┌──────────────────────────────────────────────────┐
│              Universal Profile (LSP0)             │
│  ERC725X (execute) + ERC725Y (data) + LSP1 +     │
│  LSP14 (ownership) + LSP17 (extensions) + LSP20  │
└───────────────────────┬──────────────────────────┘
                        │ owner
           ┌────────────▼────────────┐
           │    Key Manager (LSP6)    │
           │  Permissions stored in   │
           │  UP's ERC725Y storage    │
           └─────────────┬───────────┘
                         │
        ┌────────────────┼────────────────┐
   Controller A     Controller B     Controller C
   (CALL, SIGN)    (SETDATA)        (TRANSFERVALUE)

up key generate --save --password <your-password>

up profile configure 0xYourUPAddress --chain lukso

up status

{
  "version": "1.0.0",
  "network": "lukso-mainnet",
  "rpc": {
    "lukso-mainnet": "https://42.rpc.thirdweb.com",
    "lukso-testnet": "https://rpc.testnet.lukso.network"
  },
  "universalProfile": {
    "address": "0xYourUPAddress",
    "keyManager": "0xAutoDetectedKMAddress"
  },
  "controllerKey": {
    "address": "0xControllerAddress",
    "label": "default",
    "encrypted": true,
    "path": "/path/to/keystore.json"
  },
  "relay": {
    "enabled": true,
    "url": "https://relayer.lukso.network",
    "fallbackToDirect": true
  }
}

up key generate [--save] [--password <pw>]   # Generate a new controller keypair
up key list                                   # List stored keys

up status [--chain <chain>]                                            # Config, keys, connectivity
up profile info [<address>] [--chain <chain>]                          # Profile details
up profile configure <address> [--key-manager <km>] [--chain <chain>]  # Save UP for use

up permissions encode <perm1> [<perm2> ...]   # Encode to bytes32 hex
up permissions decode <hex>                    # Decode to permission names
up permissions presets                         # List presets with risk levels
up permissions validate <hex>                  # Security audit

up authorize url [--permissions <preset|hex>] [--chain <chain>]

up config show                # Full JSON config
up config set <key> <value>   # Set defaultChain, keystorePath, etc.
up help                       # All commands

Controller EOA → KeyManager.execute(payload) → UP.execute(...) → Target

import { ethers } from 'ethers';

const provider = new ethers.JsonRpcProvider('https://42.rpc.thirdweb.com');
const signer = new ethers.Wallet('0xCONTROLLER_PRIVATE_KEY', provider);

const UP_ABI = [
  'function execute(uint256 operationType, address target, uint256 value, bytes data) payable returns (bytes)',
  'function setData(bytes32 dataKey, bytes dataValue)',
];
const KM_ABI = ['function execute(bytes calldata payload) payable returns (bytes)'];

const up = new ethers.Contract('0xUPAddress', UP_ABI, signer);
const km = new ethers.Contract('0xKMAddress', KM_ABI, signer);

// Transfer LYX
const payload = up.interface.encodeFunctionData('execute', [
  0, '0xRecipient', ethers.parseEther('1.5'), '0x',
]);
await (await km.execute(payload)).wait();

// Transfer LSP7 Token
const tokenIface = new ethers.Interface([
  'function transfer(address from, address to, uint256 amount, bool force, bytes data)',
]);
const calldata = tokenIface.encodeFunctionData('transfer', [
  '0xUPAddress', '0xRecipient', ethers.parseEther('100'), false, '0x',
]);
const payload2 = up.interface.encodeFunctionData('execute', [0, '0xTokenContract', 0n, calldata]);
await (await km.execute(payload2)).wait();

import { createUniversalProfileSkill } from 'openclaw-universalprofile-skill';
const skill = createUniversalProfileSkill({ network: 'lukso-mainnet', privateKey: '0x...' });

await skill.execute({ operationType: 0, target: '0xRecipient', value: ethers.parseEther('1.5'), data: '0x' });
await skill.transferToken('0xTokenAddr', '0xRecipient', ethers.parseEther('100'));
await skill.transferNFT('0xCollectionAddr', '0xRecipient', '0xTokenId');

const nonce = await keyManager.getNonce(controllerAddress, 0);  // channel 0

function createValidityTimestamps(duration = 3600) {
  const now = Math.floor(Date.now() / 1000);
  return (BigInt(now) << 128n) | BigInt(now + duration);
}

