accounts 0.12.2 → 0.13.0

package/src/core/Account.test.ts

@@ -87,12 +87,9 @@ describe('hydrate', () => {
 })
 
 describe('find', () => {
-  function setup(
-    storeAccounts: readonly Account.Store[] = [],
-    accessKeys: readonly Store.AccessKey[] = [],
-  ) {
+  function setup(storeAccounts: readonly Account.Store[] = []) {
     const store = Store.create({ chainId: tempoLocalnet.id })
-    store.setState({ accounts: storeAccounts, accessKeys, activeAccount: 0 })
+    store.setState({ accounts: storeAccounts, activeAccount: 0 })
     return store
   }
 
@@ -145,52 +142,10 @@ describe('find', () => {
     expect(typeof result.sign).toMatchInlineSnapshot(`"function"`)
   })
 
-  test('behavior: prefers access key over root account', async () => {
-    const keyPair = await WebCryptoP256.createKeyPair()
-    const store = setup(
-      [{ address: accounts[0].address, keyType: 'secp256k1', privateKey: privateKeys[0] }],
-      [
-        {
-          address: '0x0000000000000000000000000000000000000099',
-          access: accounts[0].address,
-          chainId: tempoLocalnet.id,
-          keyType: 'webCrypto',
-          keyPair,
-        },
-      ],
-    )
-
-    const result = Account.find({ chainId: tempoLocalnet.id, store, signable: true })
-
-    expect(result.source).toMatchInlineSnapshot(`"accessKey"`)
-  })
-
-  test('behavior: accessKey false skips access key', async () => {
-    const keyPair = await WebCryptoP256.createKeyPair()
-    const store = setup(
-      [{ address: accounts[0].address, keyType: 'secp256k1', privateKey: privateKeys[0] }],
-      [
-        {
-          address: '0x0000000000000000000000000000000000000099',
-          access: accounts[0].address,
-          chainId: tempoLocalnet.id,
-          keyType: 'webCrypto',
-          keyPair,
-        },
-      ],
-    )
-
-    const result = Account.find({ accessKey: false, signable: true, store })
-
-    expect(result.address).toMatchInlineSnapshot(`"${accounts[0].address}"`)
-    expect(result.source).not.toBe('accessKey')
-  })
-
   test('behavior: falls back to root when no access key exists', () => {
-    const store = setup(
-      [{ address: accounts[0].address, keyType: 'secp256k1', privateKey: privateKeys[0] }],
-      [],
-    )
+    const store = setup([
+      { address: accounts[0].address, keyType: 'secp256k1', privateKey: privateKeys[0] },
+    ])
 
     const result = Account.find({ signable: true, store })
 

package/src/core/Account.ts

@@ -4,7 +4,6 @@ import type { Address, JsonRpcAccount } from 'viem/accounts'
 import { Account as TempoAccount } from 'viem/tempo'
 
 import type { OneOf } from '../internal/types.js'
-import * as core_AccessKey from './AccessKey.js'
 import type * as core_Store from './Store.js'
 
 /** Account stored in the provider state. */
@@ -35,7 +34,7 @@ export type Store = {
 export function find(options: find.Options & { signable: true }): TempoAccount.Account
 export function find(options: find.Options): TempoAccount.Account | JsonRpcAccount
 export function find(options: find.Options): TempoAccount.Account | JsonRpcAccount {
-  const { accessKey = true, address, signable = false, store } = options
+  const { address, signable = false, store } = options
   const { accounts, activeAccount } = store.getState()
 
   const activeAddr = accounts[activeAccount]?.address
@@ -47,30 +46,13 @@ export function find(options: find.Options): TempoAccount.Account | JsonRpcAccou
       ? new Provider.UnauthorizedError({ message: `Account "${address}" not found.` })
       : new Provider.DisconnectedError({ message: 'No active account.' })
 
