accounts 0.12.2 → 0.13.0

package/src/core/Provider.ts

@@ -1,8 +1,8 @@
 import { announceProvider } from 'mipd'
 import { Mppx, tempo as mppx_tempo } from 'mppx/client'
 import { Address, Hash, Hex, Json, Provider as ox_Provider, RpcResponse } from 'ox'
-import { KeyAuthorization } from 'ox/tempo'
 import { http, parseUnits, type Chain, type Client as ViemClient, type Transport } from 'viem'
+import type { JsonRpcAccount } from 'viem/accounts'
 import { tempo, tempoDevnet, tempoModerato } from 'viem/chains'
 import { parseSiweMessage } from 'viem/siwe'
 import { Actions } from 'viem/tempo'
@@ -13,6 +13,7 @@ import * as Account from './Account.js'
 import type * as Adapter from './Adapter.js'
 import { dialog } from './adapters/dialog.js'
 import * as Client from './Client.js'
+import * as AccessKeyTransaction from './internal/AccessKeyTransaction.js'
 import { withDedupe } from './internal/withDedupe.js'
 import * as Schema from './Schema.js'
 import * as Storage from './Storage.js'
@@ -25,8 +26,8 @@ export type Provider = ox_Provider.Provider<{ schema: Schema.Ox }> &
   ox_Provider.Emitter & {
     /** Configured chains. */
     chains: readonly [Chain, ...Chain[]]
-    /** Returns a viem Account for the given address (or active account). */
-    getAccount: Account.Find
+    /** Returns the active root account as a viem JSON-RPC account. */
+    getAccount(): JsonRpcAccount
     /** Returns local or on-chain publication status for an access key. */
     getAccessKeyStatus(
       options?: getAccessKeyStatus.Options | undefined,
@@ -271,8 +272,8 @@ export function create(options: create.Options = {}): create.ReturnType {
                     type FillParams = z.output<typeof Rpc.transactionRequest> & {
                       keyAuthorization?: unknown
                     }
+                    const client = getClient({ chainId, feePayer })
                     const fill = (params: FillParams) => {
-                      const client = getClient({ chainId, feePayer })
                       const fillRequest = {
                         ...params,
                         chainId: params.chainId ?? client.chain?.id,
@@ -292,45 +293,38 @@ export function create(options: create.Options = {}): create.ReturnType {
                     // Inject pending keyAuthorization so the node accounts for
                     // key authorization gas during estimation.
                     if (!parameters.keyAuthorization) {
-                      const account = (() => {
-                        try {
-                          const calls =
-                            parameters.calls ??
-                            (parameters.to
-                              ? [
-                                  {
-                                    data: parameters.data,
-                                    to: parameters.to,
-                                  },
-                                ]
-                              : undefined)
-                          return getAccount({
-                            address: parameters.from,
-                            calls,
-                            chainId: parameters.chainId ?? store.getState().chainId,
-                            signable: true,
-                          })
-                        } catch {
-                          return undefined
-                        }
-                      })()
-                      if (account?.source === 'accessKey') {
-                        const keyAuth = AccessKey.getPending(account, { store })
-                        if (keyAuth) {
+                      const state = store.getState()
+                      const address =
+                        parameters.from ?? state.accounts[state.activeAccount]?.address
+                      if (address) {
+                        const calls =
+                          parameters.calls ??
+                          (parameters.to
+                            ? [
+                                {
+                                  data: parameters.data,
+                                  to: parameters.to,
+                                },
+                              ]
+                            : undefined)
+                        const transaction = await AccessKeyTransaction.create({
+                          address,
+                          calls,
+                          chainId: parameters.chainId ?? state.chainId,
+                          client,
+                          store,
+                        })
+                        if (transaction)
                           try {
-                            const result = await fill({
+                            return await transaction.fill({
                               ...parameters,
-                              keyAuthorization: {
-                                address: keyAuth.address,
-                                ...KeyAuthorization.toRpc(keyAuth),
-                              } as never,
+                              chainId: parameters.chainId ?? state.chainId,
+                              from: parameters.from ?? address,
+                              ...(feePayer ? { feePayer: true } : {}),
                             })
-                            return result
-                          } catch (error) {
-                            AccessKey.invalidate(account, error, { store })
+                          } catch {
                             return await fill(parameters)
                           }
-                        }
                       }
                     }
 