const encoded = ethers.solidityPacked(
  ['uint256', 'uint256', 'uint256', 'uint256', 'uint256', 'bytes'],
  [25, chainId, nonce, validityTimestamps, msgValue, abiPayload]
  // 25 = LSP25_VERSION (always 25)
);
const hash = ethers.keccak256(encoded);
const signature = await signer.signMessage(ethers.getBytes(hash));

import { ethers } from 'ethers';
const provider = new ethers.JsonRpcProvider('https://42.rpc.thirdweb.com');
const controller = new ethers.Wallet('0xCONTROLLER_KEY');

const upIface = new ethers.Interface([
  'function execute(uint256, address, uint256, bytes) payable returns (bytes)',
]);
const km = new ethers.Contract('0xKMAddress', [
  'function executeRelayCall(bytes, uint256, uint256, bytes) payable returns (bytes)',
  'function getNonce(address, uint128) view returns (uint256)',
], provider);

// 1. Encode payload
const payload = upIface.encodeFunctionData('execute', [
  0, '0xRecipient', ethers.parseEther('3'), '0x',
]);

// 2. Get nonce
const nonce = await km.getNonce(controller.address, 0);
const { chainId } = await provider.getNetwork();

// 3. Sign (LSP25)
const encoded = ethers.solidityPacked(
  ['uint256', 'uint256', 'uint256', 'uint256', 'uint256', 'bytes'],
  [25, chainId, nonce, 0n, 0n, payload]
);
const signature = await controller.signMessage(
  ethers.getBytes(ethers.keccak256(encoded))
);

// 4a. Send to relay service
await fetch('https://relayer.lukso.network/execute', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    keyManagerAddress: '0xKMAddress', signature,
    nonce: nonce.toString(), validityTimestamps: '0', payload, value: '0',
  }),
});

// 4b. Or execute on-chain (funded account pays gas)
const relayer = new ethers.Wallet('0xRELAYER_KEY', provider);
await (await km.connect(relayer).executeRelayCall(signature, nonce, 0n, payload)).wait();

import { executeViaRelay, setDataViaRelay, checkRelayQuota } from 'openclaw-universalprofile-skill';

// High-level: handles nonce, signing, execution automatically
const result = await executeViaRelay(signer, upAddr, kmAddr,
  { operationType: 0, target: '0xRecipient', value: ethers.parseEther('1'), data: '0x' },
  { relayerUrl: 'https://relayer.lukso.network', validityDuration: 3600 }
);
console.log('TX:', result.transactionHash);

// Set data via relay
await setDataViaRelay(signer, upAddr, kmAddr, dataKey, dataValue, { relayerUrl: '...' });

// Check quota
const quota = await checkRelayQuota('https://relayer.lukso.network', upAddr);

const LSP0_ABI = [
  'function execute(uint256 operationType, address target, uint256 value, bytes data) payable returns (bytes)',
  'function executeBatch(uint256[] operationTypes, address[] targets, uint256[] values, bytes[] datas) payable returns (bytes[])',
  'function getData(bytes32 dataKey) view returns (bytes)',
  'function getDataBatch(bytes32[] dataKeys) view returns (bytes[])',
  'function setData(bytes32 dataKey, bytes dataValue)',
  'function setDataBatch(bytes32[] dataKeys, bytes[] dataValues)',
  'function universalReceiver(bytes32 typeId, bytes data) payable returns (bytes)',
  'function owner() view returns (address)',
  'function transferOwnership(address newOwner)',
  'function acceptOwnership()',
  'function supportsInterface(bytes4 interfaceId) view returns (bool)',
  'function isValidSignature(bytes32 hash, bytes signature) view returns (bytes4)',
];

const LSP6_ABI = [
  'function execute(bytes calldata payload) payable returns (bytes)',
  'function executeBatch(uint256[] values, bytes[] payloads) payable returns (bytes[])',
  'function executeRelayCall(bytes signature, uint256 nonce, uint256 validityTimestamps, bytes payload) payable returns (bytes)',
  'function executeRelayCallBatch(bytes[] signatures, uint256[] nonces, uint256[] validityTimestamps, uint256[] values, bytes[] payloads) payable returns (bytes[])',
  'function getNonce(address from, uint128 channelId) view returns (uint256)',
  'function target() view returns (address)',
  'function isValidSignature(bytes32 dataHash, bytes signature) view returns (bytes4)',
];

