accounts 0.3.0 → 0.4.1

package/src/core/adapters/local.ts

@@ -0,0 +1,277 @@
+import { Address as ox_Address, Hex, Provider as ox_Provider, PublicKey, WebCryptoP256 } from 'ox'
+import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
+import { prepareTransactionRequest } from 'viem/actions'
+import { Account as TempoAccount } from 'viem/tempo'
+
+import * as AccessKey from '../AccessKey.js'
+import * as Account from '../Account.js'
+import * as Adapter from '../Adapter.js'
+
+/**
+ * Creates a local adapter where the app manages keys and signing in-process.
+ *
+ * @example
+ * ```ts
+ * import { local, Provider } from 'accounts'
+ *
+ * const Provider = Provider.create({
+ *   adapter: local({
+ *     loadAccounts: async () => ({
+ *       accounts: [{ address: '0x...' }],
+ *     }),
+ *   }),
+ * })
+ * ```
+ */
+export function local(options: local.Options): Adapter.Adapter {
+  const { createAccount, icon, loadAccounts, name, rdns } = options
+
+  return Adapter.define({ icon, name, rdns }, ({ getAccount, getClient, store }) => {
+    /**
+     * Resolves access key params and computes the key authorization digest.
+     *
+     * For external keys: derives the address from the provided publicKey/address.
+     * For local keys: generates a P256 key pair via `AccessKey.generate`.
+     */
+    async function prepareKeyAuthorization(options: Adapter.authorizeAccessKey.Parameters) {
+      const { expiry, limits } = options
+      const chainId = getClient().chain.id
+
+      if (options.publicKey || options.address) {
+        const accessKeyAddress =
+          options.address ?? ox_Address.fromPublicKey(PublicKey.from(options.publicKey!))
+        const keyType = options.keyType ?? 'secp256k1'
+        const keyAuthorization = KeyAuthorization.from({
+          address: accessKeyAddress,
+          chainId: BigInt(chainId),
+          expiry,
+          limits,
+          type: keyType,
+        })
+        return { keyAuthorization }
+      }
+
+      const keyPair = await WebCryptoP256.createKeyPair()
+      const address = ox_Address.fromPublicKey(PublicKey.from(keyPair.publicKey))
+      const keyAuthorization = KeyAuthorization.from({
+        address,
+        chainId: BigInt(chainId),
+        expiry,
+        limits,
+        type: 'p256',
+      })
+      return { keyAuthorization, keyPair }
+    }
+
+    /**
+     * Signs (or wraps a pre-computed signature into) a key authorization
+     * and saves the result to the store.
+     */
+    async function signKeyAuthorization(
+      account: TempoAccount.Account,
+      prepared: Awaited<ReturnType<typeof prepareKeyAuthorization>>,
+      options: {
+        signature?: Hex.Hex | undefined
+      } = {},
+    ): Promise<Adapter.authorizeAccessKey.ReturnType> {
+      const { keyPair } = prepared
+
+      const keyAuthorization = await (async () => {
+        const digest = KeyAuthorization.getSignPayload(prepared.keyAuthorization)
+        const signature = options.signature ?? (await account.sign({ hash: digest }))
+        return KeyAuthorization.from(prepared.keyAuthorization, {
+          signature: SignatureEnvelope.from(signature),
+        })
+      })()
+
+      AccessKey.save({ address: account.address, keyAuthorization, keyPair, store })
+
+      return KeyAuthorization.toRpc(keyAuthorization)
+    }
+
+    async function withAccessKey<result>(
+      fn: (
+        account: TempoAccount.Account,
+        keyAuthorization?: KeyAuthorization.Signed,
+      ) => Promise<result>,
+    ): Promise<result> {
+      const account = getAccount({ signable: true })
+      const keyAuthorization = AccessKey.getPending(account, { store })
+      try {
+        const result = await fn(account, keyAuthorization ?? undefined)
+        AccessKey.removePending(account, { store })
+        return result
+      } catch (error) {
+        if (account.source !== 'accessKey') throw error
+        AccessKey.remove(account, { store })
+        const root = getAccount({ accessKey: false, signable: true })
+        return await fn(root, undefined)
+      }
+    }
+
+    return {
+      actions: {
+        async createAccount(parameters) {
+          if (!createAccount)
+            throw new ox_Provider.UnsupportedMethodError({
+              message: '`createAccount` not configured on adapter.',
+            })
+          const { authorizeAccessKey: grantOptions, ...rest } = parameters
+          const { accounts, signature } = await createAccount(rest)
+
+          // Hydrate the first account for signing. Must be done here (not via
+          // the store) because accounts aren't merged into the store until
+          // Provider.ts processes the return value.
+          const account = Account.hydrate(accounts[0]!, { signable: true })
+
+          // If the caller requested a digest signature but the adapter didn't
+          // produce one (e.g. secp256k1 adapters), sign it ourselves.
+          const signature_ =
+            rest.digest && !signature ? await account.sign({ hash: rest.digest }) : signature
+
+          const keyAuthorization = await (async () => {
+            if (!grantOptions) return undefined
+            const prepared = await prepareKeyAuthorization(grantOptions)
+            return await signKeyAuthorization(account, prepared)
+          })()
+
+          return { accounts, keyAuthorization, signature: signature_ }
+        },
+        async authorizeAccessKey(parameters) {
+          const prepared = await prepareKeyAuthorization(parameters)
+          const account = getAccount({ accessKey: false, signable: true })
