@trustvc/eip7702 1.0.0-beta.1

package/README.md

@@ -0,0 +1,156 @@
+# TrustVC EIP-7702 Smart Account
+
+Gasless trade document operations on TrustVC via **EIP-7702** (smart account delegation) and **ERC-4337** (account abstraction). Deployed on Sepolia testnet.
+
+## Overview
+
+This package provides three contracts:
+
+| Contract | Role |
+| --- | --- |
+| `EIP7702Implementation` | Shared smart account logic that EOAs delegate to via EIP-7702 |
+| `PlatformPaymaster` | Per-platform ERC-4337 paymaster — sponsors gas for registry and title escrow operations |
+| `PlatformAccountFactory` | Deploys `PlatformPaymaster` clones cheaply via EIP-1167 (`Clones.cloneDeterministic`) |
+
+## How it works
+
+1. **Delegate** — An EOA signs an EIP-7702 authorization pointing to `EIP7702Implementation`. The EOA's code becomes `0xef0100 || impl_address`, giving it full smart-account capabilities while keeping its original private key.
+2. **Deploy paymaster** — A platform calls `PlatformAccountFactory.deployPlatformPaymaster()`. A minimal-proxy clone (~55k gas vs ~1.5M for a full deploy) is initialized with the platform's owner address, daily ETH limit, and TDoc deployer.
+3. **Gasless ops** — Users submit `UserOperation`s through a bundler (Pimlico). The paymaster validates and sponsors:
+   - **Path A** — Calls to authorized registries or title escrows (beneficiary/holder/owner only, daily limit enforced)
+   - **Path B** — `deployRegistry` (credit-gated) and `mintDocument` (MINTER\_ROLE gated) on the paymaster itself
+
+## Contracts
+
+### EIP7702Implementation
+
+EIP-7702 smart account using OpenZeppelin's `Account`, `SignerEIP7702`, and `ERC7821`. Deployed once; EOAs point to it via authorization.
+
+- `entryPoint` — immutable, baked into bytecode at deploy time
+- Execution via `ERC7821` batch execute
+- Signature validation: signer must equal `address(this)` (the delegating EOA)
+
+### PlatformPaymaster
+
+Per-platform ERC-4337 paymaster cloned from a shared implementation.
+
+#### State
+
+| Variable | Description |
+| --- | --- |
+| `tdocDeployer` | TDocDeployer contract that mints registry clones |
+| `authorizedRegistries` | Registries whose calls this paymaster will sponsor |
+| `authorizedTitleEscrows` | Title escrows whose calls this paymaster will sponsor |
+| `authorizedCallers` | Addresses (beneficiary/holder) allowed on Path A |
+| `userWhitelist` | Deployment credits per user (max 3) |
+| `documentsMinted` | Count of documents minted per caller |
+| `dailyLimit` | Max ETH sponsored per user per day |
+
+#### Key functions
+
+- `initialize(owner, dailyLimit, tdocDeployer)` — called once by the factory after clone; guarded by `owner() == address(0)`
+- `deployRegistry(impl, name, symbol)` — deploys a TradeTrust registry, consumes one credit, auto-authorizes it
+- `mintDocument(registry, beneficiary, holder, tokenId, remark)` — mints a document, auto-authorizes beneficiary + holder + title escrow
+- `setUserWhitelist / removeUserFromWhitelist` — manage deployment credits (`onlyOwner`)
+- `addRegistry / removeRegistry` — manage authorized registries (`onlyOwner`)
+- `addTitleEscrow / removeTitleEscrow` — manage authorized title escrows (`onlyOwner`)
+- `addAuthorizedCaller / removeAuthorizedCaller` — manage Path A callers (`onlyOwner`)
+- `setDailyLimit` — update daily spend cap (`onlyOwner`)
+- `getUserDailySpend(user)` — returns `(spent, limit, resetsAt)`
+
+### PlatformAccountFactory
+
+Deploys `PlatformPaymaster` clones deterministically.