@@ -574,6 +568,11 @@ export function create(options: create.Options = {}): create.ReturnType {
                           auth_input as NonNullable<z.output<typeof Rpc.wallet_connect.auth>>,
                         )
                       : undefined
+                    if (auth_request && typeof auth_request === 'object' && !auth_request.challenge)
+                      throw new RpcResponse.InvalidParamsError({
+                        message:
+                          '`auth` capability must include either `url` or an explicit `challenge` endpoint.',
+                      })
                     if (auth_request && capabilities?.personalSign)
                       throw new RpcResponse.InvalidParamsError({
                         message:
@@ -608,56 +607,61 @@ export function create(options: create.Options = {}): create.ReturnType {
                       ? { message: auth.message }
                       : capabilities?.personalSign
 
-                    const { keyAuthorization, accounts, email, personalSign, signature, username } =
-                      await (async () => {
-                        if (capabilities?.method === 'register') {
-                          // If a stored account already has this label, sign in
-                          // with its credential instead of creating a new one.
-                          const existing = capabilities.name
-                            ? store
-                                .getState()
-                                .accounts.find(
-                                  (a) =>
-                                    'credential' in a &&
-                                    a.label?.toLowerCase() === capabilities.name!.toLowerCase(),
-                                )
-                            : undefined
-                          if (existing && 'credential' in existing)
-                            return await actions.loadAccounts(
-                              {
-                                credentialId: existing.credential?.id,
-                                digest: capabilities.digest,
-                                authorizeAccessKey,
-                                ...(personalSign_request
-                                  ? { personalSign: personalSign_request }
-                                  : {}),
-                              },
-                              request,
-                            )
-                          return await actions.createAccount(
+                    const {
+                      accounts,
+                      auth: auth_capability,
+                      email,
+                      keyAuthorization,
+                      personalSign,
+                      signature,
+                      username,
+                    } = await (async () => {
+                      if (capabilities?.method === 'register') {
+                        // If a stored account already has this label, sign in
+                        // with its credential instead of creating a new one.
+                        const existing = capabilities.name
+                          ? store
+                              .getState()
+                              .accounts.find(
+                                (a) =>
+                                  'credential' in a &&
+                                  a.label?.toLowerCase() === capabilities.name!.toLowerCase(),
+                              )
+                          : undefined
+                        if (existing && 'credential' in existing)
+                          return await actions.loadAccounts(
                             {
+                              credentialId: existing.credential?.id,
                               digest: capabilities.digest,
                               authorizeAccessKey,
-                              name: capabilities.name ?? 'default',
-                              userId: capabilities.userId ?? Hex.random(16),
                               ...(personalSign_request
                                 ? { personalSign: personalSign_request }
                                 : {}),
                             },
                             request,
                           )
-                        }
-                        return await actions.loadAccounts(
+                        return await actions.createAccount(
                           {
-                            credentialId: capabilities?.credentialId,
-                            digest: capabilities?.digest,
+                            digest: capabilities.digest,
                             authorizeAccessKey,
-                            selectAccount: capabilities?.selectAccount,
+                            name: capabilities.name ?? 'default',
+                            userId: capabilities.userId ?? Hex.random(16),
                             ...(personalSign_request ? { personalSign: personalSign_request } : {}),
                           },
                           request,
                         )
-                      })()
+                      }
+                      return await actions.loadAccounts(
+                        {
+                          credentialId: capabilities?.credentialId,
+                          digest: capabilities?.digest,
+                          authorizeAccessKey,
+                          selectAccount: capabilities?.selectAccount,
+                          ...(personalSign_request ? { personalSign: personalSign_request } : {}),
+                        },
+                        request,
+                      )
+                    })()
 