+          return await signKeyAuthorization(account, prepared, { signature: parameters.signature })
+        },
+        async loadAccounts(parameters) {
+          const { authorizeAccessKey, ...rest } =
+            parameters ?? ({} as Adapter.loadAccounts.Parameters)
+
+          const keyAuthorization_unsigned = authorizeAccessKey
+            ? await prepareKeyAuthorization(authorizeAccessKey)
+            : undefined
+
+          const digest = (() => {
+            if (rest.digest) return rest.digest
+            if (keyAuthorization_unsigned?.keyAuthorization)
+              return KeyAuthorization.getSignPayload(keyAuthorization_unsigned.keyAuthorization)
+            return undefined
+          })()
+
+          // Pass the prepared digest (or the caller's) into loadAccounts so
+          // the ceremony can sign it in a single biometric prompt.
+          const { accounts, signature } = await loadAccounts({ ...rest, digest })
+
+          // Hydrate here (not from the store) — same reason as createAccount.
+          // Guard against empty accounts (e.g. user cancelled the ceremony).
+          const account = accounts[0] ? Account.hydrate(accounts[0], { signable: true }) : undefined
+
+          // Fall back to local signing if the adapter didn't return a signature.
+          let signature_ = signature
+          if (digest && !signature_ && account) signature_ = await account.sign({ hash: digest })
+
+          const keyAuthorization =
+            keyAuthorization_unsigned && account
+              ? await signKeyAuthorization(account, keyAuthorization_unsigned, {
+                  signature: signature_,
+                })
+              : undefined
+
+          return { accounts, keyAuthorization, signature: signature_ }
+        },
+        async revokeAccessKey(parameters) {
+          AccessKey.revoke({
+            address: parameters.address,
+            store,
+          })
+        },
+        async signPersonalMessage({ data, address }) {
+          const account = getAccount({ address, signable: true })
+          return await account.signMessage({ message: { raw: data } })
+        },
+        async signTransaction(parameters) {
+          const { feePayer, ...rest } = parameters
+          const client = getClient({
+            feePayer: typeof feePayer === 'string' ? feePayer : undefined,
+          })
+          const { account, prepared } = await withAccessKey(async (account, keyAuthorization) => ({
+            account,
+            prepared: await prepareTransactionRequest(client, {
+              account,
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+              keyAuthorization,
+              type: 'tempo',
+            }),
+          }))
+          return await account.signTransaction(prepared as never)
+        },
+        async signTypedData({ data, address }) {
+          const account = getAccount({ address, signable: true })
+          const { domain, types, primaryType, message } = JSON.parse(data)
+          return await account.signTypedData({ domain, types, primaryType, message })
+        },
+        async sendTransaction(parameters) {
+          const { feePayer, ...rest } = parameters
+          const client = getClient({
+            feePayer: typeof feePayer === 'string' ? feePayer : undefined,
+          })
+          const { account, prepared } = await withAccessKey(async (account, keyAuthorization) => ({
+            account,
+            prepared: await prepareTransactionRequest(client, {
+              account,
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+              keyAuthorization,
+              type: 'tempo',
+            }),
+          }))
+          const signed = await account.signTransaction(prepared as never)
+          return await client.request({
+            method: 'eth_sendRawTransaction' as never,
+            params: [signed],
+          })
+        },
+        async sendTransactionSync(parameters) {
+          const { feePayer, ...rest } = parameters
+          const client = getClient({
+            feePayer: typeof feePayer === 'string' ? feePayer : undefined,
+          })
+          const { account, prepared } = await withAccessKey(async (account, keyAuthorization) => ({
+            account,
+            prepared: await prepareTransactionRequest(client, {
+              account,
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+              keyAuthorization,
+              type: 'tempo',
+            }),
+          }))
+          const signed = await account.signTransaction(prepared as never)
+          return await client.request({
+            method: 'eth_sendRawTransactionSync' as never,
+            params: [signed],
+          })
+        },
+      },
+    }
+  })
+}
+
+export declare namespace local {
+  type Options = {
+    /** Create a new account. Optional — omit for login-only flows. */
+    createAccount?:
+      | ((params: Adapter.createAccount.Parameters) => Promise<Adapter.createAccount.ReturnType>)
+      | undefined
+    /** Discover existing accounts (e.g. WebAuthn assertion). */
+    loadAccounts: (
+      params?: Adapter.loadAccounts.Parameters | undefined,
+    ) => Promise<Adapter.loadAccounts.ReturnType>
+    /** Data URI of the provider icon. @default Black 1×1 SVG. */
+    icon?: `data:image/${string}` | undefined
+    /** Display name of the provider (e.g. `"My Wallet"`). @default "Injected Wallet" */
+    name?: string | undefined
+    /** Reverse DNS identifier. @default `com.{lowercase name}` */
+    rdns?: string | undefined
+  }
+}