+
+- `deployPlatformPaymaster(platformAddress, dailyLimit, salt)` — clones the implementation and calls `initialize`
+- `computePaymasterAddress(salt)` — predict the clone address before deployment
+- `updateTdocDeployer(addr)` — update TDoc deployer (`onlyOwner`)
+- `updatePaymasterImplementation(addr)` — upgrade the implementation for future clones (`onlyOwner`)
+
+## Deployed addresses (Sepolia)
+
+| Contract | Address |
+| --- | --- |
+| EIP7702Implementation | `0xa46EC3920Ac5fc54F4bA33185A91ae250aDF59B8` |
+| PlatformPaymaster (implementation) | `0xa24695178ea881ab7d4d105106e4906a8da4752b` |
+| PlatformAccountFactory | `0x7e9ef6363180baa744eb32ceab367a44f52adc9f` |
+| TDocDeployer | `0x64bc665056DC8bE4092e569ED13a7F273Be28cD2` |
+| EntryPoint v0.8 | `0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108` |
+
+## Installation
+
+```bash
+npm install @trustvc/eip7702
+```
+
+## Development
+
+### Prerequisites
+
+- Node.js 18+
+- A Sepolia RPC URL (e.g. Infura)
+- A Pimlico API key for bundler access
+
+### Setup
+
+```bash
+npm install
+cp .env.example .env   # fill in PRIVATE_KEY, SEPOLIA_RPC_URL, PIMLICO_API_KEY
+```
+
+### Build
+
+```bash
+npm run build          # compile contracts + generate ABIs + bundle JS
+npm run build:sol      # compile contracts only
+npm run build:abis     # generate ABI TypeScript files only
+```
+
+### Test
+
+```bash
+npm test               # runs all 45 hardhat tests
+```
+
+### Deploy (Sepolia)
+
+Deploy in order:
+
+```bash
+# 1. Deploy the shared PlatformPaymaster implementation
+npx hardhat run scripts/deployImplementation.ts --network sepolia
+
+# 2. Deploy the factory (add PAYMASTER_IMPLEMENTATION to .env first)
+npx hardhat run scripts/deployFactory.ts --network sepolia
+
+# 3. Clone a paymaster for your platform (add FACTORY_ADDRESS to .env first)
+npx hardhat run scripts/deployPlatformPaymaster.ts --network sepolia
+
+# 4. Stake the paymaster on the EntryPoint
+npx hardhat run scripts/stakePlatformPaymaster.ts --network sepolia
+```
+
+### Mint a document gaslessly
+
+```bash
+npx hardhat run scripts/mintDocumentGasless.ts --network sepolia
+```
+
+## Environment variables
+
+| Variable | Description |
+| --- | --- |
+| `PRIVATE_KEY` | Deployer wallet private key |
+| `SEPOLIA_RPC_URL` | Sepolia RPC endpoint |
+| `PIMLICO_API_KEY` | Pimlico bundler API key |
+| `TDOC_DEPLOYER_ADDRESS` | Deployed TDocDeployer address |
+| `PAYMASTER_IMPLEMENTATION` | PlatformPaymaster implementation address |
+| `FACTORY_ADDRESS` | PlatformAccountFactory address |
+| `PAYMASTER_ADDRESS` | Deployed paymaster clone address |
+| `EIP7702_IMPL_ADDRESS` | EIP7702Implementation address |
+
+## Tech stack
+
+- Solidity `^0.8.28` · OpenZeppelin Contracts v5 · `@account-abstraction/contracts` v0.8
+- Hardhat · hardhat-toolbox-viem · Viem · Pimlico bundler
+- EIP-7702 · ERC-4337 · EIP-1167 minimal proxy · Sepolia testnet

package/contracts/EIP7702Implementation.sol

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import {Account} from "@openzeppelin/contracts/account/Account.sol";
+import {ERC7821} from "@openzeppelin/contracts/account/extensions/draft-ERC7821.sol";
+import {SignerEIP7702} from "@openzeppelin/contracts/utils/cryptography/signers/SignerEIP7702.sol";
+import {EIP7702Utils} from "@openzeppelin/contracts/account/utils/EIP7702Utils.sol";
+import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+import {IEntryPoint} from "@openzeppelin/contracts/interfaces/draft-IERC4337.sol";
+
+/**
+ * EIP-7702 smart account implementation using OpenZeppelin base contracts.
