (params[0] ?? {});
+            const build = () => ({
+                chainId: chainOut(tx.chainId ?? c.chain?.id),
+                from: isAddress(tx.from) ? tx.from : from,
+                to: tx.to ?? undefined,
+                data: typeof tx.data === "string" ? tx.data : typeof tx.input === "string" ? tx.input : "0x",
+                value: tx.value ?? 0,
+                ...(hasAuthorizations(tx) ? { authorizationList: tx.authorizationList } : {}),
+            });
+            await gateTx(method, build, hasAuthorizations(tx), o);
+            return;
+        }
+        case "wallet_sendCalls": {
+            const p = (params[0] ?? {});
+            await enforceCalls(() => callsOf(p.calls, p.chainId ?? c.chain?.id, isAddress(p.from) ? p.from : from, o), o);
+            return;
+        }
+        default:
+            return;
+    }
+}
+/* ------------------------------------------------------------------ ERC-4337 smart accounts (viem account abstraction) */
+/** the user-operation fields passed on to Toll as given (bigints become decimal strings) */
+const USEROP_FIELDS = [
+    "factory",
+    "factoryData",
+    "initCode",
+    "paymaster",
+    "paymasterData",
+    "paymasterAndData",
+    "paymasterVerificationGasLimit",
+    "paymasterPostOpGasLimit",
+    "callGasLimit",
+    "verificationGasLimit",
+    "preVerificationGas",
+    "maxFeePerGas",
+    "maxPriorityFeePerGas",
+    "signature",
+];
+/**
+ * Wraps a viem bundler client (account abstraction): sendUserOperation and prepareUserOperation ask Toll first.
+ * `calls` are checked one by one as transactions from the smart account's address; a ready `callData` is sent as a
+ * user operation with the account's EntryPoint. An EIP-7702 `authorization` goes to onAuthorization.
+ */
+export function guardSmartAccount(client, opts = {}) {
+    const c = client;
+    const check = async (where, args) => {
+        const acct = args?.account ?? c.account;
+        const sender = addrOf(acct);
+        const chainId = args?.chain?.id ?? c.chain?.id;
+        if (args?.authorization)
+            await gateAuthorization("userOp", where, () => authInput(args.authorization, chainId, sender), opts);
+        if (Array.isArray(args?.calls)) {
+            await enforceCalls(() => callsOf(args.calls, chainId, sender, opts), opts);
+            return;
+        }
+        await enforce("userOp", async () => {
+            if (typeof args?.callData !== "string")
+                return {};
+            let nonce = args.nonce;
+            if ((nonce === undefined || nonce === null) && typeof acct?.getNonce === "function")
+                nonce = await acct.getNonce();
+            const op = { sender: isAddress(args.sender) ? args.sender : sender, nonce: nonce ?? 0n, callData: args.callData };
+            for (const k of USEROP_FIELDS)
+                if (args[k] !== undefined && args[k] !== null)
+                    op[k] = args[k];
+            const ep = acct?.entryPoint?.address ?? args.entryPointAddress;
+            return { userOp: op, ...(isAddress(ep) ? { entryPoint: ep } : {}) };
+        }, opts);
+    };
+    const wrapped = {};
+    for (const m of ["sendUserOperation", "prepareUserOperation"]) {
+        if (typeof c[m] !== "function")
+            continue;
+        wrapped[m] = async (args, ...rest) => {
+            await check(m, args);
+            return c[m](args, ...rest);
         };
     }
     return proxy(client, wrapped);
@@ -115,6 +282,10 @@ export function primaryTypeOf(types) {
         throw new Error(roots.length ? `ambiguous primary type: ${roots.join(", ")}` : "no primary type");
     return roots[0];
 }
+async function ethersChainId(signer) {
+    const net = typeof signer.provider?.getNetwork === "function" ? await signer.provider.getNetwork() : null;
+    return net?.chainId ?? undefined;
+}
 async function ethersTx(signer, tx) {
     let to = tx?.to;
     if (to && typeof to === "object" && typeof to.getAddress === "function")
@@ -127,10 +298,8 @@ async function ethersTx(signer, tx) {
         to = r;
     }
     let chainId = tx?.chainId;
-    if (chainId === undefined || chainId === null) {
-        const net = typeof signer.provider?.getNetwork === "function" ? await signer.provider.getNetwork() : null;
-        chainId = net?.chainId ?? undefined;
-    }
+    if (chainId === undefined || chainId === null)
+        chainId = await ethersChainId(signer);
     let from = tx?.from;
     if (from && typeof from === "object" && typeof from.getAddress === "function")
         from = await from.getAddress();
@@ -142,58 +311,74 @@ async function ethersTx(signer, tx) {
         to: (to ?? undefined),
         data: typeof tx?.data === "string" ? tx.data : "0x",
         value: tx?.value ?? 0n,
+        ...(hasAuthorizations(tx) ? { authorizationList: tx.authorizationList } : {}),
     };
 }
 /**
- * Wraps an ethers v6 Signer: sendTransaction, signTransaction and signTypedData ask Toll first. An EIP-7702
- * authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization (default: blocked).
- * `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
+ * Wraps an ethers v6 Signer: sendTransaction, signTransaction, signTypedData, signMessage and authorize() ask Toll
+ * first. An EIP-7702 authorization (a transaction's authorizationList, or authorize()) goes to onAuthorization
+ * (default "check"). `signer.connect(provider)` returns an unguarded signer: wrap the connected one.