package/src/core/adapters/webAuthn.ts

@@ -0,0 +1,129 @@
+import { PublicKey, Signature } from 'ox'
+import { SignatureEnvelope } from 'ox/tempo'
+import { Account } from 'viem/tempo'
+import { Authentication, Registration } from 'webauthx/client'
+
+import type { OneOf } from '../../internal/types.js'
+import * as Adapter from '../Adapter.js'
+import * as Ceremony from '../Ceremony.js'
+import { local } from './local.js'
+
+/**
+ * Creates a WebAuthn adapter backed by real passkey ceremonies.
+ *
+ * Wraps the {@link local} adapter with WebAuthn registration and authentication flows,
+ * using the provided {@link Ceremony} for challenge generation and verification.
+ *
+ * @example
+ * ```ts
+ * import { webAuthn } from 'accounts'
+ *
+ * const provider = Provider.create({
+ *   adapter: webAuthn(),
+ * })
+ * ```
+ */
+export function webAuthn(options: webAuthn.Options = {}): Adapter.Adapter {
+  const { authUrl, icon, name, rdns } = options
+
+  return Adapter.define({ icon, name, rdns }, (parameters) => {
+    const { storage } = parameters
+
+    const ceremony =
+      options.ceremony ??
+      (authUrl ? Ceremony.server({ url: authUrl }) : Ceremony.local({ storage }))
+
+    const base = local({
+      async createAccount(parameters) {
+        const { options } = await ceremony.getRegistrationOptions(parameters)
+        const rpId = options.publicKey?.rp.id
+        if (!rpId) throw new Error('rpId is required')
+        const credential = await Registration.create({ options })
+        const { publicKey } = await ceremony.verifyRegistration(credential, {
+          name: parameters.name,
+        })
+        await storage.setItem('lastCredentialId', credential.id)
+        const account = Account.fromWebAuthnP256({ id: credential.id, publicKey })
+        return {
+          accounts: [
+            {
+              address: account.address,
+              keyType: 'webAuthn',
+              credential: { id: credential.id, publicKey, rpId },
+            },
+          ],
+        }
+      },
+      async loadAccounts(parameters = {}) {
+        const { selectAccount, digest } = parameters
+
+        const credentialId = selectAccount
+          ? undefined
+          : (parameters?.credentialId ??
+            (await storage.getItem<string>('lastCredentialId')) ??
+            undefined)
+
+        const { options } = await ceremony.getAuthenticationOptions({
+          ...parameters,
+          challenge: digest,
+          credentialId,
+        })
+
+        const rpId = options.publicKey?.rpId
+        if (!rpId) throw new Error('rpId is required')
+
+        const response = await Authentication.sign({ options })
+        const { publicKey } = await ceremony.verifyAuthentication(response)
+
+        await storage.setItem('lastCredentialId', response.id)
+
+        const account = Account.fromWebAuthnP256({ id: response.id, publicKey }, { rpId })
+
+        const signature = digest
+          ? SignatureEnvelope.serialize(
+              {
+                metadata: response.metadata,
+                publicKey: PublicKey.fromHex(publicKey),
+                signature: Signature.from(response.signature),
+                type: 'webAuthn',
+              },
+              { magic: true },
+            )
+          : undefined
+
+        return {
+          accounts: [
+            {
+              address: account.address,
+              keyType: 'webAuthn',
+              credential: { id: response.id, publicKey, rpId },
+            },
+          ],
+          signature,
+        }
+      },
+    })(parameters)
+
+    return { ...base, persistAccounts: true }
+  })
+}
+
+export declare namespace webAuthn {
+  type Options = OneOf<
+    | {
+        /** Ceremony strategy for WebAuthn registration and authentication. @default Ceremony.local() */
+        ceremony?: Ceremony.Ceremony | undefined
+      }
+    | {
+        /** URL of a WebAuthn handler (shorthand for `Ceremony.server({ url })`). */
+        authUrl?: string | undefined
+      }
+  > & {
+    /** Data URI of the provider icon. @default Black 1×1 SVG. */
+    icon?: `data:image/${string}` | undefined
+    /** Display name of the provider (e.g. `"My Wallet"`). @default "Injected Wallet" */
+    name?: string | undefined
+    /** Reverse DNS identifier. @default `com.{lowercase name}` */
+    rdns?: string | undefined
+  }
+}

