uvd-x402-sdk 2.100.0 → 2.102.0

package/dist/adapters/index.js

@@ -1205,9 +1205,9 @@ function encodeBase64Json(value) {
 // src/utils/x402.ts
 function chainToCAIP2(chainName) {
   const chain = getChainByName(chainName);
-  const caip2 = CAIP2_IDENTIFIERS[(chain?.name ?? chainName).toLowerCase()];
-  if (caip2) {
-    return caip2;
+  const caip22 = CAIP2_IDENTIFIERS[(chain?.name ?? chainName).toLowerCase()];
+  if (caip22) {
+    return caip22;
   }
   if (chain) {
     if (chain.networkType === "evm") {
@@ -1443,6 +1443,110 @@ function useX402Wagmi(walletClient) {
     createPaymentFull
   };
 }
+var INTEGER_TYPE = /^u?int\d*$/;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function inexactNumberMessage(field, value) {
+  return `${field} is the JSON number ${String(value)}, larger in magnitude than Number.MAX_SAFE_INTEGER (2**53 - 1): JSON.parse has already rounded it, and signing it would sign a different integer than the one that was written. Send uints as decimal or 0x-hex strings (or a bigint)`;
+}
+function numberRefusal(path, value, code) {
+  return new X402Error(
+    Number.isInteger(value) ? inexactNumberMessage(path, value) : `${path} must be an integer, got the JSON number ${String(value)}`,
+    code
+  );
+}
+function findInexactNumber(value, path, seen = /* @__PURE__ */ new Set()) {
+  if (typeof value === "number") {
+    return Number.isSafeInteger(value) ? null : { path, value };
+  }
+  if (typeof value !== "object" || value === null || seen.has(value)) return null;
+  seen.add(value);
+  const entries = Array.isArray(value) ? value.map((item, i) => [`${path}[${i}]`, item]) : Object.entries(value).map(([key, item]) => [`${path}.${key}`, item]);
+  for (const [itemPath, item] of entries) {
+    const hit = findInexactNumber(item, itemPath, seen);
+    if (hit) return hit;
+  }
+  return null;
+}
+function assertNoInexactNumber(value, path, code = "INVALID_CONFIG") {
+  const hit = findInexactNumber(value, path);
+  if (hit) throw numberRefusal(hit.path, hit.value, code);
+}
+function rootStruct(structs, primaryType) {
+  try {
+    return ethers.ethers.TypedDataEncoder.from(
+      structs
+    ).primaryType;
+  } catch {
+    return typeof primaryType === "string" && Array.isArray(structs[primaryType]) ? primaryType : null;
+  }
+}
+function checkTyped(type, value, path, structs, code, ancestors = /* @__PURE__ */ new Set()) {
+  if (typeof value === "object" && value !== null) {
+    if (ancestors.has(value)) return;
+    ancestors.add(value);
+  }
+  try {
+    const array = /^(.*)\[(\d*)\]$/.exec(type);
+    if (array) {
+      if (Array.isArray(value)) {
+        value.forEach(
+          (item, i) => checkTyped(array[1], item, `${path}[${i}]`, structs, code, ancestors)
+        );
+      }
+      return;
+    }
+    const struct = structs[type];
+    if (Array.isArray(struct)) {
+      if (!isRecord(value)) return;
+      for (const field of struct) {
+        if (typeof field?.name === "string" && typeof field.type === "string") {
+          checkTyped(
+            field.type,
+            value[field.name],
+            `${path}.${field.name}`,
+            structs,
+            code,
+            ancestors
+          );
+        }
+      }
+      return;
+    }
+    if (INTEGER_TYPE.test(type) && typeof value === "number" && !Number.isSafeInteger(value)) {
+      throw numberRefusal(path, value, code);
+    }
+  } finally {
+    if (typeof value === "object" && value !== null) ancestors.delete(value);
+  }
+}
+function assertTypedDataIntegersExact(doc, where = "typed data", code = "INVALID_CONFIG") {
+  if (!isRecord(doc)) return;
+  const { domain, types, message, primaryType } = doc;
+  if (isRecord(domain) && typeof domain.chainId === "number" && !Number.isSafeInteger(domain.chainId)) {
+    throw numberRefusal(`${where} domain.chainId`, domain.chainId, code);
+  }
+  if (!isRecord(message)) return;
+  const structs = isRecord(types) ? { ...types } : {};
+  delete structs["EIP712Domain"];
