accounts 0.18.4 → 0.19.0

package/src/core/adapters/privy.ts

@@ -570,13 +570,21 @@ export function privy<const client extends privy.Client>(
         },
         async revokeAccessKey(parameters) {
           const account = await getSigningAccount(parameters.address)
+          const { feePayer } = parameters
           try {
-            await Actions.accessKey.revoke(getClient(), {
-              account: account as never,
-              accessKey: parameters.accessKeyAddress,
-            })
+            await Actions.accessKey.revoke(
+              getClient({ feePayer: feePayer === true ? undefined : feePayer }),
+              {
+                account: account as never,
+                accessKey: parameters.accessKeyAddress,
+                ...(feePayer ? { feePayer: true } : {}),
+                ...(parameters.keyAuthorization
+                  ? { keyAuthorization: parameters.keyAuthorization }
+                  : {}),
+              },
+            )
           } catch (error) {
-            if (!AccessKey.isUnavailableError(error)) throw error
+            if (typeof feePayer === 'string' || !AccessKey.isUnavailableError(error)) throw error
           }
           store.accessKeys.remove({
             accessKey: parameters.accessKeyAddress,

package/src/core/zod/request.test.ts

@@ -69,6 +69,32 @@ describe('validate', () => {
     `)
   })
 
+  test('behavior: preserves access-key revocation sponsorship', () => {
+    const result = RpcRequest.validate(Schema.Request, {
+      method: 'wallet_revokeAccessKey',
+      params: [
+        {
+          accessKeyAddress: '0x2222222222222222222222222222222222222222',
+          address: '0x1111111111111111111111111111111111111111',
+          feePayer: 'https://app.example.com/fee-payer',
+        },
+      ],
+    })
+
+    expect(result._decoded).toMatchInlineSnapshot(`
+      {
+        "method": "wallet_revokeAccessKey",
+        "params": [
+          {
+            "accessKeyAddress": "0x2222222222222222222222222222222222222222",
+            "address": "0x1111111111111111111111111111111111111111",
+            "feePayer": "https://app.example.com/fee-payer",
+          },
+        ],
+      }
+    `)
+  })
+
   test('default: validates wallet_switchEthereumChain with hex chainId', () => {
     const result = RpcRequest.validate(Schema.Request, {
       method: 'wallet_switchEthereumChain',

package/src/core/zod/rpc.ts

@@ -51,6 +51,7 @@ type KeyAuthorizationRpcDecoded = Omit<KeyAuthorization.Rpc, 'chainId' | 'expiry
   address?: KeyAuthorization.Rpc['keyId'] | undefined
   chainId: bigint
   expiry: number | null | undefined
+  keyType: z.output<typeof keyType>
   limits?:
     | readonly {
         token: KeyAuthorization.RpcTokenLimit['token']
@@ -133,7 +134,7 @@ export const keyAuthorization = z.codec(keyAuthorizationRpc, z.custom<KeyAuthori
       chainId: keyAuthorization.chainId === '0x' ? 0n : Hex.toBigInt(keyAuthorization.chainId),
       expiry: keyAuthorization.expiry == null ? null : Hex.toNumber(keyAuthorization.expiry),
       keyId: keyAuthorization.keyId,
-      keyType: keyAuthorization.keyType,
+      keyType: z.parse(keyType, keyAuthorization.keyType),
       limits: keyAuthorization.limits?.map(({ limit, period, token }) => ({
         token,
         limit: Hex.toBigInt(limit),
@@ -540,11 +541,21 @@ export namespace wallet_authorizeAccessKey_strict {
 }
 
 export namespace wallet_revokeAccessKey {
+  /** Parameters for revoking an access key. */
+  export const parameters = z.object({
+    /** Root account address. */
+    address: u.address(),
+    /** Address of the access key to revoke. */
+    accessKeyAddress: u.address(),
+    /** App-provided fee sponsorship for the revocation transaction. */
+    feePayer: z.optional(z.union([z.boolean(), z.string()])),
+    /** Signed authorization for an access key that has not been published on-chain. */
+    keyAuthorization: z.optional(keyAuthorization),
+  })
+
   export const schema = Schema.defineItem({
     method: z.literal('wallet_revokeAccessKey'),
-    params: z.readonly(
-      z.tuple([z.object({ address: u.address(), accessKeyAddress: u.address() })]),
-    ),
+    params: z.readonly(z.tuple([parameters])),
     returns: undefined,
   })
   export type Encoded = Schema.Encoded<typeof schema>

