accounts 0.12.2 → 0.13.0

package/src/core/AccessKey.ts

@@ -1,24 +1,13 @@
-import { AbiFunction, Address, Hex, Provider, PublicKey, WebCryptoP256 } from 'ox'
+import { AbiFunction, Address, Hex, PublicKey, WebCryptoP256 } from 'ox'
 import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
-import type { Client, Transport } from 'viem'
+import { BaseError, type Client, type Transport } from 'viem'
 import { Account as TempoAccount, Actions } from 'viem/tempo'
 
 import type { OneOf } from '../internal/types.js'
 import * as ExecutionError from './ExecutionError.js'
 import type * as Store from './Store.js'
 
-const removalErrorNames = new Set([
-  'InvalidSignature',
-  'InvalidSignatureFormat',
-  'InvalidSignatureType',
-  'KeyAlreadyRevoked',
-  'KeyExpired',
-  'KeyNotFound',
-  'SignatureTypeMismatch',
-])
-
-/** Access-key publication states. */
-export const status = {
+const status = {
   /** No matching usable access key was found. */
   missing: 'missing',
   /** A matching key exists locally and still needs its first transaction to publish the authorization. */
@@ -29,8 +18,9 @@ export const status = {
   expired: 'expired',
 } as const
 
-/** Publication state for an access key. */
-export type Status = (typeof status)[keyof typeof status]
+const unavailableErrorNames = new Set(['KeyAlreadyRevoked', 'KeyNotFound'])
+
+type Status = (typeof status)[keyof typeof status]
 
 /** Access key entry stored alongside accounts. */
 export type AccessKey = {
@@ -42,8 +32,10 @@ export type AccessKey = {
   chainId: number
   /** Unix timestamp when the access key expires. */
   expiry?: number | undefined
-  /** Signed key authorization to attach to the first transaction. Consumed on use. */
+  /** Signed key authorization to attach until the key is observed on-chain. */
   keyAuthorization?: KeyAuthorization.Signed | undefined
+  /** Whether the key authorization is pending confirmation on-chain. */
+  keyAuthorizationPending?: boolean | undefined
   /** Key type. */
   keyType: 'secp256k1' | 'p256' | 'webAuthn' | 'webCrypto'
   /** TIP-20 spending limits for the access key. */
@@ -68,17 +60,81 @@ export type AccessKey = {
     }
 >
 
-/** Returns the pending key authorization for an access key account without removing it. */
-export function getPending(
-  account: TempoAccount.Account,
-  options: { store: Store.Store },
-): KeyAuthorization.Signed | undefined {
-  if (account.source !== 'accessKey') return undefined
-  const { store } = options
-  const accessKeyAddress = (account as TempoAccount.AccessKeyAccount).accessKeyAddress
-  const { accessKeys } = store.getState()
-  const entry = accessKeys.find((a) => a.address?.toLowerCase() === accessKeyAddress.toLowerCase())
-  return entry?.keyAuthorization
+/** Calls used to match access key scopes. */
+type Call = {
+  /** Contract address being called. */
+  to?: Address.Address | undefined
+  /** Calldata being sent. */
+  data?: Hex.Hex | undefined
+}
+
+/** Access key status query. */
+type StatusQuery = {
+  /** Root account address. */
+  account: Address.Address
+  /** Specific access key address to match. */
+  accessKey?: Address.Address | undefined
+  /** Calls to match against access key scopes. */
+  calls?: readonly Call[] | undefined
+  /** Chain ID the access key must be authorized on. */
+  chainId: number
+  /** Client used to verify publication state on-chain. */
+  client: Client<Transport>
+  /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
+  now?: number | undefined
+  /** Reactive state store. */
+  store: Store.Store
+}
+
+/** Access key selection query. */
+type SelectQuery = {
+  /** Root account address. */
+  account: Address.Address
+  /** Calls to match against access key scopes. */
+  calls?: readonly Call[] | undefined
+  /** Chain ID the access key must be authorized on. */
+  chainId: number
+  /** Client used to verify publication state on-chain. */
+  client: Client<Transport>
+  /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
+  now?: number | undefined
+  /** Reactive state store. */
+  store: Store.Store
+}
+
+/** Access key record identity. */
+type Key = {
+  /** Root account address. */
+  account: Address.Address
+  /** Access key address. */
+  accessKey: Address.Address
+  /** Chain ID the access key is scoped to. */
+  chainId: number
+  /** Reactive state store. */
+  store: Store.Store
+}
+
+type ListQuery = {
+  /** Root account address. */
+  account: Address.Address
+  /** Specific access key address to match. */
+  accessKey?: Address.Address | undefined
+  /** Chain ID the access key is scoped to. */
+  chainId: number
+  /** Reactive state store. */
+  store: Store.Store
+}
+
+/** Selected access key for an intent. */
+type Selection = {
+  /** Hydrated locally-signable access key account. */
+  account: TempoAccount.AccessKeyAccount
+  /** Access key address. */
+  accessKey: Address.Address
+  /** Pending key authorization to attach, if the key is not yet known published. */
+  authorization?: KeyAuthorization.Signed | undefined
+  /** Stored access key record. */
+  record: AccessKey
 }
 
