nodpay 0.2.40 → 0.2.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodpay",
-  "version": "0.2.40",
+  "version": "0.2.41",
   "description": "NodPay CLI — propose on-chain payments from agent-human shared wallets",
   "type": "module",
   "bin": {

package/scripts/propose.mjs

@@ -113,6 +113,18 @@ if (_remoteWalletUrl) {
   }
   AGENT_ADDRESS = wallets[0].agentSigner;
 
+  // remote_wallet: extract passkey/recovery from wallet data for approvalContext
+  // (CLI args take precedence if provided, but agents in remote_wallet mode don't pass them)
+  const rw = wallets[0];
+  if (!passkeyX && rw.humanSignerPasskeyX) {
+    passkeyX = rw.humanSignerPasskeyX;
+    passkeyY = rw.humanSignerPasskeyY;
+    isPasskey = true;
+  }
+  if (!recoverySigner && rw.recoverySigner) {
+    recoverySigner = rw.recoverySigner;
+  }
+
   signHash = async (hash) => {
     const signRes = await fetch(`${_remoteWalletUrl.replace(/\/$/, '')}/sign`, {
       method: 'POST',
@@ -159,12 +171,12 @@ const humanSigner = getArg('--human-signer-eoa');
 const salt = getArg('--salt') || '1001';
 
 // Passkey support
-const passkeyX = getArg('--human-signer-passkey-x');
-const passkeyY = getArg('--human-signer-passkey-y');
+let passkeyX = getArg('--human-signer-passkey-x');
+let passkeyY = getArg('--human-signer-passkey-y');
 const passkeyRawId = getArg('--passkey-raw-id');
 const passkeyVerifier = getArg('--passkey-verifier') || '0x445a0683e494ea0c5AF3E83c5159fBE47Cf9e765';
-const recoverySigner = getArg('--recovery-signer');
-const isPasskey = !!(passkeyX && passkeyY);
+let recoverySigner = getArg('--recovery-signer');
+let isPasskey = !!(passkeyX && passkeyY);
 
 // remote_wallet + --human-signer-eoa is not supported
 if (_remoteWalletUrl && humanSigner) {
@@ -582,8 +594,28 @@ try {
   writeFileSync(join(PENDING_DIR, `4337-${shortId}.json`), JSON.stringify(result, null, 2));
 
   // Store to op-store API for hash-based web app lookup
-  // NOTE: signerType intentionally NOT sent — it's determined by user's browser
-  // (localStorage), not by agent. See ARCHITECTURE.md Client Verification Chain.
+  // Build approvalContext: server-side approval context (replaces localStorage dependency)
+  const approvalContext = isPasskey
+    ? {
+        version: 1,
+        signerType: 'passkey',
+        rpId: walletRpId || 'nodpay.ai',
+        passkeyX,
+        passkeyY,
+        recoveryAddress: recoverySigner || null,
+        safeAddress,
+        chainId: parseInt(CHAIN_ID, 10),
+      }
+    : humanSigner
+      ? {
+          version: 1,
+          signerType: 'eoa',
+          humanSignerAddress: humanSigner,
+          safeAddress,
+          chainId: parseInt(CHAIN_ID, 10),
+        }
+      : null;
+
   const storePayload = {
     safeOperationJson,
     userOpHash: entryPointUserOpHash,
@@ -596,10 +628,12 @@ try {
     agent: AGENT_ADDRESS,
     agentSignature: safeOperationJson.signatures,
     createdAt: new Date().toISOString(),
-    // SafeClaw integration: passkey coordinates + recovery for approve page fallback
+    // Legacy fields (kept for URL-param fallback during transition)
     passkeyX: passkeyX || null,
     passkeyY: passkeyY || null,
     recoveryAddress: recoverySigner || null,
+    // Server-side approval context
+    approvalContext,
   };
 
   // Extract raw agent signature for server auth