  */
 export function guardEthers(signer, opts = {}) {
     const s = signer;
+    const origin = opts.origin !== undefined ? { origin: opts.origin } : {};
     const wrapped = {};
-    if (typeof s.sendTransaction === "function") {
-        wrapped.sendTransaction = async (tx, ...rest) => {
-            if (hasAuthorizations(tx))
-                await gateAuthorization("transaction", "sendTransaction", null, opts);
-            await enforce("transaction", () => ethersTx(s, tx), opts);
-            return s.sendTransaction(tx, ...rest);
-        };
-    }
-    if (typeof s.signTransaction === "function") {
-        wrapped.signTransaction = async (tx, ...rest) => {
-            if (hasAuthorizations(tx))
-                await gateAuthorization("transaction", "signTransaction", null, opts);
-            await enforce("transaction", () => ethersTx(s, tx), opts);
-            return s.signTransaction(tx, ...rest);
+    for (const m of ["sendTransaction", "signTransaction"]) {
+        if (typeof s[m] !== "function")
+            continue;
+        wrapped[m] = async (tx, ...rest) => {
+            await gateTx(m, () => ethersTx(s, tx), hasAuthorizations(tx), opts);
+            return s[m](tx, ...rest);
         };
     }
     if (typeof s.signTypedData === "function") {
         wrapped.signTypedData = async (domain, types, value, ...rest) => {
-            await enforce("typedData", () => ({ typedData: { domain: domain ?? {}, types: types ?? {}, primaryType: primaryTypeOf(types ?? {}), message: value ?? {} } }), opts);
+            await enforce("typedData", () => ({ typedData: { domain: domain ?? {}, types: types ?? {}, primaryType: primaryTypeOf(types ?? {}), message: value ?? {} }, ...origin }), opts);
             return s.signTypedData(domain, types, value, ...rest);
         };
     }
+    if (typeof s.signMessage === "function") {
+        wrapped.signMessage = async (message, ...rest) => {
+            await enforce("message", async () => {
+                // ethers signs a string as its UTF-8 bytes, even one that looks like hex
+                const data = typeof message === "string" ? utf8Hex(message) : message instanceof Uint8Array ? bytesHex(message) : null;
+                if (data === null)
+                    throw new Error("signMessage: message must be a string or bytes");
+                const from = typeof s.getAddress === "function" ? await s.getAddress() : undefined;
+                return { message: { kind: "personal_sign", data, ...(isAddress(from) ? { from } : {}) }, ...origin };
+            }, opts);
+            return s.signMessage(message, ...rest);
+        };
+    }
     if (typeof s.authorize === "function") {
-        wrapped.authorize = async (...args) => {
-            await gateAuthorization("transaction", "authorize", null, opts);
-            return s.authorize(...args);
+        wrapped.authorize = async (auth, ...rest) => {
+            await gateAuthorization("transaction", "authorize", async () => {
+                const chainId = chainOut(await ethersChainId(s));
+                const from = typeof s.getAddress === "function" ? await s.getAddress() : undefined;
+                return authInput(auth ?? {}, chainId, isAddress(from) ? from : undefined);
+            }, opts);
+            return s.authorize(auth, ...rest);
         };
     }
     return proxy(signer, wrapped);
 }
-/* ------------------------------------------------------------------ either */
+/* ------------------------------------------------------------------ any */
 /** true for a viem WalletClient (has `extend` and `request`), false for an ethers Signer */
 export const isViemClient = (x) => !!x && typeof x.extend === "function" && typeof x.request === "function";
+/** true for a viem bundler client (account abstraction): it has sendUserOperation */
+export const isBundlerClient = (x) => !!x && typeof x.sendUserOperation === "function";
 /**
- * Puts Toll's pre-sign check in front of a wallet. A viem WalletClient or an ethers v6 Signer; the wrapped wallet has
- * the same type and methods.
+ * Puts Toll's pre-sign check in front of a wallet: a viem bundler client (smart account), a viem WalletClient or an
+ * ethers v6 Signer; the wrapped wallet has the same type and methods.
  */
 export function guard(wallet, opts = {}) {
+    // a bundler client is also a viem client: it is detected first
+    if (isBundlerClient(wallet))
+        return guardSmartAccount(wallet, opts);
     if (isViemClient(wallet))
         return guardViem(wallet, opts);
     if (typeof wallet.getAddress === "function" && (typeof wallet.sendTransaction === "function" || typeof wallet.signTypedData === "function")) {
         return guardEthers(wallet, opts);
     }
-    throw new TypeError("guard(): pass a viem WalletClient or an ethers v6 Signer (or use guardViem / guardEthers).");
+    throw new TypeError("guard(): pass a viem WalletClient, a viem bundler client or an ethers v6 Signer (or use guardViem / guardSmartAccount / guardEthers).");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tollxyz/guard",
-  "version": "0.2.0",
-  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain. Zero runtime dependencies.",
+  "version": "0.3.0",
+  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, viem smart-account, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain: transactions, messages, typed data, batches, user operations, EIP-7702 authorizations. Zero runtime dependencies.",
   "license": "MIT",
   "author": "Toll",
   "type": "module",