-  // When accessKey is requested, prefer a locally-signable access key for this address.
-  if (accessKey) {
-    const account = core_AccessKey.selectAccount({
-      address: root.address,
-      calls: options.calls,
-      chainId: options.chainId ?? store.getState().chainId,
-      store,
-    })
-    if (account) return account
-  }
-
   return hydrate(root, { signable }) as never
 }
 
 export declare namespace find {
   type Options = {
-    /** Whether to prefer an access key for this account. @default true */
-    accessKey?: boolean | undefined
     /** Address to find. Defaults to the active account. */
     address?: Address | undefined
-    /** Calls to match against access key scopes. When provided, access keys whose scopes don't cover these calls are skipped. */
-    calls?: readonly { to?: Address | undefined; data?: Hex | undefined }[] | undefined
-    /** Chain ID the access key must be authorized on. Defaults to the active chain. */
-    chainId?: number | undefined
     /** Whether to hydrate signing capability. @default false */
     signable?: boolean | undefined
     /** Reactive state store. */

package/src/core/Adapter.ts

@@ -143,7 +143,7 @@ export type Instance = {
 export declare namespace SetupFn {
   /** Parameters passed to an adapter's setup function. */
   export type Parameters = {
-    /** Returns the rehydrated local account for the given address, or the active account if omitted. */
+    /** Returns the rehydrated root account for the given address, or the active account if omitted. */
     getAccount: Account.Find
     /** Get the viem client for a given chain ID. Defaults to the active chain. */
     getClient: (options?: getClient.Options | undefined) => Client<Transport, typeof tempo>
@@ -166,7 +166,7 @@ export function define(meta: Meta, fn: SetupFn): Adapter {
 
 /** Spreads decoded params. */
 export type ActionRequest<item extends Schema.Item> =
-  Schema.Decoded<item>['params'] extends readonly [infer first] ? first : never
+  NonNullable<Schema.Decoded<item>['params']> extends readonly [infer first] ? first : never
 
 export declare namespace getClient {
   type Options = {
@@ -201,6 +201,8 @@ export declare namespace createAccount {
     email?: string | null | undefined
     /** Signed key authorization, if an access key was granted. */
     keyAuthorization?: KeyAuthorization.Rpc | undefined
+    /** Server Authentication result, if the auth capability was requested. */
+    auth?: { token?: string | undefined } | undefined
     /**
      * Echo of the `personalSign` request, present iff the caller supplied
      * `personalSign`. The signature lives on the top-level `signature`
@@ -257,6 +259,8 @@ export declare namespace loadAccounts {
     email?: string | null | undefined
     /** Signed key authorization, if an access key was granted. */
     keyAuthorization?: KeyAuthorization.Rpc | undefined
+    /** Server Authentication result, if the auth capability was requested. */
+    auth?: { token?: string | undefined } | undefined
     /**
      * Echo of the `personalSign` request, present iff the caller supplied
      * `personalSign`. The signature lives on the top-level `signature`

package/src/core/{Provider.test.ts → Provider.localnet.test.ts}

@@ -349,37 +349,43 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
         // Real Hono app: mount the auth handler under `/auth` and add a
         // protected `/me` route — exactly as a dapp would compose them
         // — so the e2e test below exercises the full flow.
-        const auth = Handler.auth()
-        const app = Handler.compose([auth], { path: '/auth' })
-        app.get('/me', async (c) => {
-          const session = await auth.getSession(c.req.raw)
-          if (!session) return c.json({ error: 'unauthenticated' }, 401)
-          return c.json({ address: session.address, chainId: session.chainId })
+        let listener: Parameters<typeof createServer>[0] | undefined
+        server = await createServer((req, res) => {
+          if (!listener) {
+            const auth = Handler.auth({ origin: server.url })
+            const app = Handler.compose([auth], { path: '/auth' })
+            app.get('/me', async (c) => {
+              const session = await auth.getSession(c.req.raw)
+              if (!session) return c.json({ error: 'unauthenticated' }, 401)
+              return c.json({ address: session.address, chainId: session.chainId })
+            })
+            // Bad-challenge / bad-verify endpoints mounted on the same origin
+            // as `/auth` so the same-origin enforcement (`absolutizeAuth`)
+            // doesn't reject the request before the bad-content paths under
+            // test can run. `app.all` so we don't depend on the SDK's request
+            // method (POST).
+            app.all('/bad/verify-401', (c) => c.json({ error: 'unauthorized' }, 401))
+            app.all('/bad/challenge-500', (c) => c.json({ error: 'boom' }, 500))
+            app.all('/bad/challenge-empty', (c) => c.json({}))
+            app.all('/bad/challenge-evil-domain', (c) =>
+              c.json({
+                message: [
+                  'evil.example wants you to sign in with your Ethereum account:',
+                  '0x0000000000000000000000000000000000000000',
+                  '',
+                  '',
+                  'URI: https://evil.example',
+                  'Version: 1',
+                  'Chain ID: 0',
+                  'Nonce: deadbeef00',
+                  'Issued At: 2025-01-01T00:00:00Z',
+                ].join('\n'),
+              }),
+            )
+            listener = app.listener
+          }
+          return listener(req, res)
         })
-        // Bad-challenge / bad-verify endpoints mounted on the same origin
-        // as `/auth` so the same-origin enforcement (`absolutizeAuth`)
-        // doesn't reject the request before the bad-content paths under
-        // test can run. `app.all` so we don't depend on the SDK's request
-        // method (POST).
-        app.all('/bad/verify-401', (c) => c.json({ error: 'unauthorized' }, 401))
-        app.all('/bad/challenge-500', (c) => c.json({ error: 'boom' }, 500))
-        app.all('/bad/challenge-empty', (c) => c.json({}))
-        app.all('/bad/challenge-evil-domain', (c) =>
-          c.json({
-            message: [
-              'evil.example wants you to sign in with your Ethereum account:',
-              '0x0000000000000000000000000000000000000000',
-              '',
-              '',
-              'URI: https://evil.example',
-              'Version: 1',
-              'Chain ID: 0',
-              'Nonce: deadbeef00',
-              'Issued At: 2025-01-01T00:00:00Z',
-            ].join('\n'),
-          }),
-        )
-        server = await createServer(app.listener)
         authBase = `${server.url}/auth`
 