 /** Generates a P256 key pair and access key account. */
@@ -164,18 +220,22 @@ export declare namespace prepareAuthorization {
   }
 }
 
-/** Saves a prepared access key authorization with an existing signature. */
-export function saveAuthorization(
-  options: saveAuthorization.Options,
-): saveAuthorization.ReturnType {
-  const { address, prepared, signature, store } = options
+/** Prepares, signs, and saves an access key authorization. */
+export async function authorize(options: authorize.Options): Promise<authorize.ReturnType> {
+  const { account, chainId, parameters, store } = options
+  const prepared = await prepareAuthorization({
+    ...parameters,
+    chainId: parameters.chainId ?? chainId,
+  })
+  const digest = KeyAuthorization.getSignPayload(prepared.keyAuthorization)
+  const signature = await account.sign({ hash: digest })
   const keyAuthorization = KeyAuthorization.from(prepared.keyAuthorization, {
     signature: SignatureEnvelope.from(signature),
   })
 
-  save({
-    address,
-    keyAuthorization,
+  add({
+    account: account.address,
+    authorization: keyAuthorization,
     ...(prepared.keyPair ? { keyPair: prepared.keyPair } : {}),
     store,
   })
@@ -183,33 +243,6 @@ export function saveAuthorization(
   return KeyAuthorization.toRpc(keyAuthorization)
 }
 
-export declare namespace saveAuthorization {
-  /** Options for {@link saveAuthorization}. */
-  type Options = {
-    /** Root account address that owns this access key. */
-    address: Address.Address
-    /** Prepared unsigned key authorization returned by {@link prepareAuthorization}. */
-    prepared: prepareAuthorization.ReturnType
-    /** Signature over the key authorization digest. */
-    signature: Hex.Hex
-    /** Reactive state store. */
-    store: Store.Store
-  }
-
-  /** Signed key authorization in RPC form. */
-  type ReturnType = KeyAuthorization.Rpc
-}
-
-/** Prepares, signs, and saves an access key authorization. */
-export async function authorize(options: authorize.Options): Promise<authorize.ReturnType> {
-  const { account, chainId, parameters, store } = options
-  const prepared = await prepareAuthorization({
-    ...parameters,
-    chainId: parameters.chainId ?? chainId,
-  })
-  return await signAuthorization({ account, prepared, store })
-}
-
 export declare namespace authorize {
   /** Options for {@link authorize}. */
   type Options = {
@@ -230,192 +263,184 @@ export declare namespace authorize {
   type ReturnType = KeyAuthorization.Rpc
 }
 
