@nihilium/recovery-settlement-evm

The two EVM constructions as SettlementAdapters:

• Erc7579RecoveryModuleSettlement — the RecoveryModule executor on an ERC-7579 account (a Safe with Safe7579, a Kernel, a Nexus). One singleton per chain; registration is an install the account executes on itself, so registration is "owner-executes".
• Eip7702RecoveryAccountSettlement — Eip7702RecoveryAccount on a plain EOA. Registration is a one-time delegation plus a register signed by the owner and the incoming recovery key, so registration is "owner-and-recovery-key-sign" and the orchestrator mints the root, signs once and wipes it (RecoverySDK.addChainWithSigner).

What is injected and never bundled: the account. eoaExecutor wraps a viem wallet client; erc7579Executor wraps whatever smart-account client the wallet already holds through the two methods every one of them exposes. permissionless is not a dependency. viem is a peer dependency.

const settlement = new Erc7579RecoveryModuleSettlement({ chainId: 11155111, client, submitter, accountFlavour: "safe7579" });
await settlement.register({ account, owner: erc7579Executor({ address, client: safeClient, signDigest, namespace }), recoveryPubKey, veto, replacing });
const intent = await settlement.buildIntent({ account, newOwner, ttlSeconds: 3600 });
await settlement.initiate({ account, intent, authority });   // the recovered key signs; the submitter pays
await settlement.execute({ account, intent: intent.serialized });   // after the timelock: no signature

Every digest is read from the chain: the deployed version() is inside the EIP-712 domain, and a locally computed digest signs the wrong thing. submitter is evmDirectSubmitter on a server and core's HttpRelaySubmitter in a browser; prepareRelay on the server side rebuilds every transaction from the wire fields rather than trusting a client's. toRecoveredOwnerAccount builds the viem account that drives a recovered ERC-7579 account through the validator the recovery installed.

Depends on @nihilium/recovery-onchain-evm for the ABIs and address book; that package must publish before this one can.