+ *
+ * Inheritance stack:
+ *   Account          — ERC-4337 validateUserOp, onlyEntryPoint guards, pre-fund payment
+ *   SignerEIP7702    — _rawSignatureValidation: recovers signer and checks == address(this)
+ *   ERC7821          — standardized batch execute(bytes32 mode, bytes executionData)
+ *   ERC165           — supportsInterface
+ *
+ * EIP-7702 flow: deploy this contract once, then have EOAs sign an authorization
+ * pointing to this address. The EOA's code becomes `0xef0100 || address(this)`,
+ * giving it full smart-account capabilities while keeping the original private key.
+ */
+contract EIP7702Implementation is Account, SignerEIP7702, ERC7821, ERC165 {
+    // Baked into bytecode at deploy time so EIP-7702 delegating EOAs inherit
+    // the correct EntryPoint without any storage reads.
+    IEntryPoint private immutable _entryPoint;
+
+    // Takes address so callers don't need OZ's IEntryPoint type in scope.
+    constructor(address entryPoint_) {
+        _entryPoint = IEntryPoint(entryPoint_);
+    }
+
+    function entryPoint() public view virtual override returns (IEntryPoint) {
+        return _entryPoint;
+    }
+
+    // -------------------------------------------------------------------------
+    // Execution
+    // -------------------------------------------------------------------------
+
+    /**
+     * @dev Allow the EntryPoint (in addition to address(this)) to call the
+     * ERC-7821 batch execute function. Without this override only the account
+     * itself can trigger execution.
+     */
+    function _erc7821AuthorizedExecutor(
+        address caller,
+        bytes32 mode,
+        bytes calldata executionData
+    ) internal view virtual override returns (bool) {
+        return caller == address(entryPoint()) || super._erc7821AuthorizedExecutor(caller, mode, executionData);
+    }
+
+    /**
+     * @dev Convenience single-call path. Only callable by the EntryPoint or the
+     * account itself — prevents arbitrary callers from draining funds.
+     *
+     * For batch calls use the ERC-7821 `execute(bytes32 mode, bytes executionData)`
+     * inherited from ERC7821 with mode = 0x0100000000000000000000000000000000000000000000000000000000000000
+     * and executionData = abi.encode(calls) where calls is (address,uint256,bytes)[].
+     */
+    function execute(
+        address to,
+        uint256 value,
+        bytes calldata data
+    ) external onlyEntryPointOrSelf returns (bytes memory) {
+        (bool ok, bytes memory result) = to.call{value: value}(data);
+        require(ok, "execution failed");
+        return result;
+    }
+
+    // -------------------------------------------------------------------------
+    // ERC-165
+    // -------------------------------------------------------------------------
+
+    /**
+     * @dev Advertise ERC-7821 (batch executor) and ERC-165 support.
+     * The ERC-7821 interface ID 0x4e49c5c7 is the XOR of:
+     *   execute(bytes32,bytes).selector ^ supportsExecutionMode(bytes32).selector
+     */
+    function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
+        return interfaceId == 0x4e49c5c7 // ERC-7821 batch executor
+            || super.supportsInterface(interfaceId); // covers 0x01ffc9a7 (ERC-165)
+    }
+
+    // -------------------------------------------------------------------------
+    // Utilities
+    // -------------------------------------------------------------------------
+
+    /**
+     * @dev Returns the implementation address this EOA has delegated to via
+     * EIP-7702, or address(0) if no delegation is active.