-async function signAuthorization(
-  options: signAuthorization.Options,
-): Promise<signAuthorization.ReturnType> {
-  const { account, prepared, store } = options
-  const digest = KeyAuthorization.getSignPayload(prepared.keyAuthorization)
-  const signature = await account.sign({ hash: digest })
-  return saveAuthorization({ address: account.address, prepared, signature, store })
-}
-
-declare namespace signAuthorization {
-  type Options = {
-    account: TempoAccount.Account
-    prepared: prepareAuthorization.ReturnType
-    store: Store.Store
-  }
-
-  type ReturnType = KeyAuthorization.Rpc
-}
+/** Returns publication status for a stored or on-chain access key. */
+export async function getStatus(options: StatusQuery): Promise<Status> {
+  const { accessKey, account, calls, chainId, client, store } = options
+  const now = options.now ?? Date.now() / 1000
+  const local = list({ account, accessKey, chainId, store }).find((key) =>
+    scopesMatch(key, { calls }),
+  )
 
-/** Hydrates an access key entry to a viem Account. Only works for locally-generated keys. */
-export function hydrate(accessKey: AccessKey): TempoAccount.Account {
-  if ('keyPair' in accessKey && accessKey.keyPair)
-    return TempoAccount.fromWebCryptoP256(accessKey.keyPair, { access: accessKey.access })
-  if ('privateKey' in accessKey && accessKey.privateKey) {
-    switch (accessKey.keyType) {
-      case 'secp256k1':
-        return TempoAccount.fromSecp256k1(accessKey.privateKey, { access: accessKey.access })
-      case 'p256':
-        return TempoAccount.fromP256(accessKey.privateKey, { access: accessKey.access })
+  if (local) {
+    if (isExpired(local.expiry, now)) return status.expired
+    if (local.keyAuthorization) {
+      if (local.keyAuthorizationPending) {
+        const publicationStatus = await getPublishedStatus(client, {
+          accessKey: local.address,
+          account,
+          now,
+        }).catch(() => status.pending)
+        if (publicationStatus === status.published) {
+          markPublished({
+            accessKey: local.address,
+            account,
+            chainId,
+            store,
+          })
+          return status.published
+        }
+      }
+      return status.pending
     }
+    return await getPublishedStatus(client, { accessKey: local.address, account, now })
   }
-  throw new Provider.UnauthorizedError({
-    message: 'External access key cannot be hydrated for signing.',
-  })
-}
 
-/** Removes an access key entry for the given account from the store. */
-export function remove(account: TempoAccount.Account, options: { store: Store.Store }): void {
-  if (account.source !== 'accessKey') return
-  const { store } = options
-  const accessKeyAddress = account.accessKeyAddress
-  store.setState((state) => ({
-    accessKeys: state.accessKeys.filter(
-      (a) => a.address?.toLowerCase() !== accessKeyAddress?.toLowerCase(),
-    ),
-  }))
-}
-
-/** Invalidates a stored access key when the error proves it is no longer usable. */
-export function invalidate(
-  account: TempoAccount.Account,
-  error: unknown,
-  options: invalidate.Options,
-): boolean {
-  if (account.source !== 'accessKey') return false
-  if (!shouldRemoveForError(error)) return false
-  remove(account, options)
-  return true
-}
-
-export declare namespace invalidate {
-  /** Options for {@link invalidate}. */
-  type Options = {
-    /** Reactive state store. */
-    store: Store.Store
-  }
+  if (accessKey) return await getPublishedStatus(client, { accessKey, account, now })
+  return status.missing
 }
 
-/** Permanently removes the pending key authorization for an access key account. */
-export function removePending(
-  account: TempoAccount.Account,
-  options: { store: Store.Store },
-): void {
-  if (account.source !== 'accessKey') return
-  const { store } = options
-  const accessKeyAddress = (account as TempoAccount.AccessKeyAccount).accessKeyAddress
-  store.setState((state) => ({
-    accessKeys: state.accessKeys.map((a) =>
-      a.address.toLowerCase() === accessKeyAddress.toLowerCase()
-        ? { ...a, keyAuthorization: undefined }
-        : a,
-    ),
-  }))
-}
+/** Selects a locally-signable access key for an intent. */
+export async function select(options: SelectQuery): Promise<Selection | undefined> {
+  const { account, calls, chainId, client, store } = options
+  const now = options.now ?? Date.now() / 1000
+  const records = list({ account, chainId, store })
 