package/src/react/Remote.test.ts

@@ -0,0 +1,153 @@
+import { vi } from 'vitest'
+import { afterEach, describe, expect, test } from 'vp/test'
+
+const hooks = vi.hoisted(() => ({ cleanups: [] as (() => void)[] }))
+
+vi.mock('react', () => ({
+  useCallback: (fn: unknown) => fn,
+  useEffect: (effect: () => void | (() => void)) => {
+    const cleanup = effect()
+    if (cleanup) hooks.cleanups.push(cleanup)
+  },
+  useMemo: (fn: () => unknown) => fn(),
+  useRef: (current: unknown) => ({ current }),
+  useState: (initial: unknown) => [initial, () => {}],
+}))
+
+import { useTheme } from './Remote.js'
+
+afterEach(() => {
+  hooks.cleanups.length = 0
+  vi.unstubAllGlobals()
+})
+
+describe('useTheme', () => {
+  test('behavior: applies URL theme values to the document', () => {
+    const root = createRoot()
+    stubBrowser(root, '?accent=%23b9a3ff&radius=medium&scheme=dark')
+
+    useTheme()
+
+    expect(readRoot(root)).toMatchInlineSnapshot(`
+      {
+        "attributes": {
+          "data-theme": "dark",
+          "data-theme-accent": "custom",
+          "data-theme-radius": "medium",
+        },
+        "colorScheme": "dark",
+        "properties": {
+          "--theme-accent": "#b9a3ff",
+        },
+      }
+    `)
+  })
+
+  test('behavior: replaces URL overrides with live theme updates', () => {
+    const root = createRoot()
+    stubBrowser(root, '?accent=purple&radius=full&scheme=dark')
+    let update: ((theme: { scheme?: string }) => void) | undefined
+    const remote = {
+      messenger: {
+        on(_topic: string, listener: typeof update) {
+          update = listener
+          return () => {}
+        },
+      },
+    }
+    useTheme(remote as never)
+
+    update?.({ scheme: 'light' })
+
+    expect(readRoot(root)).toMatchInlineSnapshot(`
+      {
+        "attributes": {
+          "data-theme": "light",
+        },
+        "colorScheme": "light",
+        "properties": {},
+      }
+    `)
+  })
+
+  test('behavior: restores the document theme when unmounted', () => {
+    const root = createRoot(
+      {
+        'data-theme': 'light',
+        'data-theme-accent': 'custom',
+        'data-theme-radius': 'small',
+      },
+      'light',
+      { '--theme-accent': '#ff007a' },
+    )
+    stubBrowser(root, '?accent=blue&radius=full&scheme=dark')
+    useTheme()
+
+    hooks.cleanups[0]?.()
+
+    expect(readRoot(root)).toMatchInlineSnapshot(`
+      {
+        "attributes": {
+          "data-theme": "light",
+          "data-theme-accent": "custom",
+          "data-theme-radius": "small",
+        },
+        "colorScheme": "light",
+        "properties": {
+          "--theme-accent": "#ff007a",
+        },
+      }
+    `)
+  })
+})
+
+// Helpers
+
+function stubBrowser(root: ReturnType<typeof createRoot>, search: string) {
+  vi.stubGlobal('document', { documentElement: root })
+  vi.stubGlobal('window', { location: { search } })
+}
+
+function createRoot(
+  initialAttributes: Record<string, string> = {},
+  colorScheme = '',
+  initialProperties: Record<string, string> = {},
+) {
+  const attributes = new Map(Object.entries(initialAttributes))
+  const properties = new Map(Object.entries(initialProperties))
+  return {
+    attributes,
+    getAttribute(name: string) {
+      return attributes.get(name) ?? null
+    },
+    removeAttribute(name: string) {
+      attributes.delete(name)
+    },
+    setAttribute(name: string, value: string) {
+      attributes.set(name, value)
+    },
+    style: {
+      colorScheme,
+      getPropertyValue(name: string) {
+        return properties.get(name) ?? ''
+      },
+      removeProperty(name: string) {
+        const value = properties.get(name) ?? ''
+        properties.delete(name)
+        return value
+      },
+      setProperty(name: string, value: string) {
+        properties.set(name, value)
+      },
+    },
+    properties,
+  }
+}
+
+function readRoot(root: ReturnType<typeof createRoot>) {
+  return {
+    attributes: Object.fromEntries(root.attributes),
+    colorScheme: root.style.colorScheme,
+    properties: Object.fromEntries(root.properties),
+  }
+}

package/src/react/Remote.ts

@@ -126,7 +126,10 @@ function applyTheme(theme: {
     root.setAttribute('data-theme-accent', getAccentName(accent))
     if (!isAccentPreset(accent)) root.style.setProperty('--theme-accent', accent)
   }
-  if (scheme) root.style.colorScheme = scheme
+  if (scheme) {
+    root.style.colorScheme = scheme
+    root.setAttribute('data-theme', scheme)
+  }
   if (radius) root.setAttribute('data-theme-radius', radius)
 }
 