+     */
+    function getDelegate() external view returns (address) {
+        return EIP7702Utils.fetchDelegate(address(this));
+    }
+}

package/contracts/Factory.sol

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import {PlatformPaymaster} from "./PlatformPaymaster.sol";
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
+import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";
+
+contract PlatformAccountFactory is Ownable {
+    address public tdocDeployer;
+    address public paymasterImplementation;
+
+    event PlatformOnboarded(address indexed platformAddress, address indexed paymaster);
+    event TdocDeployerUpdated(address indexed newDeployer);
+    event ImplementationUpdated(address indexed newImplementation);
+
+    constructor(
+        address _tdocDeployer,
+        address _paymasterImplementation
+    ) Ownable(msg.sender) {
+        tdocDeployer = _tdocDeployer;
+        paymasterImplementation = _paymasterImplementation;
+    }
+
+    function updateTdocDeployer(address _tdocDeployer) external onlyOwner {
+        require(_tdocDeployer != address(0), "Zero address");
+        tdocDeployer = _tdocDeployer;
+        emit TdocDeployerUpdated(_tdocDeployer);
+    }
+
+    function updatePaymasterImplementation(address _impl) external onlyOwner {
+        require(_impl != address(0), "Zero address");
+        paymasterImplementation = _impl;
+        emit ImplementationUpdated(_impl);
+    }
+
+    function deployPlatformPaymaster(
+        address platformAddress,
+        uint256 dailyLimit,
+        bytes32 salt
+    ) external returns (address paymaster) {
+        paymaster = Clones.cloneDeterministic(paymasterImplementation, salt);
+        PlatformPaymaster(payable(paymaster)).initialize(platformAddress, dailyLimit, tdocDeployer);
+        emit PlatformOnboarded(platformAddress, paymaster);
+    }
+
+    // Address is determined solely by implementation + salt (not by constructor args).
+    function computePaymasterAddress(bytes32 salt) external view returns (address) {
+        return Clones.predictDeterministicAddress(paymasterImplementation, salt, address(this));
+    }
+}

package/contracts/PlatformPaymaster.sol

@@ -0,0 +1,347 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import "@account-abstraction/contracts/core/BasePaymaster.sol";
+import "@account-abstraction/contracts/core/Helpers.sol";
+
+interface ITDocDeployer {
+    function deploy(
+        address implementation,
+        bytes memory params
+    ) external returns (address);
+}
+
+interface ITradeTrustToken {
+    function mint(
+        address beneficiary,
+        address holder,
+        uint256 tokenId,
+        bytes calldata remark
+    ) external returns (address);
+}
+
+interface IAccessControl {
+    function grantRole(bytes32 role, address account) external;
+    function renounceRole(bytes32 role, address callerConfirmation) external;
+}
+
+/**
+ * PlatformPaymaster — validates by inspecting the target contract in callData.
+ *
+ * Validation strategy (no third-party storage reads → bundler compliant):
+ *   1. Decode userOp.callData → must be execute(address to, uint256, bytes)
+ *   2. Check `to` is in authorizedRegistries (paymaster's own storage)
+ *   3. Check daily spend (paymaster's own storage — always allowed)
+ *
+ * Access control is enforced by the Storage contract itself:
+ *   require(msg.sender == beneficiary || msg.sender == holder)
+ * so non-beneficiary/holder callers are rejected at execution time.
+ * If the call reverts, _postOp skips the spend update.