-/** Selects and hydrates a locally-signable access key account for a root account. */
-export function selectAccount(
-  options: selectAccount.Options,
-): TempoAccount.AccessKeyAccount | undefined {
-  const { address, calls, chainId, store } = options
-  const { accessKeys } = store.getState()
-  let accessKeys_next = accessKeys
-  for (const key of accessKeys) {
-    if (key.access.toLowerCase() !== address.toLowerCase()) continue
-    if (key.chainId !== chainId) continue
-    if (!('keyPair' in key && !!key.keyPair) && !('privateKey' in key && !!key.privateKey)) continue
-
-    if (key.expiry && key.expiry < Date.now() / 1000) {
-      accessKeys_next = accessKeys_next.filter((a) => a !== key)
-      store.setState({ accessKeys: accessKeys_next })
+  for (const record of records) {
+    if (!scopesMatch(record, { calls })) continue
+    if (isExpired(record.expiry, now)) {
+      remove({ accessKey: record.address, account: record.access, chainId: record.chainId, store })
       continue
     }
 
-    if (scopesMatch(key, { calls })) return hydrate(key) as TempoAccount.AccessKeyAccount
-  }
-  return undefined
-}
+    const account_accessKey = hydrate(record)
+    if (!account_accessKey) continue
+
+    let authorization = record.keyAuthorization
+    if (authorization && record.keyAuthorizationPending) {
+      const publicationStatus = await getPublishedStatus(client, {
+        accessKey: record.address,
+        account: record.access,
+        now: Date.now() / 1000,
+      }).catch(() => status.pending)
+      if (publicationStatus === status.published) {
+        markPublished({
+          accessKey: record.address,
+          account: record.access,
+          chainId: record.chainId,
+          store,
+        })
+        authorization = undefined
+      }
+    }
 
-export declare namespace selectAccount {
-  /** Options for {@link selectAccount}. */
-  type Options = {
-    /** Root account address. */
-    address: Address.Address
-    /** Calls to match against access key scopes. */
-    calls?: readonly { to?: Address.Address | undefined; data?: Hex.Hex | undefined }[] | undefined
-    /** Chain ID the access key must be authorized on. */
-    chainId: number
-    /** Reactive state store. */
-    store: Store.Store
+    return {
+      account: account_accessKey,
+      accessKey: record.address,
+      ...(authorization ? { authorization } : {}),
+      record,
+    }
   }
 }
 
-/** Returns publication status for a stored or on-chain access key. */
-export async function getStatus(options: getStatus.Options): Promise<getStatus.ReturnType> {
-  const { accessKey, address, calls, chainId, client, store } = options
-  const now = options.now ?? Date.now() / 1000
-  const local = store
-    .getState()
-    .accessKeys.find((key) => matches(key, { accessKey, address, calls, chainId }))
-
-  if (local) {
-    if (isExpired(local.expiry, now)) return status.expired
-    if (local.keyAuthorization) return status.pending
-    if (client) return await getPublishedStatus(client, { accessKey: local.address, address, now })
-    return status.published
+/** Adds a signed access key authorization. */
+export function add(options: add.Options): add.ReturnType {
+  const { account, authorization, keyPair, privateKey, store } = options
+  const base = {
+    address: authorization.address,
+    access: account,
+    chainId: Number(authorization.chainId),
+    expiry: authorization.expiry ?? undefined,
+    keyAuthorization: authorization,
+    keyType: authorization.type,
+    limits: authorization.limits as AccessKey['limits'],
+    scopes: authorization.scopes as AccessKey['scopes'],
   }
-
-  if (accessKey && client) return await getPublishedStatus(client, { accessKey, address, now })
-  return status.missing
+  const record = (
+    privateKey ? { ...base, privateKey } : keyPair ? { ...base, keyPair } : base
+  ) as AccessKey
+  store.setState((state) => ({
+    accessKeys: [
+      record,
+      ...state.accessKeys.filter(
+        (entry) =>
+          !matches(entry, {
+            account: record.access,
+            accessKey: record.address,
+            chainId: record.chainId,
+          }),
+      ),
+    ],
+  }))
+  return record
 }
 