                     store.setState({
                       accounts: resolveAccounts(accounts),
@@ -713,12 +717,14 @@ export function create(options: create.Options = {}): create.ReturnType {
                                       },
                                     }
                                   : {}),
-                                ...(signature && (!auth_request || auth_result)
+                                ...(signature && (!auth_request || auth_result || !verifyUrl)
                                   ? { signature }
                                   : {}),
                                 ...(email !== undefined ? { email } : {}),
                                 ...(username !== undefined ? { username } : {}),
-                                ...(auth_result ? { auth: auth_result } : {}),
+                                ...((auth_result ?? auth_capability)
+                                  ? { auth: auth_result ?? auth_capability }
+                                  : {}),
                                 ...(personalSign
                                   ? { personalSign: { message: personalSign.message } }
                                   : {}),
@@ -802,7 +808,7 @@ export function create(options: create.Options = {}): create.ReturnType {
                         message: '`deposit` not supported by adapter.',
                       })
                     return (await actions.deposit(
-                      request._decoded.params[0],
+                      request._decoded.params?.[0] ?? {},
                       request,
                     )) satisfies Rpc.wallet_deposit.Encoded['returns']
                   }
@@ -973,15 +979,20 @@ export function create(options: create.Options = {}): create.ReturnType {
     ),
     {
       chains,
-      getAccount,
+      getAccount() {
+        const account = getAccount()
+        return { address: account.address, type: 'json-rpc' as const }
+      },
       async getAccessKeyStatus(options: getAccessKeyStatus.Options = {}) {
         const state = store.getState()
         const address = options.address ?? state.accounts[state.activeAccount]?.address
-        if (!address) return AccessKey.status.missing
+        if (!address) return 'missing'
         const chainId = options.chainId ?? state.chainId
+        const { accessKey, calls } = options
         return await AccessKey.getStatus({
-          ...options,
-          address,
+          account: address,
+          ...(accessKey ? { accessKey } : {}),
+          ...(calls ? { calls } : {}),
           chainId,
           client: provider.getClient({ chainId }),
           store,
@@ -1031,31 +1042,22 @@ export function create(options: create.Options = {}): create.ReturnType {
     const polyfill = polyfill_option ?? isFetchWritable()
     const getClient = ({ chainId }: { chainId?: number | undefined }) => {
       const client = provider.getClient({ chainId })
-      const account = provider.getAccount()
-      return Object.assign(client, { account })
+      const account = store.getState().accounts[store.getState().activeAccount]
+      if (!account) throw new ox_Provider.DisconnectedError({ message: 'No active account.' })
+      return Object.assign(client, {
+        account: {
+          address: account.address,
+          type: 'json-rpc' as const,
+        },
+      })
     }
-    const mppx = Mppx.create({
+    Mppx.create({
       methods: [
         mppx_tempo({ ...methodOptions, getClient, mode }),
         mppx_tempo.subscription({ getClient }),
       ],
       polyfill,
     })
-    mppx.onPaymentResponse(({ challenge, method }) => {
-      if (method.name !== 'tempo' || method.intent !== 'charge') return
-      const amount = challenge.request.amount
-      if (
-        typeof amount !== 'string' &&
-        typeof amount !== 'number' &&
-        typeof amount !== 'bigint' &&
-        typeof amount !== 'boolean'
-      )
-        return
-      if (BigInt(amount) === 0n) return
-      const account = provider.getAccount()
-      if ('source' in account && account.source === 'accessKey')
-        AccessKey.removePending(account, { store })
-    })
   }
 
   providerRef = provider
@@ -1161,7 +1163,7 @@ export declare namespace getAccessKeyStatus {
   }
 
   /** Access-key publication status. */
-  type ReturnType = AccessKey.Status
+  type ReturnType = 'missing' | 'pending' | 'published' | 'expired'
 }
 
 export declare namespace mpp {
@@ -1266,14 +1268,16 @@ function resolveAuthEndpoint(
 }
 
 /**
- * Pre-resolves the `auth` capability into its absolute, fully-explicit
- * object form. Run once at the dapp-side Provider so forwarding adapters
- * (dialog) carry absolute URLs to the wallet host — the wallet's
- * `window.location.origin` belongs to the wallet, not the dapp, and
- * cannot resolve relative paths correctly.
+ * Pre-resolves the `auth` capability into its absolute object form. Run
+ * once at the dapp-side Provider so forwarding adapters (dialog) carry
+ * absolute URLs to the wallet host — the wallet's `window.location.origin`
+ * belongs to the wallet, not the dapp, and cannot resolve relative paths
+ * correctly.
  *
- * `logout` is omitted when the input doesn't supply enough info to derive
- * one (it's optional in the protocol).
+ * Individual endpoints are omitted when the input doesn't supply enough
+ * info to derive them. `logout` is optional in the protocol; `verify` can
+ * also be omitted by wallet-host re-entry so the dapp-origin Provider runs
+ * verification and receives the session cookie.
  */
 function absolutizeAuth(
   auth: NonNullable<z.output<typeof Rpc.wallet_connect.auth>>,
@@ -1297,10 +1301,6 @@ function absolutizeAuth(
 