         // Cross-origin bad server kept around for the same-origin enforcement
@@ -412,6 +418,22 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
         expect(capabilities.signature).toMatch(/^0x[0-9a-f]+$/)
       })
 
+      test('default: object-form auth with url derives challenge and verify', async () => {
+        const provider = Provider.create({ adapter: adapter() })
+
+        const result = await provider.request({
+          method: 'wallet_connect',
+          params: [{ capabilities: { method: 'register', auth: { url: authBase } } }],
+        })
+
+        const capabilities = result.accounts[0]!.capabilities
+        expect(capabilities.auth).toEqual({ token: expect.any(String) })
+        expect(capabilities.personalSign).toEqual({
+          message: expect.stringContaining('wants you to sign in'),
+        })
+        expect(capabilities.signature).toMatch(/^0x[0-9a-f]+$/)
+      })
+
       test('default: object-form auth with explicit endpoints uses the override URLs', async () => {
         const provider = Provider.create({ adapter: adapter() })
 
@@ -433,6 +455,32 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
         expect(result.accounts[0]!.capabilities.auth).toEqual({ token: expect.any(String) })
       })
 
+      test('default: forwarded auth without verify returns signature for downstream verify', async () => {
+        const provider = Provider.create({ adapter: adapter() })
+
+        const result = await provider.request({
+          method: 'wallet_connect',
+          params: [
+            {
+              capabilities: {
+                method: 'register',
+                auth: {
+                  challenge: `${authBase}/challenge`,
+                  logout: `${authBase}/logout`,
+                },
+              },
+            },
+          ],
+        })
+
+        const capabilities = result.accounts[0]!.capabilities
+        expect(capabilities.auth).toBeUndefined()
+        expect(capabilities.personalSign).toEqual({
+          message: expect.stringContaining('wants you to sign in'),
+        })
+        expect(capabilities.signature).toMatch(/^0x[0-9a-f]+$/)
+      })
+
       test('error: verify endpoint returns 401 → InternalError; user already signed', async () => {
         const provider = Provider.create({ adapter: adapter() })
 
@@ -1133,7 +1181,7 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
           from:  0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
 
         Details: plain send failure
-        Version: viem@2.49.2]
+        Version: viem@2.50.4]
       `)
     })
   })
@@ -1957,6 +2005,24 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
       expect(provider.store.getState().accessKeys[0]!.keyAuthorization).toBeUndefined()
     })
 
+    test('behavior: fills pending keyAuthorization with the active account when from is omitted', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+      const address = await connect(provider)
+      await fund(address)
+
+      await provider.request({
+        method: 'wallet_authorizeAccessKey',
+        params: [{ expiry: Expiry.days(1) }],
+      })
+
+      const result = await provider.request({
+        method: 'eth_fillTransaction',
+        params: [fillTx],
+      })
+      expect(result.tx.gas).toBeDefined()
+      expect(provider.store.getState().accessKeys[0]!.keyAuthorization).toBeDefined()
+    })
+
     test('behavior: removes stale access key and retries on error', async () => {
       const provider = Provider.create({ adapter: adapter(), chains: [chain] })
       const address = await connect(provider)