+ */
+contract PlatformPaymaster is BasePaymaster {
+    bytes4 private constant EXECUTE_SEL =
+        bytes4(keccak256("execute(address,uint256,bytes)"));
+    bytes4 private constant DEPLOY_REGISTRY_SEL =
+        bytes4(keccak256("deployRegistry(address,string,string)"));
+    bytes4 private constant MINT_DOCUMENT_SEL =
+        bytes4(
+            keccak256("mintDocument(address,address,address,uint256,bytes)")
+        );
+
+    bytes32 private constant DEFAULT_ADMIN_ROLE = bytes32(0);
+
+    ITDocDeployer public tdocDeployer;
+
+    // Paymaster's own storage — always allowed under ERC-7562
+    mapping(address => bool) public authorizedRegistries;
+    mapping(address => bool) public authorizedTitleEscrows;
+    // remaining deployment credits per user; max 3 per user
+    mapping(address => uint256) public userWhitelist;
+    // Addresses permitted to call title escrow functions via this paymaster
+    mapping(address => bool) public authorizedCallers;
+    // Count of documents minted per user
+    mapping(address => uint256) public documentsMinted;
+
+    // Daily spend tracking — paymaster's own storage, always allowed
+    mapping(address => uint256) public dailySpend;
+    mapping(address => uint256) public lastReset;
+    uint256 public dailyLimit;
+
+    event RegistryAdded(address indexed registry);
+    event RegistryRemoved(address indexed registry);
+    event TitleEscrowLinked(
+        address indexed titleEscrow,
+        address indexed registry
+    );
+    event TitleEscrowAdded(address indexed titleEscrow);
+    event TitleEscrowRemoved(address indexed titleEscrow);
+    event UserWhitelistUpdated(address indexed user, uint256 credits);
+    event RegistryDeployed(
+        address indexed user,
+        address indexed deployed,
+        uint256 creditsLeft
+    );
+    event AuthorizedCallerUpdated(address indexed caller, bool authorized);
+    event UserOpSponsored(address indexed user, uint256 gasCost);
+    event UserOpRejected(address indexed user, string reason);
+    event DailyLimitUpdated(uint256 newLimit);
+
+    // Deployed once as the shared implementation; BasePaymaster sets owner = msg.sender.
+    // That non-zero owner prevents initialize() from running on the implementation itself.
+    constructor(IEntryPoint _entryPoint) BasePaymaster(_entryPoint) {}
+
+    // Called by the factory immediately after cloneDeterministic().
+    // A fresh clone has all-zero storage, so owner() == address(0) exactly once.
+    function initialize(
+        address _owner,
+        uint256 _dailyLimit,
+        address _tdocDeployer
+    ) external {
+        require(owner() == address(0), "Already initialized");
+        require(_owner != address(0), "Zero owner");
+        _transferOwnership(_owner);
+        dailyLimit = _dailyLimit;
+        tdocDeployer = ITDocDeployer(_tdocDeployer);
+    }
+
+    // Grant/update deployment credits for a user; credits cannot exceed 3
+    function setUserWhitelist(
+        address user,
+        uint256 credits
+    ) external onlyOwner {
+        require(user != address(0), "Zero address");
+        require(credits <= 3, "Exceeds max credits of 3");
+        userWhitelist[user] = credits;
+        emit UserWhitelistUpdated(user, credits);
+    }
+
+    // add function to remove user from whitelist
+    function removeUserFromWhitelist(address user) external onlyOwner {
+        require(user != address(0), "Zero address");
+        userWhitelist[user] = 0;
+        emit UserWhitelistUpdated(user, 0);
+    }
+
+    // Deploys a TDoc clone on behalf of a whitelisted user; consumes one credit.