-export declare namespace getStatus {
-  /** Options for {@link getStatus}. */
+export declare namespace add {
+  /** Options for {@link add}. */
   type Options = {
-    /** Root account address that owns the access key. */
-    address: Address.Address
-    /** Specific access key address to query. When omitted, the first locally matching key is used. */
-    accessKey?: Address.Address | undefined
-    /** Calls to match against access key scopes. */
-    calls?: readonly { to?: Address.Address | undefined; data?: Hex.Hex | undefined }[] | undefined
-    /** Chain ID the access key must be authorized on. */
-    chainId: number
-    /** Client used to verify published state on-chain. */
-    client?: Client<Transport> | undefined
-    /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
-    now?: number | undefined
+    /** Root account address that owns this access key. */
+    account: Address.Address
+    /** Signed key authorization for the access key. */
+    authorization: KeyAuthorization.Signed
+    /** The exported private key backing the access key. */
+    privateKey?: Hex.Hex | undefined
+    /** The WebCrypto key pair backing the access key. */
+    keyPair?: Awaited<globalThis.ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined
     /** Reactive state store. */
     store: Store.Store
   }
 
-  /** Access-key publication status. */
-  type ReturnType = Status
+  /** Stored access key record. */
+  type ReturnType = AccessKey
 }
 
-/** Removes an access key from the store. */
-export function revoke(options: revoke.Options): void {
-  const { address, store } = options
-  const { accessKeys } = store.getState()
-  store.setState({
-    accessKeys: accessKeys.filter((a) => a.access.toLowerCase() !== address.toLowerCase()),
+/** Marks a key authorization as pending confirmation on-chain. */
+export function markPending(options: Key): void {
+  const { store, ...key } = options
+  const record = list({ ...key, store })[0]
+  if (!record?.keyAuthorization) return
+  patch({
+    ...key,
+    patch: { keyAuthorizationPending: true },
+    store,
   })
 }
 
-export declare namespace revoke {
-  type Options = {
-    /** Root account address. */
-    address: Address.Address
-    /** Reactive state store. */
-    store: Store.Store
+/** Marks an access key as published on-chain and clears its pending authorization. */
+export function markPublished(options: Key): void {
+  const { store, ...key } = options
+  patch({
+    ...key,
+    patch: { keyAuthorization: undefined, keyAuthorizationPending: undefined },
+    store,
+  })
+}
+
+/** Removes an access key record. */
+export function remove(options: Key): void {
+  const { store, ...key } = options
+  store.setState((state) => ({
+    accessKeys: state.accessKeys.filter((record) => !matches(record, key)),
+  }))
+}
+
+/** Returns whether an error means an access key is already unavailable on-chain. */
+export function isUnavailableError(error: unknown): boolean {
+  if (error instanceof BaseError) {
+    const found = error.walk((e) => {
+      const errorName = (e as { data?: { errorName?: string } }).data?.errorName
+      return !!errorName && unavailableErrorNames.has(errorName)
+    })
+    if (found) return true
   }
+
+  if (!(error instanceof Error)) return false
+  return unavailableErrorNames.has(ExecutionError.parse(error).errorName)
 }
 
 function scopesMatch(
   key: AccessKey,
   options: {
-    calls?: readonly { to?: Address.Address | undefined; data?: Hex.Hex | undefined }[] | undefined
+    calls?: readonly Call[] | undefined
   },
 ): boolean {
   const scopes = key.scopes
@@ -429,56 +454,29 @@ function scopesMatch(
     return scopes.some((scope) => {
       if (!isScope(scope)) return false
       if (scope.address.toLowerCase() !== callTo) return false
-      if (!scope.selector) return scope.recipients ? scope.recipients.length === 0 : true
-      const scopeSelector = getSelector(scope.selector)
+      const selector = scope.selector
+      if (!selector) return scope.recipients ? scope.recipients.length === 0 : true
+      const scopeSelector = (() => {
+        try {
+          return (
+            selector.startsWith('0x') && selector.length === 10
+              ? selector
+              : AbiFunction.getSelector(selector)
+          ).toLowerCase()
+        } catch {
+          return undefined
+        }
+      })()
       if (!scopeSelector || callSelector !== scopeSelector) return false
-      return recipientsMatch(scope.recipients, call.data)
+      if (!scope.recipients || scope.recipients.length === 0) return true
+      if (!call.data || call.data.length < 74) return false
+      const recipient = `0x${call.data.slice(34, 74)}` as Address.Address
+      if (!Address.validate(recipient)) return false
+      return scope.recipients.some((address) => address.toLowerCase() === recipient.toLowerCase())
     })
   })
 }
 
