feat: add feature-flagged Somnia session keys

[CryptoMickle]

Summary

• add an opt-in Thirdweb ERC-4337 Instant Play path for Somnia Shannon
• keep MetaMask as the owner/admin wallet and standard MetaMask play available
• restrict the temporary session key to the configured Delveworn contract, zero native value, and an 8-hour lifetime
• restore and revoke sessions with onchain permission checks
• lazy-load the Thirdweb bundle so the grant-linked RISE default does not load it on entry
• keep the feature disabled unless both the explicit flag and a public Thirdweb client ID are configured
• document the separate smart-account player address and rollout requirements
• extend frontend CI to RISE, Somnia standard, and Somnia session-key builds

Build verification

• npm run lint (0 errors; 15 existing warning categories)
• npx tsc --noEmit --pretty false
• npx npm@10.9.4 ci
• RISE production build with Next.js webpack
• Somnia standard production build with Next.js webpack
• Somnia session-key production build with Next.js webpack
• git diff --check

The normal CI jobs continue to use the repository build command and validate all three configurations. GitHub CI and both Vercel project checks are green.

Controlled live preview QA — 2026-09-01

Environment:

• Somnia Shannon Testnet, chain ID 50312
• Dungeon 0x07c5D071132ae95C3708031790b3feC740F4c292
• preview-only feature flag and public Thirdweb client ID; production was not changed
• Thirdweb sponsorship restricted to Somnia Shannon Testnet
• MetaMask owner 0x32af12c2be521D67A3a4eC0b168171CF335186d2
• ERC-4337 smart account 0xb936bb4869a59736F4548BB6BE9336ad548277B6
• temporary session signer 0x3a899F677FD5F5E63fab7A8EDfAb4Fc67CF13De2

Verified lifecycle:

1. Smart-account deployment and restricted 8-hour session authorization succeeded and was sponsored: 0xc532371fa848a7f731f62ccdafcd54676c3e655efacbef3f6f819126f1442e30.
2. startGame was submitted by the session signer as a sponsored UserOperation: 0x4cf1ef0c8642dcf3fcafe97c1a0ac11f63b8976623599cf4c896bd0e13dd3622.
3. Native verifiable VRF request 34 fulfilled successfully with callback success: 0xdfb48e2e554ffe3f838535387a07260c72628c3a52507addbce36813320957a0.
4. A gameplay attack was submitted without another MetaMask popup as a sponsored UserOperation: 0x09f3012e870764793dee783668dce5d9c15236bdb9e9faa55f458ba31393f733.
5. Native verifiable VRF request 35 fulfilled successfully with callback success: 0x112b6a4a0ca6645ba3c409c07ea5a96c1cdbde6576576425473dc989aac4655d.
6. The owner revoked the session signer successfully through a sponsored UserOperation: 0x8c7ebc82a6483db7c4080b470899096ff6b0818cce245225a2b9bfc64a2e133d.

Read-only postconditions:

• the session signer is absent from getAllActiveSigners()
• its approved targets are empty and permission start/end timestamps are zero
• the smart account balance remained 0
• the owner EOA nonce remained 37; gameplay and revocation did not consume normal EOA transactions
• the UI cleared the local Instant Play session and returned to MetaMask Standard Play
• Dungeon and VRF adapter pending state returned to zero after each tested action

Rollout and URL guardrails

• this PR remains disabled by default and does not change the public deployment selector
• no production environment variables, production deployment, contract deployment, or contract administration were changed
• the only chain writes were the explicitly listed controlled Shannon testnet QA operations
• ERC-4337 smart-account state is separate from the owner EOA game state
• the grant-linked RISE deployment and its published URLs must remain untouched
• https://delveworn.vercel.app/practice and https://delveworn.vercel.app/onchain are published compatibility URLs and must remain reachable
• the exact preview URL supplied to MetaMask Support must remain reachable and unchanged while the support case is open
• do not merge, promote, or replace URLs without a separate production go/no-go review

Open launch items

• MetaMask security/phishing warnings still appear during initial setup; the support ticket is pending
• sponsorship is currently restricted to Shannon, but production-grade spend and call-policy controls still need review
• the final stable URL/origin plan must preserve all grant and support links; session-key browser storage is origin-scoped

Dependency note

The clean npm 10 audit reports 35 transitive findings (29 moderate, 6 high), including findings in the current Thirdweb and existing wallet dependency trees. No forced audit rewrite or incompatible downgrade is included. Keep this PR in draft until the MetaMask warning, sponsorship controls, URL compatibility plan, and dependency posture are reviewed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
delveworn	Ready	Preview	Sep 1, 2026 4:24am UTC
delveworn-somnia	Ready	Preview	Sep 1, 2026 4:24am UTC