+    // Role setup (atomic, no follow-up txs needed):
+    //   - msg.sender (EOA) gets DEFAULT_ADMIN_ROLE
+    //   - paymaster gets MINTER_ROLE + RESTORER_ROLE + ACCEPTER_ROLE
+    function deployRegistry(
+        address implementation,
+        string memory name,
+        string memory symbol
+    ) external returns (address deployed) {
+        require(address(tdocDeployer) != address(0), "TdocDeployer not set");
+        uint256 credits = userWhitelist[msg.sender];
+        require(credits > 0, "No deployment credits");
+
+        userWhitelist[msg.sender] = credits - 1;
+
+        // Paymaster is temporary admin so it can configure roles after deploy
+        bytes memory params = abi.encode(name, symbol, address(this));
+        deployed = tdocDeployer.deploy(implementation, params);
+
+        // Hand admin to the calling EOA
+        IAccessControl(deployed).grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
+
+        // Paymaster keeps only the operational roles it needs
+        // (MINTER_ROLE, RESTORER_ROLE, ACCEPTER_ROLE were granted to address(this) via initialize)
+
+        // Relinquish admin — EOA is now sole admin
+        IAccessControl(deployed).renounceRole(
+            DEFAULT_ADMIN_ROLE,
+            address(this)
+        );
+
+        authorizedRegistries[deployed] = true;
+        emit RegistryAdded(deployed);
+        emit RegistryDeployed(msg.sender, deployed, credits - 1);
+    }
+
+    // Mints a TradeTrust document, captures the TitleEscrow, and auto-authorizes it.
+    // Paymaster must hold MINTER_ROLE on the registry.
+    // Callable gaslessly by userWhitelist users (credits not consumed — only deployRegistry uses credits).
+    function mintDocument(
+        address registry,
+        address beneficiary,
+        address holder,
+        uint256 tokenId,
+        bytes calldata remark
+    ) external returns (address titleEscrow) {
+        require(authorizedRegistries[registry], "registry not authorized");
+
+        titleEscrow = ITradeTrustToken(registry).mint(
+            beneficiary,
+            holder,
+            tokenId,
+            remark
+        );
+
+        // Auto-authorize beneficiary and holder to call title escrow functions
+        authorizedCallers[beneficiary] = true;
+        authorizedCallers[holder] = true;
+
+        authorizedTitleEscrows[titleEscrow] = true;
+        documentsMinted[msg.sender]++;
+        emit TitleEscrowLinked(titleEscrow, registry);
+    }
+
+    function addRegistry(address registry) external onlyOwner {
+        require(registry != address(0), "Zero address");
+        authorizedRegistries[registry] = true;
+        emit RegistryAdded(registry);
+    }
+
+    function removeRegistry(address registry) external onlyOwner {
+        authorizedRegistries[registry] = false;
+        emit RegistryRemoved(registry);
+    }
+
+    function addTitleEscrow(address titleEscrow) external onlyOwner {
+        require(titleEscrow != address(0), "Zero address");
+        authorizedTitleEscrows[titleEscrow] = true;
+        emit TitleEscrowAdded(titleEscrow);
+    }
+
+    function removeTitleEscrow(address titleEscrow) external onlyOwner {
+        authorizedTitleEscrows[titleEscrow] = false;
+        emit TitleEscrowRemoved(titleEscrow);
+    }
+
+    function addAuthorizedCaller(address caller) external onlyOwner {
+        require(caller != address(0), "Zero address");
+        authorizedCallers[caller] = true;
+        emit AuthorizedCallerUpdated(caller, true);
+    }
+
+    function removeAuthorizedCaller(address caller) external onlyOwner {
+        authorizedCallers[caller] = false;
+        emit AuthorizedCallerUpdated(caller, false);
+    }
+
+    function setDailyLimit(uint256 _dailyLimit) external onlyOwner {
+        dailyLimit = _dailyLimit;
+        emit DailyLimitUpdated(_dailyLimit);
+    }
+
+    function _validatePaymasterUserOp(
+        PackedUserOperation calldata userOp,
+        bytes32, // userOpHash — not needed
+        uint256 maxCost
+    ) internal override returns (bytes memory context, uint256 validationData) {
+        address sender = userOp.sender;
+
+        // 1. callData must be long enough for selector + one address arg
+        if (userOp.callData.length < 36) {
+            emit UserOpRejected(sender, "callData too short");
+            return ("", _packValidationData(true, 0, 0));
+        }
+
+        // 2. Must call execute(address,uint256,bytes)
+        bytes4 sel = bytes4(userOp.callData[:4]);
+        if (sel != EXECUTE_SEL) {
+            emit UserOpRejected(sender, "wrong selector");
+            return ("", _packValidationData(true, 0, 0));
+        }
+
+        // 3. Decode target and inner calldata
+        (address target, , bytes memory innerData) = abi.decode(
+            userOp.callData[4:],
+            (address, uint256, bytes)
+        );
+
+        // Path A — calling an authorized registry or title escrow (regular sponsored op)
+        // Only authorizedCallers or the platform owner may be sponsored here.