package/src/core/internal/withDedupe.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test } from 'vp/test'
+
+import { withDedupe } from './withDedupe.js'
+
+describe('withDedupe', () => {
+  test('default: returns result of fn', async () => {
+    const result = await withDedupe(() => Promise.resolve(42), { id: 'a' })
+    expect(result).toMatchInlineSnapshot(`42`)
+  })
+
+  test('behavior: deduplicates concurrent calls with same id', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return new Promise<number>((resolve) => setTimeout(() => resolve(calls), 10))
+    }
+
+    const [a, b, c] = await Promise.all([
+      withDedupe(fn, { id: 'same' }),
+      withDedupe(fn, { id: 'same' }),
+      withDedupe(fn, { id: 'same' }),
+    ])
+
+    expect(calls).toMatchInlineSnapshot(`1`)
+    expect(a).toMatchInlineSnapshot(`1`)
+    expect(b).toMatchInlineSnapshot(`1`)
+    expect(c).toMatchInlineSnapshot(`1`)
+  })
+
+  test('behavior: different ids execute independently', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return Promise.resolve(calls)
+    }
+
+    const [a, b] = await Promise.all([withDedupe(fn, { id: 'x' }), withDedupe(fn, { id: 'y' })])
+
+    expect(calls).toMatchInlineSnapshot(`2`)
+    expect(a).toMatchInlineSnapshot(`1`)
+    expect(b).toMatchInlineSnapshot(`2`)
+  })
+
+  test('behavior: cache is cleared after promise resolves', async () => {
+    const fn = () => Promise.resolve('ok')
+
+    await withDedupe(fn, { id: 'clear' })
+    expect(withDedupe.cache.has('clear')).toMatchInlineSnapshot(`false`)
+  })
+
+  test('behavior: cache is cleared after promise rejects', async () => {
+    const fn = () => Promise.reject(new Error('fail'))
+
+    await withDedupe(fn, { id: 'reject' }).catch(() => {})
+    expect(withDedupe.cache.has('reject')).toMatchInlineSnapshot(`false`)
+  })
+
+  test('behavior: rejection is shared across deduped calls', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return Promise.reject(new Error('boom'))
+    }
+
+    const results = await Promise.allSettled([
+      withDedupe(fn, { id: 'err' }),
+      withDedupe(fn, { id: 'err' }),
+    ])
+
+    expect(calls).toMatchInlineSnapshot(`1`)
+    expect(results[0]!.status).toMatchInlineSnapshot(`"rejected"`)
+    expect(results[1]!.status).toMatchInlineSnapshot(`"rejected"`)
+  })
+
+  test('behavior: allows new call after previous settles', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return Promise.resolve(calls)
+    }
+
+    const first = await withDedupe(fn, { id: 'seq' })
+    const second = await withDedupe(fn, { id: 'seq' })
+
+    expect(first).toMatchInlineSnapshot(`1`)
+    expect(second).toMatchInlineSnapshot(`2`)
+    expect(calls).toMatchInlineSnapshot(`2`)
+  })
+
+  test('behavior: bypasses when enabled is false', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return Promise.resolve('ok')
+    }
+
+    await Promise.all([
+      withDedupe(fn, { id: 'dis', enabled: false }),
+      withDedupe(fn, { id: 'dis', enabled: false }),
+    ])
+
+    expect(calls).toMatchInlineSnapshot(`2`)
+  })
+
+  test('behavior: bypasses when id is undefined', async () => {
+    let calls = 0
+    const fn = () => {
+      calls++
+      return Promise.resolve('ok')
+    }
+
+    await Promise.all([withDedupe(fn, { id: undefined }), withDedupe(fn, { id: undefined })])
+
+    expect(calls).toMatchInlineSnapshot(`2`)
+  })
+})