-function matches(
-  key: AccessKey,
-  options: {
-    accessKey?: Address.Address | undefined
-    address: Address.Address
-    calls?: readonly { to?: Address.Address | undefined; data?: Hex.Hex | undefined }[] | undefined
-    chainId: number
-  },
-): boolean {
-  const { accessKey, address, calls, chainId } = options
-  if (key.access.toLowerCase() !== address.toLowerCase()) return false
-  if (key.chainId !== chainId) return false
-  if (accessKey && key.address.toLowerCase() !== accessKey.toLowerCase()) return false
-  return scopesMatch(key, { calls })
-}
-
-function isExpired(expiry: number | undefined, now: number): boolean {
-  return typeof expiry === 'number' && expiry < now
-}
-
-async function getPublishedStatus(
-  client: Client<Transport>,
-  options: { accessKey: Address.Address; address: Address.Address; now: number },
-): Promise<Status> {
-  const { accessKey, address, now } = options
-  try {
-    const metadata = await Actions.accessKey.getMetadata(client, {
-      account: address,
-      accessKey,
-    })
-    if (metadata.isRevoked) return status.missing
-    if (metadata.expiry > 0n && metadata.expiry < BigInt(Math.floor(now))) return status.expired
-    return status.published
-  } catch (error) {
-    if (!(error instanceof Error)) throw error
-    const parsed = ExecutionError.parse(error)
-    if (parsed.errorName === 'KeyNotFound' || parsed.errorName === 'KeyAlreadyRevoked')
-      return status.missing
-    throw error
-  }
-}
-
 function isScope(scope: unknown): scope is NonNullable<AccessKey['scopes']>[number] {
   if (!scope || typeof scope !== 'object') return false
   const value = scope as {
@@ -496,83 +494,81 @@ function isScope(scope: unknown): scope is NonNullable<AccessKey['scopes']>[numb
   return true
 }
 
-function getSelector(selector: string): string | undefined {
-  try {
-    return (
-      selector.startsWith('0x') && selector.length === 10
-        ? selector
-        : AbiFunction.getSelector(selector)
-    ).toLowerCase()
-  } catch {
-    return undefined
+function hydrate(accessKey: AccessKey): TempoAccount.AccessKeyAccount | undefined {
+  if ('keyPair' in accessKey && accessKey.keyPair)
+    return TempoAccount.fromWebCryptoP256(accessKey.keyPair, {
+      access: accessKey.access,
+    }) as TempoAccount.AccessKeyAccount
+  if ('privateKey' in accessKey && accessKey.privateKey) {
+    switch (accessKey.keyType) {
+      case 'secp256k1':
+        return TempoAccount.fromSecp256k1(accessKey.privateKey, {
+          access: accessKey.access,
+        }) as TempoAccount.AccessKeyAccount
+      case 'p256':
+        return TempoAccount.fromP256(accessKey.privateKey, {
+          access: accessKey.access,
+        }) as TempoAccount.AccessKeyAccount
+    }
   }
+  return undefined
 }
 
-function recipientsMatch(
-  recipients: readonly Address.Address[] | undefined,
-  data: Hex.Hex | undefined,
-): boolean {
-  if (!recipients || recipients.length === 0) return true
-  const recipient = getCallRecipient(data)
-  if (!recipient) return false
-  return recipients.some((address) => address.toLowerCase() === recipient.toLowerCase())
+function isExpired(expiry: number | undefined, now: number): boolean {
+  return typeof expiry === 'number' && expiry < now
 }
 