@@ -137,11 +140,13 @@ function captureTheme(): ThemeSnapshot {
     accentValue: root.style.getPropertyValue('--theme-accent'),
     colorScheme: root.style.colorScheme,
     radius: root.getAttribute('data-theme-radius'),
+    scheme: root.getAttribute('data-theme'),
   }
 }
 
 function restoreTheme(snapshot: ThemeSnapshot) {
   const root = document.documentElement
+  restoreAttribute(root, 'data-theme', snapshot.scheme)
   restoreAttribute(root, 'data-theme-accent', snapshot.accentPreset)
   restoreAttribute(root, 'data-theme-radius', snapshot.radius)
   if (snapshot.accentValue) root.style.setProperty('--theme-accent', snapshot.accentValue)
@@ -175,6 +180,7 @@ type ThemeSnapshot = {
   accentValue: string
   colorScheme: string
   radius: string | null
+  scheme: string | null
 }
 
 export declare namespace useEnsureVisibility {

package/src/server/CliAuth.test.ts

@@ -1,5 +1,5 @@
 import { Base64, Hex } from 'ox'
-import { KeyAuthorization } from 'ox/tempo'
+import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
 import { createClient, custom, encodeErrorResult, encodeFunctionResult } from 'viem'
 import { Abis, Account as TempoAccount } from 'viem/tempo'
 import { describe, expect, test } from 'vp/test'
@@ -89,6 +89,7 @@ async function authorize(
     code,
     keyAuthorization: z.decode(CliAuth.keyAuthorization, {
       ...keyAuthorization,
+      keyType: key.keyType,
       address: keyAuthorization.keyId,
     }),
   } satisfies z.output<typeof CliAuth.authorizeRequest>
@@ -126,6 +127,7 @@ async function authorizeWebAuthn(
     code,
     keyAuthorization: z.decode(CliAuth.keyAuthorization, {
       ...keyAuthorization,
+      keyType: key.keyType,
       address: keyAuthorization.keyId,
     }),
   } satisfies z.output<typeof CliAuth.authorizeRequest>
@@ -1199,7 +1201,7 @@ describe('poll', () => {
             keyAuthorization: {
               ...first.keyAuthorization,
               signature: {
-                type: first.keyAuthorization.signature.type,
+                type: SignatureEnvelope.fromRpc(first.keyAuthorization.signature).type,
               },
             },
           }
@@ -1727,7 +1729,7 @@ describe('authorize', () => {
         ? {
             ...polled.keyAuthorization,
             signature: {
-              type: polled.keyAuthorization.signature.type,
+              type: SignatureEnvelope.fromRpc(polled.keyAuthorization.signature).type,
             },
           }
         : undefined

package/src/server/CliAuth.ts

@@ -765,11 +765,12 @@ export function from(options: from.Options = {}): CliAuth {
       })
 
       const client = options.client ?? cache.get(current.chainId)
+      const signature = SignatureEnvelope.fromRpc(actual.signature)
       const valid = await verifyHash(client, {
         address: options.request.accountAddress,
         hash: TempoKeyAuthorization.getSignPayload(signed),
-        signature: SignatureEnvelope.serialize(SignatureEnvelope.fromRpc(actual.signature), {
-          magic: actual.signature.type === 'webAuthn',
+        signature: SignatureEnvelope.serialize(signature, {
+          magic: signature.type === 'webAuthn',
         }),
       })
       if (!valid) throw new Error('Key authorization signature is invalid.')
@@ -1258,11 +1259,12 @@ async function verifyKeyAuthorizationSignature(options: {
     ...(actual.limits ? { limits: actual.limits } : {}),
     type: actual.keyType,
   })
+  const signature = SignatureEnvelope.fromRpc(actual.signature)
   const valid = await verifyHash(options.client, {
     address: options.account,
     hash: TempoKeyAuthorization.getSignPayload(unsigned),
-    signature: SignatureEnvelope.serialize(SignatureEnvelope.fromRpc(actual.signature), {
-      magic: actual.signature.type === 'webAuthn',
+    signature: SignatureEnvelope.serialize(signature, {
+      magic: signature.type === 'webAuthn',
     }),
   })
   if (!valid) throw new Error('Key authorization signature is invalid.')