+  const root = rootStruct(structs, primaryType);
+  if (root) {
+    checkTyped(root, message, `${where} message`, structs, code);
+    if (typeof primaryType === "string" && primaryType !== root && Array.isArray(structs[primaryType])) {
+      checkTyped(primaryType, message, `${where} message`, structs, code);
+    }
+    return;
+  }
+  assertNoInexactNumber(message, `${where} message`, code);
+}
+function parseTypedDataJson(text, where = "typed data", code = "INVALID_CONFIG") {
+  const doc = JSON.parse(text);
+  assertTypedDataIntegersExact(doc, where, code);
+  return doc;
+}
+
+// src/adapters/env-key.ts
 var EnvKeyAdapter = class {
   wallet;
   /**
@@ -1482,9 +1586,12 @@ var EnvKeyAdapter = class {
    *
    * @param typedData - JSON string with `domain`, `types`, `primaryType`, and `message` fields
    * @returns Object with signature and v/r/s components
+   * @throws {X402Error} `INVALID_CONFIG` when an integer field of `message`
+   *   (or `domain.chainId`) is a JSON number above 2**53 - 1: `JSON.parse`
+   *   rounded it, so it is refused instead of signed. Write uints as strings.
    */
   async signTypedData(typedData) {
-    const parsed = JSON.parse(typedData);
+    const parsed = parseTypedDataJson(typedData);
     const { domain, types, message } = parsed;
     const cleanTypes = { ...types };
     delete cleanTypes["EIP712Domain"];
@@ -1585,121 +1692,342 @@ var EnvKeyAdapter = class {
     };
   }
 };
+var OWS_FUNCTIONS = ["getWallet", "signMessage", "signTypedData", "signTransaction"];
+var MIGRATION = "pass the module and the wallet: new OWSWalletAdapter(ows, { wallet: '<name or id>', passphrase }) with import * as ows from '@open-wallet-standard/core'";
+var EIP712_DOMAIN_FIELDS = [
+  ["name", "string"],
+  ["version", "string"],
+  ["chainId", "uint256"],
+  ["verifyingContract", "address"],
+  ["salt", "bytes32"]
+];
+var TRANSACTION_FIELDS = [
+  "type",
+  "to",
+  "nonce",
+  "gasLimit",
+  "gasPrice",
+  "maxPriorityFeePerGas",
+  "maxFeePerGas",
+  "maxFeePerBlobGas",
+  "data",
+  "value",
+  "chainId",
+  "signature",
+  "accessList",
+  "authorizationList",
+  "blobVersionedHashes",
+  "kzg",
+  "blobWrapperVersion",
+  "blobs"
+];
+var ETHERS_NAME_OF = { input: "data", gas: "gasLimit" };
+var TWO_127 = 1n << 127n;
+var TWO_128 = 1n << 128n;
+var TWO_256 = 1n << 256n;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function shown(value) {
+  if (typeof value === "bigint") return `${value}n`;
+  try {
+    return JSON.stringify(value) ?? String(value);
+  } catch {
+    return String(value);
+  }
+}
+function refuse(message) {
+  return new X402Error(`${message}; nothing was signed`, "INVALID_CONFIG");
+}
+function toInteger(value, where) {
+  if (typeof value === "bigint") return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) return BigInt(value);
+  if (typeof value === "number" && Number.isInteger(value)) throw refuse(inexactNumberMessage(where, value));
+  if (typeof value === "string" && /^-?(0[xX][0-9a-fA-F]+|[0-9]+)$/.test(value)) {
+    return value.startsWith("-") ? -BigInt(value.slice(1)) : BigInt(value);
+  }
+  throw refuse(
+    `${where}: ${shown(value)} is not an integer (a safe-integer number, a decimal string or 0x-hex)`
+  );
+}
+function integerWire(n) {
+  if (n >= -TWO_127 && n < TWO_128) return n.toString();
+  if (n > 0n) {
+    const digits = n.toString(16);
+    return `0x${digits.length % 2 ? "0" : ""}${digits}`;
+  }
+  return `0x${(n + TWO_256).toString(16).padStart(64, "0")}`;
+}
+function owsValue(kind, value, types, where) {
+  const array = /^(.*)\[(\d*)\]$/.exec(kind);
+  if (array) {
+    const [, inner, size] = array;
+    if (!Array.isArray(value)) throw refuse(`${where}: ${kind} needs an array, got ${shown(value)}`);
+    if (size !== "" && value.length !== Number(size)) {
+      throw refuse(`${where}: ${kind} needs ${size} items, got ${value.length}`);
+    }
+    return value.map((item, i) => owsValue(inner, item, types, `${where}[${i}]`));
+  }
+  const struct = types[kind];
+  if (struct) {