package/src/core/internal/withDedupe.ts

@@ -0,0 +1,20 @@
+/** Deduplicates in-flight promises by key. */
+export function withDedupe<data>(
+  fn: () => Promise<data>,
+  { enabled = true, id }: withDedupe.Options,
+): Promise<data> {
+  if (!enabled || !id) return fn()
+  if (withDedupe.cache.get(id)) return withDedupe.cache.get(id)!
+  const promise = fn().finally(() => withDedupe.cache.delete(id))
+  withDedupe.cache.set(id, promise)
+  return promise
+}
+
+export declare namespace withDedupe {
+  type Options = {
+    enabled?: boolean | undefined
+    id?: string | undefined
+  }
+}
+
+withDedupe.cache = new Map<string, Promise<any>>()

package/src/core/mppx.test.ts

@@ -0,0 +1,83 @@
+import { Mppx as ServerMppx, tempo } from 'mppx/server'
+import { parseUnits } from 'viem'
+import { Addresses } from 'viem/tempo'
+import { Actions } from 'viem/tempo'
+import { afterAll, beforeAll, describe, expect, test } from 'vp/test'
+
+import { headlessWebAuthn } from '../../test/adapters.js'
+import { accounts, chain, getClient } from '../../test/config.js'
+import { type Server, createServer } from '../../test/utils.js'
+import * as Provider from './Provider.js'
+
+const recipient = accounts[1]!.address
+const client = getClient()
+
+const payment = ServerMppx.create({
+  methods: [
+    tempo({
+      recipient,
+      currency: Addresses.pathUsd,
+      getClient: () => client,
+    }),
+  ],
+  realm: 'mppx-test',
+  secretKey: 'test-secret-key',
+})
+
+let server: Server
+
+beforeAll(async () => {
+  server = await createServer(async (req, res) => {
+    const result = await ServerMppx.toNodeListener(
+      payment.charge({
+        amount: '1',
+      }),
+    )(req, res)
+    if (result.status === 402) return
+    res.writeHead(200, { 'Content-Type': 'application/json' })
+    res.end(JSON.stringify({ fortune: 'Your code will compile on the first try.' }))
+  })
+})
+
+afterAll(() => server?.closeAsync())
+
+describe('mppx integration', () => {
+  test('polyfilled fetch handles 402 charge automatically', async () => {
+    const provider = Provider.create({
+      adapter: headlessWebAuthn(),
+      chains: [chain],
+      mpp: true,
+    })
+
+    const address = await connect(provider)
+
+    const client = getClient()
+    await Actions.token.transferSync(client, {
+      account: accounts[0]!,
+      feeToken: Addresses.pathUsd,
+      to: address,
+      token: Addresses.pathUsd,
+      amount: parseUnits('10', 6),
+    })
+
+    const res = await fetch(`${server.url}/fortune`)
+    expect(res.status).toBe(200)
+
+    const body = await res.json()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "fortune": "Your code will compile on the first try.",
+      }
+    `)
+  })
+})
+
+async function connect(provider: ReturnType<typeof Provider.create>) {
+  const login = await provider.request({ method: 'wallet_connect' })
+  if (login.accounts.length > 0) return login.accounts[0]!.address
+  const register = await provider.request({
+    method: 'wallet_connect',
+    params: [{ capabilities: { method: 'register' } }],
+  })
+  return register.accounts[0]!.address
+}