package/src/server/internal/handlers/relay.ts

@@ -26,7 +26,6 @@ import { type Handler, from } from '../../Handler.js'
 import * as Kv from '../../Kv.js'
 import { cached } from '../kv.js'
 import * as Tokenlist from '../tokenlist.js'
-import * as Multisig from './multisig.js'
 import * as Sponsorship from './sponsorship.js'
 import * as Utils from './utils.js'
 
@@ -84,7 +83,6 @@ export function relay(options: relay.Options = {}): Handler {
     ...rest
   } = options
   const feePayerOptions = options.feePayer
-  const multisigOptions = options.multisig
 
   // Resolves the verified tokenlist for `chainId`, sharing the KV cache with
   // `Handler.exchange` so a single `kv: Kv.cloudflare(env.KV)` covers both.
@@ -519,33 +517,6 @@ export function relay(options: relay.Options = {}): Handler {
       case 'eth_sendRawTransactionSync': {
         try {
           const serialized = params[0]
-          if (
-            multisigOptions &&
-            (request.method === 'eth_sendRawTransaction' ||
-              request.method === 'eth_sendRawTransactionSync') &&
-            typeof serialized === 'string' &&
-            Multisig.isMultisigTransaction(serialized as Hex.Hex)
-          ) {
-            const result = await Multisig.handleRawTransaction({
-              claimTtl: multisigOptions.claimTtl,
-              finalize: multisigOptions.finalize,
-              getClient,
-              method: request.method,
-              request: { params: 'params' in request ? request.params : undefined },
-              resolveConfig: multisigOptions.resolveConfig,
-              sponsor: feePayerOptions
-                ? {
-                    account: feePayerOptions.account,
-                    feeToken: feePayerOptions.feeToken,
-                    resolveFeeToken: async (chainId) => (await getTokens(chainId))[0],
-                    validate: feePayerOptions.validate,
-                  }
-                : undefined,
-              store: multisigOptions.store,
-            })
-            return RpcResponse.from({ result } as never, { request } as never)
-          }
-
           if (!feePayerOptions) {
             // eth_signRawTransaction is a signing method that only the
             // relay can fulfill — forwarding it to the RPC node returns
@@ -590,27 +561,6 @@ export function relay(options: relay.Options = {}): Handler {
         }
       }
 
-      case 'eth_getTransactionByHash':
-      case 'eth_getTransactionReceipt': {
-        try {
-          if (multisigOptions) {
-            const aliased = await Multisig.handleGetTransaction({
-              getClient,
-              method: request.method,
-              request: { params: 'params' in request ? request.params : undefined },
-              store: multisigOptions.store,
-            })
-            if (aliased)
-              return RpcResponse.from({ result: aliased.result } as never, { request } as never)
-          }
-
-          const result = await client.request(request as never)
-          return RpcResponse.from({ result }, { request })
-        } catch (error) {
-          return Utils.rpcErrorJson(request, error)
-        }
-      }
-
       default: {
         try {
           const result = await client.request(request as never)
@@ -696,12 +646,6 @@ export namespace relay {
           url?: string | undefined
         }
       | undefined
-    /**
-     * Native multisig configuration. When provided, the relay collects owner
-     * approvals from multisig raw transaction submissions and broadcasts once
-     * collected owner weight meets the configured threshold.
-     */
-    multisig?: Multisig.Options | undefined
     /**
      * Relay features.
      *

package/src/server/internal/handlers/sponsorship.ts

@@ -121,8 +121,7 @@ export async function handleRawTransaction(options: handleRawTransaction.Options
     })
 
   const transaction = Transaction.deserialize(serialized)
-  // Prefer sender recovered from raw envelope; multisig finalize path supplies fallback sender.
-  const sender = transaction.from ?? options.sender
+  const sender = transaction.from
 
   // Sponsorship only applies after sender has signed original transaction.
   if (!transaction.signature || !sender)
@@ -178,8 +177,6 @@ export declare namespace handleRawTransaction {
     method: 'eth_signRawTransaction' | 'eth_sendRawTransaction' | 'eth_sendRawTransactionSync'
     /** Incoming JSON-RPC request. */
     request: { params?: readonly unknown[] | undefined }
-    /** Sender address to use if it cannot be recovered from the raw envelope. */
-    sender?: Address | undefined
     /** Optional sponsorship approval callback. */
     validate?: ((request: Transaction.TransactionRequest) => boolean | Promise<boolean>) | undefined
   }

package/src/trusted-hosts.json

@@ -3,6 +3,7 @@
     "localhost",
     "*.localhost",
     "*.tempo.xyz",
+    "mercator.sh",
     "paradigm.xyz",
     "promptgolf.sh",
     "app.polyhedge.capital",