+    if (!isRecord2(value)) throw refuse(`${where}: ${kind} needs an object, got ${shown(value)}`);
+    const out = {};
+    for (const field of struct) {
+      if (value[field.name] === void 0) throw refuse(`${where}: ${kind} lacks ${field.name}`);
+      out[field.name] = owsValue(field.type, value[field.name], types, `${where}.${field.name}`);
+    }
+    return out;
+  }
+  const integer = /^(u?)int(\d+)$/.exec(kind);
+  if (integer) {
+    const bits = BigInt(integer[2]);
+    const n = toInteger(value, where);
+    const [low, high] = integer[1] ? [0n, 1n << bits] : [-(1n << bits - 1n), 1n << bits - 1n];
+    if (n < low || n >= high) {
+      throw new X402Error(
+        `${where}: ${shown(value)} is out of range for ${kind}; nothing was signed`,
+        "INVALID_AMOUNT"
+      );
+    }
+    return integerWire(n);
+  }
+  if (kind === "bool") {
+    if (typeof value !== "boolean") throw refuse(`${where}: bool needs true or false, got ${shown(value)}`);
+    return value;
+  }
+  if (kind === "string") {
+    if (typeof value !== "string") throw refuse(`${where}: string needs a string, got ${shown(value)}`);
+    return value;
+  }
+  if (kind === "address") {
+    try {
+      if (typeof value !== "string") throw new Error();
+      return ethers.ethers.getAddress(value);
+    } catch {
+      throw refuse(`${where}: ${shown(value)} is not an address`);
+    }
+  }
+  const bytes = /^bytes(\d*)$/.exec(kind);
+  if (bytes) {
+    let raw;
+    try {
+      if (typeof value !== "string") throw new Error();
+      raw = ethers.ethers.getBytes(value);
+    } catch {
+      throw refuse(`${where}: ${kind} needs 0x-hex, got ${shown(value)}`);
+    }
+    if (bytes[1] !== "" && raw.length !== Number(bytes[1])) {
+      throw refuse(`${where}: ${kind} needs ${bytes[1]} bytes, got ${raw.length}`);
+    }
+    return ethers.ethers.hexlify(raw);
+  }
+  throw refuse(`${where}: unsupported EIP-712 type ${kind}`);
+}
+function prepareTypedData(input) {
+  if (!isRecord2(input)) throw refuse("typed data must be an object with domain, types and message");
+  const { domain, types, message, primaryType } = input;
+  if (!isRecord2(domain)) throw refuse("typed data needs a domain object");
+  if (!isRecord2(types)) throw refuse("typed data needs a types object");
+  if (!isRecord2(message)) throw refuse("typed data needs a message object");
+  const structs = { ...types };
+  delete structs["EIP712Domain"];
+  let root;
+  try {
+    root = ethers.ethers.TypedDataEncoder.from(structs).primaryType;
+  } catch (error) {
+    throw refuse(`typed data types are invalid (${error instanceof Error ? error.message : error})`);
+  }
+  if (primaryType !== void 0 && primaryType !== root) {
+    throw refuse(
+      `primaryType ${shown(primaryType)} is not ${root}, the root struct ethers signs for these types`
+    );
+  }
+  for (const key of Object.keys(domain)) {
+    if (!EIP712_DOMAIN_FIELDS.some(([name]) => name === key)) {
+      throw refuse(`domain.${key} is not an EIP-712 domain field`);
+    }
+  }
+  const all = {
+    EIP712Domain: EIP712_DOMAIN_FIELDS.filter(([name]) => domain[name] != null).map(
+      ([name, type]) => ({ name, type })
+    ),
+    ...structs
+  };
+  const owsDomain = owsValue("EIP712Domain", domain, all, "domain");
+  const owsMessage = owsValue(root, message, all, "message");
+  const chainId = domain["chainId"] != null ? toInteger(domain["chainId"], "domain.chainId") : 0n;
+  return {
+    document: JSON.stringify({ types: all, primaryType: root, domain: owsDomain, message: owsMessage }),
+    domain,
+    types: structs,
+    message,
+    chain: chainId > 0n ? `eip155:${chainId}` : null
+  };
+}
+function evmSignature(result, what) {
+  const hex = String(result?.signature ?? "").replace(/^0x/, "");
+  if (!/^[0-9a-fA-F]{130}$/.test(hex)) {
+    throw new X402Error(`OWS ${what} returned a signature that is not 65 bytes of hex`, "PAYMENT_FAILED");
+  }
+  const bytes = ethers.ethers.getBytes(`0x${hex}`);