 function assertSameAuthOrigin(auth: NonNullable<z.output<typeof Rpc.wallet_connect.auth>>): void {
   if (typeof auth !== 'object') return
-  if (!auth.challenge || !auth.verify)
-    throw new RpcResponse.InvalidParamsError({
-      message: '`auth` requires both `challenge` and `verify` endpoints.',
-    })
   const urls = [auth.challenge, auth.verify, auth.logout].filter(
     (u): u is string => typeof u === 'string',
   )

package/src/core/Schema.test-d.ts

@@ -156,6 +156,24 @@ describe('Encoded', () => {
     }>()
   })
 
+  test('wallet_deposit', () => {
+    expectTypeOf<Rpc.wallet_deposit.Encoded>().toMatchTypeOf<{
+      method: 'wallet_deposit'
+      params:
+        | readonly [
+            {
+              address?: Hex | undefined
+              amount?: string | undefined
+              chainId?: Hex | undefined
+              displayName?: string | undefined
+              token?: Hex | string | undefined
+            },
+          ]
+        | undefined
+      returns: { receipts?: readonly { transactionHash: Hex }[] | undefined } | undefined
+    }>()
+  })
+
   test('wallet_switchEthereumChain', () => {
     expectTypeOf<Rpc.wallet_switchEthereumChain.Encoded>().toEqualTypeOf<{
       method: 'wallet_switchEthereumChain'

package/src/core/adapters/dialog.test.ts

@@ -2,8 +2,8 @@ import { Provider as ox_Provider } from 'ox'
 import { tempoLocalnet } from 'viem/chains'
 import { afterEach, describe, expect, test, vi } from 'vp/test'
 
-import * as AccessKey from '../AccessKey.js'
 import * as Dialog from '../Dialog.js'
+import * as AccessKeyTransaction from '../internal/AccessKeyTransaction.js'
 import * as Storage from '../Storage.js'
 import * as Store from '../Store.js'
 import { dialog } from './dialog.js'
@@ -21,16 +21,24 @@ describe('dialog', () => {
     const store = Store.create({ chainId: tempoLocalnet.id, storage })
     const clientRequests: unknown[] = []
     const signRequests: unknown[] = []
-    vi.spyOn(AccessKey, 'selectAccount').mockReturnValue({
-      accessKeyAddress: '0x0000000000000000000000000000000000000099',
-      address: '0x0000000000000000000000000000000000000099',
-      signTransaction: async (request: unknown) => {
-        signRequests.push(request)
-        return '0xsigned'
-      },
-      source: 'accessKey',
-      type: 'local',
-    } as never)
+    vi.spyOn(AccessKeyTransaction, 'create').mockResolvedValue({
+      fill: async () => ({ capabilities: { sponsored: false }, tx: {} }),
+      prepare: async (request) => ({
+        request: request as never,
+        send: async () => {
+          signRequests.push(request)
+          clientRequests.push({ method: 'eth_sendRawTransaction', params: ['0xsigned'] })
+          return '0xtransaction'
+        },
+        sendSync: async () => {
+          throw new Error('unexpected sendSync')
+        },
+        sign: async () => {
+          signRequests.push(request)
+          return '0xsigned'
+        },
+      }),
+    })
     const adapter = dialog({ dialog: Dialog.noop() })({
       getAccount: () => {
         throw new ox_Provider.UnauthorizedError({ message: 'No local signer.' })
@@ -84,10 +92,76 @@ describe('dialog', () => {
     expect(store.getState().requestQueue).toMatchInlineSnapshot(`[]`)
   })
 
