@agenticprimitives/agent-account 1.0.0-alpha.4 → 1.0.0-alpha.40

package/README.md

@@ -1,15 +1,14 @@
 # @agenticprimitives/agent-account
 
-ERC-4337 Smart Agent substrate — **canonical identity owner**.
+> Part of **[Agentic Primitives](https://agenticprimitives.dev)** — the open-source trust substrate for agentic applications: identity that can sign, authority checked at act time, evidence the owner carries. [Developer kit](https://github.com/agentictrustlabs/agentic-primitives) · [All packages](https://agenticprimitives.dev/developers)
 
-Every person, org, service, or treasury agent is anchored by its Smart Agent
-address (`0x…` / CAIP-10 `eip155:<chainId>:<address>`). This package deploys
-that account, derives its address, builds UserOps, and verifies ERC-1271
-signatures. Names, profiles, and passkeys are **facets** handled by sibling
-packages.
+**The address IS the identity.**
 
-> **Layer:** Core — the canonical identity **anchor**.
-> **Canonical key:** Smart Agent address (CAIP-10 `eip155:<chainId>:<address>`). Names / profiles / edges point AT it; they never *are* the identity.
+Every person, organization, service agent, and treasury in this stack is an ERC-4337 Smart Agent address (`0x…` / CAIP-10 `eip155:<chainId>:<address>`). Not a username with a wallet attached — the address itself is the canonical identity, and everything else (names, passkeys, profiles, registry entries) is a replaceable facet pointing at it. This package is where that anchor comes from: it derives the address counterfactually, deploys the account, builds UserOperations, and verifies ERC-1271 signatures.
+
+That design choice has a consequence most smart-account SDKs cannot offer: the CREATE2 salt derives from auth methods and user scope — never from a name, never from credential material ([ADR-0010](../../docs/architecture/decisions/0010-smart-agent-canonical-identifier.md), [spec 220](../../specs/220-agent-identity-bootstrap.md)). Lose a passkey, rotate a signer, change your name — the address never moves, and every delegation it ever issued stays valid ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)).
+
+> Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
 
 ## Use This When
 
@@ -60,6 +59,8 @@ if (!(await account.isDeployed(address))) {
 }
 ```
 
+The address exists before the account does. You can name it, fund it, and issue authority to it counterfactually; deployment happens when it first acts.
+
 ## Main Concepts
 
 - **Smart Agent address**: the canonical identifier; stable across credential
@@ -87,6 +88,10 @@ import { encodeWebAuthnSignature, SIG_TYPE_WEBAUTHN } from '@agenticprimitives/a
 // WebAuthn ceremony output is produced by connect-auth; on-chain wire format here.
 ```
 
+## How it's different
+
+Safe, ZeroDev, and Alchemy Account Kit ship excellent smart accounts — and stop there. The account is a container; who it is, what it may do, and how to prove it are someone else's integration problem. Here the account is the anchor of a substrate: the same address that `agent-account` derives is what `agent-naming` resolves, `account-custody` governs, `delegation` issues authority from, and `audit` attributes evidence to. The account contract itself is a thin ERC-7579 modular core ([spec 209](../../specs/209-erc7579-module-taxonomy.md)) — custody, threshold, and session machinery are modules, not inlined features. We ported the patterns worth porting (Safe-style signature packing) without taking a runtime dependency on anyone else's account stack.
+
 ## Runtime Support
 