+  const v = bytes[64] < 27 ? bytes[64] + 27 : bytes[64];
+  if (v !== 27 && v !== 28) {
+    throw new X402Error(`OWS ${what} returned a recovery byte of ${bytes[64]}`, "PAYMENT_FAILED");
+  }
+  return ethers.ethers.Signature.from({
+    r: ethers.ethers.hexlify(bytes.subarray(0, 32)),
+    s: ethers.ethers.hexlify(bytes.subarray(32, 64)),
+    v
+  });
+}
+function caip2(network) {
+  if (typeof network !== "string") {
+    throw new X402Error(
+      `OWSWalletAdapter: options.network must be a string (an SDK network name or eip155:<id>), got ${typeof network}`,
+      "INVALID_CONFIG"
+    );
+  }
+  const caip = /^eip155:([1-9][0-9]*)$/.exec(network);
+  if (caip) return network;
+  const chain = getChainByName(network);
+  if (!chain || chain.networkType !== "evm") {
+    throw new X402Error(
+      `OWSWalletAdapter signs for an EVM network; got ${shown(network)}`,
+      "CHAIN_NOT_SUPPORTED"
+    );
+  }
+  return `eip155:${chain.chainId}`;
+}
 var OWSWalletAdapter = class {
-  owsWallet;
-  address;
-  /**
-   * Create an OWSWalletAdapter.
-   *
-   * @param owsWallet - An object implementing the OWSWallet interface
-   *   (typically from @open-wallet-standard/core or a compatible provider)
-   * @param accountIndex - Which account to use if the wallet has multiple (default: 0)
-   * @throws {X402Error} if the wallet has no accounts
-   */
-  constructor(owsWallet, accountIndex = 0) {
-    if (!owsWallet || !owsWallet.accounts || owsWallet.accounts.length === 0) {
+  #ows;
+  #wallet;
+  #passphrase;
+  #vaultPath;
+  #chain;
+  #address;
+  constructor(ows, options) {
+    if (isRecord2(ows) && "accounts" in ows && (options === void 0 || typeof options === "number")) {
       throw new X402Error(
-        "OWS wallet has no accounts. Create or import a wallet first.",
-        "WALLET_NOT_CONNECTED"
+        `OWSWalletAdapter no longer takes a wallet object with accounts (the deprecated OWSWallet shape, which never worked with @open-wallet-standard/core 1.x); ${MIGRATION}. Nothing was signed.`,
+        "INVALID_CONFIG"
       );
     }
-    const account = owsWallet.accounts[accountIndex];
-    if (!account) {
+    const missing = OWS_FUNCTIONS.filter(
+      (name) => typeof ows?.[name] !== "function"
+    );
+    if (missing.length > 0) {
       throw new X402Error(
-        `OWS wallet account index ${accountIndex} does not exist. Wallet has ${owsWallet.accounts.length} account(s).`,
-        "WALLET_NOT_CONNECTED"
+        `OWSWalletAdapter takes the @open-wallet-standard/core module (import * as ows from '@open-wallet-standard/core'); it lacks ${missing.join(", ")}. Since the OWS rewrite the adapter no longer takes a wallet object with accounts.`,
+        "INVALID_CONFIG"
       );
     }
-    this.owsWallet = owsWallet;
-    this.address = ethers.ethers.getAddress(account.address);
+    const opts = isRecord2(options) ? options : {};
+    if (typeof opts.wallet !== "string" || opts.wallet === "") {
+      throw new X402Error("OWSWalletAdapter needs options.wallet: the name or id of a wallet in the vault", "INVALID_CONFIG");
+    }
+    if (opts.passphrase != null && typeof opts.passphrase !== "string") {
+      throw new X402Error("OWSWalletAdapter: options.passphrase must be a string", "INVALID_CONFIG");
+    }
+    this.#ows = ows;
+    this.#wallet = opts.wallet;
+    this.#passphrase = opts.passphrase ?? (typeof process !== "undefined" ? process.env?.OWS_PASSPHRASE : void 0) ?? null;
+    this.#vaultPath = opts.vaultPath ?? null;
+    this.#chain = caip2(opts.network ?? "base");
+    const info = this.#call("getWallet", () => this.#ows.getWallet(this.#wallet, this.#vaultPath), "WALLET_NOT_FOUND");
+    const account = (info?.accounts ?? []).find((a) => String(a.chainId).startsWith("eip155:"));
+    if (!account) {
+      throw new X402Error(`OWS wallet ${shown(this.#wallet)} has no EVM account`, "WALLET_NOT_FOUND");
+    }
+    this.#address = ethers.ethers.getAddress(account.address);
   }
   /**
-   * Get the checksummed EVM wallet address.
