feat: add feature-flagged Somnia session keys

[CryptoMickle]

Summary

• add opt-in Thirdweb ERC-4337 Instant Play for Somnia Shannon
• keep MetaMask Standard Play available as the fallback
• keep the grant-linked RISE deployment and all published URLs unchanged
• lazy-load the Thirdweb bundle and require both the explicit feature flag and public Thirdweb client ID
• extend CI across RISE, Somnia Standard Play, and Somnia Session Keys configurations

Session security

The temporary signer is accepted only when all onchain checks pass:

• the connected MetaMask owner is an administrator of the smart account
• the temporary signer is not an administrator
• the configured Delveworn dungeon is the single approved target
• native-token allowance is zero
• the permission is active and no longer than eight hours plus the 30-second clock-skew allowance
• stored owner, signer, smart-account, dungeon, and expiry values match the active deployment

The session is origin-scoped in browser storage, can be revoked from the UI, and gameplay transactions always target the configured dungeon with zero native value.

Verification

• ESLint: 0 errors (existing warnings only)
• TypeScript: passed
• production builds: RISE, Somnia Standard Play, and Somnia Session Keys passed
• GitHub CI matrix: passed
• both Vercel previews: Ready
• dependency gate: npm audit --omit=dev --audit-level=high passes with no high or critical findings; 26 moderate transitive findings remain in upstream wallet dependencies, with no forced downgrade applied

Controlled Shannon QA

Environment:

• chain ID 50312
• dungeon 0x07c5D071132ae95C3708031790b3feC740F4c292
• Thirdweb sponsorship restricted to Somnia Shannon Testnet

Verified lifecycle:

1. MetaMask deployed the ERC-4337 smart account and authorized the restricted eight-hour session.
2. startGame and native VRF fulfillment completed through the sponsored Session Keys path.
3. A gameplay attack completed without another MetaMask popup.
4. The owner revoked the session successfully.
5. The UI cleared the local session and returned to MetaMask Standard Play.
6. After the final security-hardening commit, a fresh create → Attack → revoke pass completed successfully on the isolated preview.

Production and URL guardrails

• the existing production and compatibility URLs remain unchanged
• https://delveworn.vercel.app/practice and https://delveworn.vercel.app/onchain remain reachable
• the production Somnia URL remains https://delveworn-somnia.vercel.app/onchain
• the exact preview URL supplied to MetaMask Support remains untouched while ticket #129330424 is open
• no contract deployment or contract administration is changed by this PR
• production activation still requires the existing public Thirdweb client ID and NEXT_PUBLIC_SOMNIA_SESSION_KEYS_ENABLED=true in the Somnia Vercel project

MetaMask status

The earlier false-positive “Malicious site” warning is no longer reproducible on the original production domain. The exact same transaction currently opens without a warning. MetaMask ticket #129330424 remains open to confirm whether the classification was cleared and whether Blockaid supports Somnia chain ID 50312. This external confirmation does not block the testnet-only rollout.

Go/no-go

Final automated checks, hardened wallet QA, URL review, and testnet sponsorship review passed on 2026-09-01. Production rollout to the existing Somnia testnet URL was explicitly approved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
delveworn	Ready	Preview	Sep 1, 2026 4:13pm UTC
delveworn-somnia	Ready	Preview	Sep 1, 2026 4:13pm UTC