 Node and browser via `viem`. Requires RPC URL for chain reads and transaction
@@ -117,6 +122,10 @@ pnpm check:agent-account
 pnpm check:forbidden-terms
 ```
 
+## Status
+
+Testnet/pilot-ready. Production launch is gated on the public checklist in the root README — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).
+
 ## License
 
 UNLICENSED.

package/dist/abis.d.ts

@@ -23,6 +23,9 @@ export declare const agentAccountFactoryAbi: readonly [{
         }, {
             readonly name: "initialPasskeyY";
             readonly type: "uint256";
+        }, {
+            readonly name: "initialPasskeyRpIdHash";
+            readonly type: "bytes32";
         }];
     }, {
         readonly name: "timelockOverrides";
@@ -60,7 +63,13 @@ export declare const agentAccountFactoryAbi: readonly [{
         }, {
             readonly name: "initialPasskeyY";
             readonly type: "uint256";
+        }, {
+            readonly name: "initialPasskeyRpIdHash";
+            readonly type: "bytes32";
         }];
+    }, {
+        readonly name: "timelockOverrides";
+        readonly type: "uint32[7]";
     }, {
         readonly name: "salt";
         readonly type: "uint256";
@@ -193,6 +202,85 @@ export declare const agentAccountAbi: readonly [{
     readonly outputs: readonly [{
         readonly type: "uint256";
     }];
+}, {
+    readonly type: "function";
+    readonly name: "custodyEpoch";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly type: "uint64";
+    }];
+}, {
+    readonly type: "function";
+    readonly name: "approvedHashKey";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly name: "hash";
+        readonly type: "bytes32";
+    }];
+    readonly outputs: readonly [{
+        readonly type: "bytes32";
+    }];
+}, {
+    readonly type: "event";
+    readonly name: "CustodyEpochBumped";
+    readonly inputs: readonly [{
+        readonly name: "epoch";
+        readonly type: "uint64";
+        readonly indexed: false;
+    }];
+}, {
+    readonly type: "function";
+    readonly name: "approveDigest";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "digest";
+        readonly type: "bytes32";
+    }];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "function";
+    readonly name: "revokeDigest";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "digest";
+        readonly type: "bytes32";
+    }];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "function";
+    readonly name: "revokeAllApprovedDigests";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "event";
+    readonly name: "DigestApproved";
+    readonly inputs: readonly [{
+        readonly name: "digest";
+        readonly type: "bytes32";
+        readonly indexed: true;
+    }, {
+        readonly name: "epoch";
+        readonly type: "uint64";
+        readonly indexed: false;
+    }];
+}, {
+    readonly type: "event";
+    readonly name: "DigestRevoked";
+    readonly inputs: readonly [{
+        readonly name: "digest";
+        readonly type: "bytes32";
+        readonly indexed: true;
+    }, {
+        readonly name: "epoch";
+        readonly type: "uint64";
+        readonly indexed: false;
+    }];
+}, {
+    readonly type: "event";
+    readonly name: "AllDigestsRevoked";
+    readonly inputs: readonly [];
 }, {
     readonly type: "function";
     readonly name: "factory";
@@ -212,7 +300,7 @@ export declare const agentAccountAbi: readonly [{
 }, {
     readonly type: "function";
     readonly name: "passkeyIdentity";
-    readonly stateMutability: "pure";
+    readonly stateMutability: "view";
     readonly inputs: readonly [{
         readonly name: "x";
         readonly type: "uint256";
@@ -270,6 +358,9 @@ export declare const agentAccountAbi: readonly [{
     }, {
         readonly name: "y";
         readonly type: "uint256";
+    }, {
+        readonly name: "rpIdHash";
+        readonly type: "bytes32";
     }];
     readonly outputs: readonly [];
 }, {
@@ -356,14 +447,6 @@ export declare const agentAccountAbi: readonly [{
         readonly name: "credentialIdDigest";
         readonly type: "bytes32";
         readonly indexed: true;
-    }, {
-        readonly name: "x";
-        readonly type: "uint256";
-        readonly indexed: false;
-    }, {
-        readonly name: "y";
-        readonly type: "uint256";
-        readonly indexed: false;
     }];
 }, {
     readonly type: "event";
@@ -381,6 +464,10 @@ export declare const agentAccountAbi: readonly [{
  * ECDSA sig. `QuorumEnforcer.beforeHook` (and the
  * `_verifyQuorum(..., guardianMode=true)` path in AgentAccount) check
  * `isApproved(signer, hash)` for v=1 slots in the packed blob.
+ *
+ * R917-C-2 (spec 408 §1.2): an AgentAccount's `0x03` ERC-1271 sentinel consults
+ * `isApproved(account, approvedHashKey(hash))` — the EPOCH-BOUND key, never the raw
+ * hash. Approve with `approvedHashKey(hash, epoch)` from `./approved-hash.js`.