+   * Get the checksummed EVM wallet address (read from the vault once, when
+   * the adapter was created; no passphrase needed).
    */
   getAddress() {
-    return this.address;
+    return this.#address;
   }
   /**
-   * Sign a message using EIP-191 personal_sign.
+   * Sign a message using EIP-191 personal_sign (the string as UTF-8, as
+   * `EnvKeyAdapter` signs it).
    *
    * @param message - The message string to sign
-   * @returns Hex-encoded signature
+   * @returns Hex-encoded 65-byte signature, v = 27/28
    */
   async signMessage(message) {
+    if (typeof message !== "string") throw refuse(`signMessage takes a string, got ${typeof message}`);
+    const result = this.#call(
+      "signMessage",
+      () => this.#ows.signMessage(this.#wallet, this.#chain, message, this.#passphrase, "utf8", null, this.#vaultPath)
+    );
+    const signature = evmSignature(result, "signMessage").serialized;
+    let signer = "";
     try {
-      const result = await this.owsWallet.signMessage({
-        account: { address: this.address },
-        message
-      });
-      return result.signature;
-    } catch (error) {
-      throw new X402Error(
-        `OWS signMessage failed: ${error instanceof Error ? error.message : "Unknown error"}`,
-        "PAYMENT_FAILED",
-        error
-      );
+      signer = ethers.ethers.verifyMessage(message, signature);
+    } catch {
     }
+    this.#checkSigner(signer, "signMessage");
+    return signature;
   }
   /**
    * Sign EIP-712 typed structured data.
    *
-   * @param typedData - JSON string with `domain`, `types`, `primaryType`, and `message` fields
+   * @param typedData - JSON string with `domain`, `types`, `message` and
+   *   optionally `primaryType` (it must then be the root struct)
    * @returns Object with signature and v/r/s components
+   * @throws {X402Error} `INVALID_AMOUNT` for an integer out of its type's
+   *   range and `INVALID_CONFIG` for anything else ethers would not encode,
+   *   both before signing; `PAYMENT_FAILED` if OWS fails or signs a digest
+   *   other than the one ethers computes (the signature is not returned).
    */
   async signTypedData(typedData) {
-    const parsed = JSON.parse(typedData);
+    let parsed;
     try {
-      const result = await this.owsWallet.signTypedData({
-        account: { address: this.address },
-        domain: parsed.domain,
-        types: parsed.types,
-        primaryType: parsed.primaryType,
-        message: parsed.message
-      });
-      const sig = ethers.ethers.Signature.from(result.signature);
-      return {
-        signature: result.signature,
-        v: sig.v,
-        r: sig.r,
-        s: sig.s
-      };
-    } catch (error) {
-      throw new X402Error(
-        `OWS signTypedData failed: ${error instanceof Error ? error.message : "Unknown error"}`,
-        "PAYMENT_FAILED",
-        error
-      );
+      parsed = JSON.parse(typedData);
+    } catch {
+      throw refuse("typedData is not a JSON string");
     }
+    return this.#signTyped(parsed);
   }
   /**
-   * Sign a serialized EVM transaction.
+   * Sign an EVM transaction.
    *
-   * Delegates to the OWS wallet's signTransaction method.
-   * Used by AdvancedEscrowClient for on-chain operations (release,
-   * refund, charge) where the wallet signs instead of a raw private key.