-function getCallRecipient(data: Hex.Hex | undefined): Address.Address | undefined {
-  if (!data || data.length < 74) return undefined
-  const recipient = `0x${data.slice(34, 74)}` as Address.Address
-  if (!Address.validate(recipient)) return undefined
-  return recipient
+async function getPublishedStatus(
+  client: Client<Transport>,
+  options: { accessKey: Address.Address; account: Address.Address; now: number },
+): Promise<Status> {
+  const { accessKey, account, now } = options
+  try {
+    const metadata = await Actions.accessKey.getMetadata(client, {
+      account,
+      accessKey,
+    })
+    if (metadata.address.toLowerCase() !== accessKey.toLowerCase()) return status.missing
+    if (metadata.isRevoked) return status.missing
+    if (metadata.expiry > 0n && metadata.expiry < BigInt(Math.floor(now))) return status.expired
+    return status.published
+  } catch (error) {
+    if (isUnavailableError(error)) return status.missing
+    throw error
+  }
 }
 
-function shouldRemoveForError(error: unknown): boolean {
-  if (!(error instanceof Error)) return false
-  const parsed = ExecutionError.parse(error)
-  return removalErrorNames.has(parsed.errorName)
+function list(options: ListQuery): readonly AccessKey[] {
+  const { store, ...query } = options
+  return store.getState().accessKeys.filter((key) => matches(key, query))
 }
 
-/** Saves an access key to the store with its one-time key authorization. */
-export function save(options: save.Options): void {
-  const { address, keyAuthorization, keyPair, privateKey, store } = options
-
-  const base = {
-    address: keyAuthorization.address,
-    access: address,
-    chainId: Number(keyAuthorization.chainId),
-    expiry: keyAuthorization.expiry ?? undefined,
-    keyAuthorization,
-    keyType: keyAuthorization.type,
-    limits: keyAuthorization.limits as AccessKey['limits'],
-    scopes: keyAuthorization.scopes as AccessKey['scopes'],
-  }
-
-  const accessKey: AccessKey = privateKey
-    ? { ...base, privateKey }
-    : keyPair
-      ? { ...base, keyPair }
-      : { ...base }
-
+function patch(options: Key & { patch: Partial<AccessKey> }): void {
+  const { patch, store, ...key } = options
   store.setState((state) => ({
-    accessKeys: [
-      accessKey,
-      ...state.accessKeys.filter(
-        (entry) => entry.address.toLowerCase() !== keyAuthorization.address.toLowerCase(),
-      ),
-    ],
+    accessKeys: state.accessKeys.map((record) => {
+      if (!matches(record, key)) return record
+      const next = { ...record } as Record<string, unknown>
+      for (const [name, value] of Object.entries(patch)) {
+        if (typeof value === 'undefined') delete next[name]
+        else next[name] = value
+      }
+      return next as AccessKey
+    }),
   }))
 }
 
-export declare namespace save {
-  type Options = {
-    /** Root account address that owns this access key. */
-    address: Address.Address
-    /** Signed key authorization to attach to the first transaction. */
-    keyAuthorization: KeyAuthorization.Signed
-    /** The exported private key backing the access key. */
-    privateKey?: Hex.Hex | undefined
-    /** The WebCrypto key pair backing the access key. Only present for locally-generated keys. */
-    keyPair?: Awaited<ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined
-    /** Reactive state store. */
-    store: Store.Store
-  }
+function matches(
+  record: AccessKey,
+  options: {
+    account: Address.Address
+    accessKey?: Address.Address | undefined
+    chainId: number
+  },
+): boolean {
+  const { accessKey, account, chainId } = options
+  if (record.access.toLowerCase() !== account.toLowerCase()) return false
+  if (record.chainId !== chainId) return false
+  if (accessKey && record.address.toLowerCase() !== accessKey.toLowerCase()) return false
+  return true
 }