+        if (authorizedRegistries[target] || authorizedTitleEscrows[target]) {
+            if (!authorizedCallers[sender] && sender != owner()) {
+                emit UserOpRejected(sender, "caller not authorized");
+                return ("", _packValidationData(true, 0, 0));
+            }
+            if (dailyLimit > 0 && dailySpend[sender] + maxCost > dailyLimit) {
+                emit UserOpRejected(sender, "daily limit exceeded");
+                return ("", _packValidationData(true, 0, 0));
+            }
+            return (
+                abi.encode(sender, maxCost, false),
+                _packValidationData(false, 0, 0)
+            );
+        }
+
+        // Path B — gasless paymaster call (deployRegistry or mintDocument)
+        // Double-spend safe: EntryPoint sequential nonces allow only one
+        // pending UserOp per sender in the mempool at a time.
+        if (target == address(this)) {
+            bytes4 innerSel;
+            assembly {
+                innerSel := mload(add(innerData, 32))
+            }
+
+            if (innerSel == DEPLOY_REGISTRY_SEL) {
+                // deployRegistry requires whitelist credits — platform-level gate
+                if (userWhitelist[sender] == 0) {
+                    emit UserOpRejected(sender, "not whitelisted");
+                    return ("", _packValidationData(true, 0, 0));
+                }
+                // credits consumed inside deployRegistry; flag as deployment to skip daily spend
+                return (
+                    abi.encode(sender, maxCost, true),
+                    _packValidationData(false, 0, 0)
+                );
+            }
+
+            if (innerSel == MINT_DOCUMENT_SEL) {
+                // mintDocument: registry enforces MINTER_ROLE — no extra whitelist needed
+                return (
+                    abi.encode(sender, maxCost, false),
+                    _packValidationData(false, 0, 0)
+                );
+            }
+
+            emit UserOpRejected(sender, "unauthorized paymaster call");
+            return ("", _packValidationData(true, 0, 0));
+        }
+
+        emit UserOpRejected(sender, "unauthorized target");
+        return ("", _packValidationData(true, 0, 0));
+    }
+
+    function _postOp(
+        PostOpMode mode,
+        bytes calldata context,
+        uint256 actualGasCost,
+        uint256 /*actualUserOpFeePerGas*/
+    ) internal override {
+        if (mode == PostOpMode.postOpReverted) return;
+
+        (address sender, , bool isDeployment) = abi.decode(
+            context,
+            (address, uint256, bool)
+        );
+
+        // Deployment ops are credit-gated; skip daily spend tracking for them
+        if (!isDeployment) {
+            if (block.timestamp > lastReset[sender] + 1 days) {
+                dailySpend[sender] = 0;
+                lastReset[sender] = block.timestamp;
+            }
+            dailySpend[sender] += actualGasCost;
+        }
+
+        emit UserOpSponsored(sender, actualGasCost);
+    }
+
+    // v0.8 contracts on Etherspot EntryPoint — skip interface mismatch check
+    function _validateEntryPointInterface(IEntryPoint) internal pure override {}
+
+    receive() external payable {
+        deposit();
+    }
+
+    function getUserDailySpend(
+        address user
+    ) external view returns (uint256 spent, uint256 limit, uint256 resetsAt) {
+        spent = dailySpend[user];
+        limit = dailyLimit;
+        resetsAt = lastReset[user] + 1 days;
+    }
+}