+   * OWS signs keccak256 of the bytes it is given and returns only the
+   * signature, so the transaction is parsed and serialised with ethers here,
+   * the way `EnvKeyAdapter` (ethers.Wallet) does it, EIP-155 `v` included.
    *
-   * @param unsignedTx - Hex-encoded unsigned transaction
-   * @returns Hex-encoded signed raw transaction
+   * A sender, given as `from` or implied by an existing signature, must be
+   * this wallet: it is taken out, as ethers takes it out; any other sender is
+   * refused before signing.
+   *
+   * @param unsignedTx - Hex-encoded transaction (ethers serialized), an
+   *   `ethers.Transaction`, or a transaction object ethers' `Transaction.from`
+   *   accepts, plus `from`
+   * @returns Hex-encoded signed raw transaction, ready for broadcast
    */
   async signTransaction(unsignedTx) {
-    try {
-      const result = await this.owsWallet.signTransaction({
-        account: { address: this.address },
-        transaction: unsignedTx,
-        chainId: "1"
-        // chainId is embedded in the serialized TX; this is a hint
-      });
-      return result.signedTransaction;
-    } catch (error) {
-      throw new X402Error(
-        `OWS signTransaction failed: ${error instanceof Error ? error.message : "Unknown error"}`,
-        "PAYMENT_FAILED",
-        error
-      );
-    }
+    const tx = this.#unsignedTransaction(unsignedTx);
+    const chain = tx.chainId > 0n ? `eip155:${tx.chainId}` : this.#chain;
+    const result = this.#call(
+      "signTransaction",
+      () => this.#ows.signTransaction(
+        this.#wallet,
+        chain,
+        tx.unsignedSerialized.slice(2),
+        this.#passphrase,
+        null,
+        this.#vaultPath
+      )
+    );
+    tx.signature = evmSignature(result, "signTransaction");
+    const signed = tx.serialized;
+    this.#checkSigner(ethers.ethers.Transaction.from(signed).from ?? "", "signTransaction");
+    return signed;
   }
   /**
-   * Sign an EIP-3009 ReceiveWithAuthorization for USDC.
+   * Sign an EIP-3009 TransferWithAuthorization for USDC: the typed data
+   * `EnvKeyAdapter.signEIP3009` builds, signed through {@link signTypedData}
+   * (OWS has no EIP-3009 call of its own).
    *
    * @param params - EIP-3009 parameters
    * @returns Signed authorization ready for facilitator relay
@@ -1717,65 +2045,133 @@ var OWSWalletAdapter = class {
     }
     const chainId = params.chainId ?? chain.chainId;
     const usdcAddress = params.usdcContract ?? chain.usdc.address;
-    const from = this.address;
+    const from = this.#address;
     const to = ethers.ethers.getAddress(params.to);
     const value = ethers.ethers.parseUnits(params.amountUsdc.toString(), chain.usdc.decimals);
     const validAfter = params.validAfter ?? 0;
     const validBefore = params.validBefore ?? Math.floor(Date.now() / 1e3) + 300;
     const nonce = ethers.ethers.hexlify(ethers.ethers.randomBytes(32));
-    const domain = {
-      name: chain.usdc.name,
-      version: chain.usdc.version,
-      chainId,
-      verifyingContract: usdcAddress
-    };
-    const types = {
-      TransferWithAuthorization: [
-        { name: "from", type: "address" },
-        { name: "to", type: "address" },
-        { name: "value", type: "uint256" },
-        { name: "validAfter", type: "uint256" },
-        { name: "validBefore", type: "uint256" },
-        { name: "nonce", type: "bytes32" }
-      ]
-    };
-    const message = {
+    const signed = await this.#signTyped({
+      domain: {
+        name: chain.usdc.name,
+        version: chain.usdc.version,
+        chainId,
+        verifyingContract: usdcAddress
+      },
+      types: {
+        TransferWithAuthorization: [
+          { name: "from", type: "address" },
+          { name: "to", type: "address" },
+          { name: "value", type: "uint256" },
+          { name: "validAfter", type: "uint256" },
+          { name: "validBefore", type: "uint256" },
+          { name: "nonce", type: "bytes32" }
+        ]
+      },
+      primaryType: "TransferWithAuthorization",
+      message: { from, to, value, validAfter, validBefore, nonce }
+    });
+    return {
       from,
       to,
       value: value.toString(),
       validAfter: validAfter.toString(),