const LSP7_ABI = [
  'function name() view returns (string)',
  'function symbol() view returns (string)',
  'function decimals() view returns (uint8)',
  'function totalSupply() view returns (uint256)',
  'function balanceOf(address tokenOwner) view returns (uint256)',
  'function transfer(address from, address to, uint256 amount, bool force, bytes data)',
  'function transferBatch(address[] from, address[] to, uint256[] amounts, bool[] force, bytes[] data)',
  'function authorizeOperator(address operator, uint256 amount, bytes operatorNotificationData)',
  'function revokeOperator(address operator, address tokenOwner, bool notify, bytes operatorNotificationData)',
  'function authorizedAmountFor(address operator, address tokenOwner) view returns (uint256)',
  'function getOperatorsOf(address tokenOwner) view returns (address[])',
  'function owner() view returns (address)',
  'function supportsInterface(bytes4 interfaceId) view returns (bool)',
];

const LSP8_ABI = [
  'function name() view returns (string)',
  'function symbol() view returns (string)',
  'function totalSupply() view returns (uint256)',
  'function balanceOf(address tokenOwner) view returns (uint256)',
  'function tokenOwnerOf(bytes32 tokenId) view returns (address)',
  'function tokenIdsOf(address tokenOwner) view returns (bytes32[])',
  'function transfer(address from, address to, bytes32 tokenId, bool force, bytes data)',
  'function authorizeOperator(address operator, bytes32 tokenId, bytes operatorNotificationData)',
  'function revokeOperator(address operator, bytes32 tokenId, bool notify, bytes operatorNotificationData)',
  'function isOperatorFor(address operator, bytes32 tokenId) view returns (bool)',
  'function getDataForTokenId(bytes32 tokenId, bytes32 dataKey) view returns (bytes)',
  'function owner() view returns (address)',
  'function supportsInterface(bytes4 interfaceId) view returns (bool)',
];

const INTERFACE_IDS = {
  ERC165: '0x01ffc9a7',       ERC725X: '0x7545acac',       ERC725Y: '0x629aa694',
  ERC1271: '0x1626ba7e',      LSP0: '0x24871b3d',          LSP1: '0x6bb56a14',
  LSP1Delegate: '0xa245bbda', LSP6: '0x23f34c62',          LSP7: '0xc52d6008',
  LSP8: '0x3a271706',         LSP9: '0x28af17e6',          LSP14: '0x94be5999',
  LSP17Extendable: '0xa918fa6b', LSP17Extension: '0xcee78b40',
  LSP25: '0x5ac79908',        LSP26: '0x2b299cea',
};

// CALL + TRANSFERVALUE + SIGN = 0x200a00
const perm = BigInt(0x800) | BigInt(0x200) | BigInt(0x200000);
const hex = '0x' + perm.toString(16).padStart(64, '0');

<callTypes(4)><address(20)><interfaceId(4)><functionSelector(4)>

function getArrayElementKey(baseKey, index) {
  const prefix = baseKey.slice(0, 34); // 0x + 32 hex chars = 16 bytes
  return prefix + index.toString(16).padStart(32, '0');
}

npm install @lukso/lsp-smart-contracts  # All LSP contract artifacts
npm install @erc725/erc725.js           # ERC725Y data encoding/decoding
npm install ethers                       # Ethereum library (v6)

import ERC725 from '@erc725/erc725.js';
import LSP3Schema from '@erc725/erc725.js/schemas/LSP3ProfileMetadata.json';

const erc725 = new ERC725(LSP3Schema, '0xUPAddress', 'https://42.rpc.thirdweb.com', {
  ipfsGateway: 'https://api.universalprofile.cloud/ipfs',
});

// Fetch profile (resolves IPFS automatically)
const profile = await erc725.fetchData('LSP3Profile');
console.log(profile.value); // { LSP3Profile: { name: '...', ... } }

// Available schemas: LSP3, LSP4, LSP5, LSP6, LSP8, LSP9, LSP10, LSP12

const up = new ethers.Contract(address, ['function supportsInterface(bytes4) view returns (bool)'], provider);
const isUP = await up.supportsInterface('0x24871b3d');  // LSP0
const isLSP7 = await up.supportsInterface('0xc52d6008'); // LSP7
const isLSP8 = await up.supportsInterface('0x3a271706'); // LSP8