+  test('behavior: loadAccounts forwards auth capabilities returned by the dialog', async () => {
+    const storage = Storage.memory()
+    const store = Store.create({ chainId: tempoLocalnet.id, storage })
+    const adapter = dialog({ dialog: Dialog.noop() })({
+      getAccount: () => {
+        throw new ox_Provider.UnauthorizedError({ message: 'No local signer.' })
+      },
+      getClient: () => ({}) as never,
+      storage,
+      store,
+    })
+    const request = {
+      method: 'wallet_connect' as const,
+      params: [
+        {
+          capabilities: {
+            auth: {
+              url: 'https://app.example/auth',
+              returnToken: true,
+            },
+          },
+          chainId: '0x1079' as const,
+        },
+      ] as const,
+    }
+
+    const promise = adapter.actions.loadAccounts(undefined, request)
+
+    await vi.waitFor(() => {
+      if (!store.getState().requestQueue[0]) throw new Error('request not queued')
+    })
+
+    const queued = store.getState().requestQueue[0]!
+    store.setState({
+      requestQueue: [
+        {
+          request: queued.request,
+          result: {
+            accounts: [
+              {
+                address,
+                capabilities: {
+                  auth: { token: 'test-token' },
+                },
+              },
+            ],
+          },
+          status: 'success',
+        },
+      ],
+    })
+
+    await expect(promise).resolves.toMatchInlineSnapshot(`
+      {
+        "accounts": [
+          {
+            "address": "0x0000000000000000000000000000000000000001",
+          },
+        ],
+        "auth": {
+          "token": "test-token",
+        },
+      }
+    `)
+  })
+
   test('behavior: sendTransaction falls through when no access key is selected', async () => {
     const storage = Storage.memory()
     const store = Store.create({ chainId: tempoLocalnet.id, storage })
-    vi.spyOn(AccessKey, 'selectAccount').mockReturnValue(undefined)
+    vi.spyOn(AccessKeyTransaction, 'create').mockResolvedValue(undefined)
     const lookups: unknown[] = []
     const adapter = dialog({ dialog: Dialog.noop() })({
       getAccount: (options) => {
@@ -137,10 +211,60 @@ describe('dialog', () => {
     expect(lookups).toMatchInlineSnapshot(`[]`)
   })
 
+  test('behavior: revokeAccessKey clears the forwarded key from local state', async () => {
+    const storage = Storage.memory()
+    const store = Store.create({ chainId: tempoLocalnet.id, storage })
+    store.setState({
+      accessKeys: [
+        {
+          access: address,
+          address: recipient,
+          chainId: tempoLocalnet.id,
+          keyType: 'p256',
+        } as never,
+      ],
+    })
+    const adapter = dialog({ dialog: Dialog.noop() })({
+      getAccount: () => {
+        throw new ox_Provider.UnauthorizedError({ message: 'No local signer.' })
+      },
+      getClient: () => ({}) as never,
+      storage,
+      store,
+    })
+    const request = {
+      method: 'wallet_revokeAccessKey' as const,
+      params: [{ accessKeyAddress: recipient, address }] as const,
+    }
+
+    const promise = adapter.actions.revokeAccessKey!(
+      { accessKeyAddress: recipient, address },
+      request,
+    )
+
+    await vi.waitFor(() => {
+      if (!store.getState().requestQueue[0]) throw new Error('request not queued')
+    })
+
+    const queued = store.getState().requestQueue[0]!
+    store.setState({
+      requestQueue: [
+        {
+          request: queued.request,
+          result: undefined,
+          status: 'success',
+        },
+      ],
+    })
+
+    await expect(promise).resolves.toMatchInlineSnapshot(`undefined`)
+    expect(store.getState().accessKeys).toMatchInlineSnapshot(`[]`)
+  })
+
   test('error: wallet validation errors keep their RPC code', async () => {
     const storage = Storage.memory()
     const store = Store.create({ chainId: tempoLocalnet.id, storage })
-    vi.spyOn(AccessKey, 'selectAccount').mockReturnValue(undefined)
+    vi.spyOn(AccessKeyTransaction, 'create').mockResolvedValue(undefined)
     const adapter = dialog({ dialog: Dialog.noop() })({
       getAccount: () => {
         throw new ox_Provider.UnauthorizedError({ message: 'No local signer.' })