       validBefore: validBefore.toString(),
-      nonce
+      nonce,
+      v: signed.v,
+      r: signed.r,
+      s: signed.s,
+      signature: signed.signature
     };
-    let signatureResult;
+  }
+  // --------------------------------------------------------------------------
+  async #signTyped(input) {
+    const typed = prepareTypedData(input);
+    const result = this.#call(
+      "signTypedData",
+      () => this.#ows.signTypedData(
+        this.#wallet,
+        typed.chain ?? this.#chain,
+        typed.document,
+        this.#passphrase,
+        null,
+        this.#vaultPath
+      )
+    );
+    const sig = evmSignature(result, "signTypedData");
+    let signer;
     try {
-      signatureResult = await this.owsWallet.signTypedData({
-        account: { address: this.address },
-        domain,
-        types,
-        primaryType: "TransferWithAuthorization",
-        message
-      });
+      signer = ethers.ethers.verifyTypedData(typed.domain, typed.types, typed.message, sig);
     } catch (error) {
       throw new X402Error(
-        `OWS signEIP3009 failed: ${error instanceof Error ? error.message : "Unknown error"}`,
-        "PAYMENT_FAILED",
-        error
+        `ethers cannot encode this typed data (${error instanceof Error ? error.message : error}); the OWS signature is not returned`,
+        "INVALID_CONFIG"
       );
     }
-    const sig = ethers.ethers.Signature.from(signatureResult.signature);
-    return {
-      from,
-      to,
-      value: value.toString(),
-      validAfter: validAfter.toString(),
-      validBefore: validBefore.toString(),
-      nonce,
-      v: sig.v,
-      r: sig.r,
-      s: sig.s,
-      signature: signatureResult.signature
-    };
+    this.#checkSigner(signer, "signTypedData");
+    return { signature: sig.serialized, v: sig.v, r: sig.r, s: sig.s };
+  }
+  #unsignedTransaction(input) {
+    const senders = [];
+    let tx;
+    try {
+      if (typeof input === "string") {
+        tx = ethers.ethers.Transaction.from(input);
+      } else if (typeof input === "object" && input !== null) {
+        const source = input;
+        for (const key of Object.keys(source)) {
+          if (key === "from" || key === "hash" || TRANSACTION_FIELDS.includes(key)) continue;
+          const ethersName = ETHERS_NAME_OF[key];
+          throw refuse(
+            `transaction key ${shown(key)} is not one ethers reads` + (ethersName ? `; ethers calls it ${ethersName}` : "")
+          );
+        }
+        if (source.from != null) senders.push(source.from);
+        const fields = {};
+        for (const key of TRANSACTION_FIELDS) {
+          if (source[key] != null) fields[key] = source[key];
+        }
+        tx = ethers.ethers.Transaction.from(fields);
+      } else {
+        throw new Error(`got ${typeof input}`);
+      }
+    } catch (error) {
+      if (error instanceof X402Error) throw error;
+      throw refuse(
+        `not a transaction ethers can read (${error instanceof Error ? error.message : error})`
+      );
+    }
+    if (tx.signature) senders.push(tx.from);
+    for (const sender of senders) {
+      let address = "";
+      try {
+        address = ethers.ethers.getAddress(sender);
+      } catch {
+      }
+      if (address !== this.#address) {
+        throw refuse(`transaction from ${shown(sender)} is not this wallet (${this.#address})`);
+      }
+    }
+    tx.signature = null;
+    return tx;
+  }
+  #checkSigner(signer, what) {
+    if (signer !== this.#address) {
+      throw new X402Error(
+        `OWS ${what} returned a signature that does not recover to ${this.#address} over the digest ethers computes (the one EnvKeyAdapter signs); it is not returned`,
+        "PAYMENT_FAILED"
+      );
+    }
+  }
+  /** Run one OWS call; its error becomes an X402Error without the passphrase in it. */
+  #call(what, run, code = "PAYMENT_FAILED") {
+    try {
+      return run();
+    } catch (error) {
+      let message = error instanceof Error ? error.message : String(error);
+      if (this.#passphrase) message = message.split(this.#passphrase).join("[redacted]");
+      throw new X402Error(`OWS ${what} failed: ${message}`, code);
+    }
   }
 };