  */
 export declare const approvedHashRegistryAbi: readonly [{
     readonly type: "function";
@@ -414,9 +501,26 @@ export declare const approvedHashRegistryAbi: readonly [{
     readonly outputs: readonly [{
         readonly type: "bool";
     }];
+}, {
+    readonly type: "function";
+    readonly name: "revokeAll";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [];
+}, {
+    readonly type: "function";
+    readonly name: "epochOf";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly name: "signer";
+        readonly type: "address";
+    }];
+    readonly outputs: readonly [{
+        readonly type: "uint64";
+    }];
 }];
 /** ERC-1271 magic value returned by isValidSignature on success. */
-export declare const ERC1271_MAGIC_VALUE: "0x1626ba7e";
+export { ERC1271_MAGIC_VALUE } from '@agenticprimitives/types';
 /**
  * Minimal EntryPoint ABI for our bundler client + UserOp hashing.
  * Source: account-abstraction/contracts/core/EntryPoint.sol (v0.9).

package/dist/abis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abis.d.ts","sourceRoot":"","sources":["../src/abis.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyEzB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDlB,CAAC;AAKX;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB1B,CAAC;AAEX,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,EAAG,YAAqB,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8EhB,CAAC"}
+{"version":3,"file":"abis.d.ts","sourceRoot":"","sources":["../src/abis.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6EzB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DlB,CAAC;AAKX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4B1B,CAAC;AAEX,oEAAoE;AAIpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8EhB,CAAC"}

package/dist/abis.js

@@ -14,6 +14,11 @@ const initParamsTuple = {
         { name: 'initialPasskeyCredentialIdDigest', type: 'bytes32' },
         { name: 'initialPasskeyX', type: 'uint256' },
         { name: 'initialPasskeyY', type: 'uint256' },
+        // H7-C.1 / CON-WEBAUTHN-001: rpIdHash binds the passkey to a specific
+        // Relying Party at registration. Required by the on-chain struct
+        // since the binding was added; the TS ABI mirror was previously
+        // out-of-sync, causing factory reverts with a 6-field tuple.
+        { name: 'initialPasskeyRpIdHash', type: 'bytes32' },
     ],
 };
 export const agentAccountFactoryAbi = [
@@ -35,6 +40,10 @@ export const agentAccountFactoryAbi = [
         stateMutability: 'view',
         inputs: [
             initParamsTuple,
+            // CA-F1 (audit 2026-06-10): the counterfactual address commits to the full
+            // custody config, so the view takes timelockOverrides too. Predict with the
+            // SAME (params, timelockOverrides, salt) you will deploy with.
+            { name: 'timelockOverrides', type: 'uint32[7]' },
             { name: 'salt', type: 'uint256' },
         ],
         outputs: [{ name: '', type: 'address' }],
@@ -115,14 +124,27 @@ export const agentAccountAbi = [
     },
     { type: 'function', name: 'isCustodian', stateMutability: 'view', inputs: [{ name: 'account', type: 'address' }], outputs: [{ type: 'bool' }] },
     { type: 'function', name: 'custodianCount', stateMutability: 'view', inputs: [], outputs: [{ type: 'uint256' }] },
+    // R917-C-2 (spec 408 §1.2) — the custody epoch and the epoch-bound key the 0x03 sentinel consults.
+    { type: 'function', name: 'custodyEpoch', stateMutability: 'view', inputs: [], outputs: [{ type: 'uint64' }] },
+    { type: 'function', name: 'approvedHashKey', stateMutability: 'view', inputs: [{ name: 'hash', type: 'bytes32' }], outputs: [{ type: 'bytes32' }] },
+    { type: 'event', name: 'CustodyEpochBumped', inputs: [{ name: 'epoch', type: 'uint64', indexed: false }] },
+    // Spec 410 §1 (generation 3, THESIS-1a) — the account derives the approved-hash key itself; the registry is
+    // never an execute target. `approveDigest` / `revokeDigest` are onlySelf; `revokeAllApprovedDigests` is
+    // custody-gated on a governed account and the last step of every recovery path.
+    { type: 'function', name: 'approveDigest', stateMutability: 'nonpayable', inputs: [{ name: 'digest', type: 'bytes32' }], outputs: [] },
+    { type: 'function', name: 'revokeDigest', stateMutability: 'nonpayable', inputs: [{ name: 'digest', type: 'bytes32' }], outputs: [] },
+    { type: 'function', name: 'revokeAllApprovedDigests', stateMutability: 'nonpayable', inputs: [], outputs: [] },
+    { type: 'event', name: 'DigestApproved', inputs: [{ name: 'digest', type: 'bytes32', indexed: true }, { name: 'epoch', type: 'uint64', indexed: false }] },
+    { type: 'event', name: 'DigestRevoked', inputs: [{ name: 'digest', type: 'bytes32', indexed: true }, { name: 'epoch', type: 'uint64', indexed: false }] },
+    { type: 'event', name: 'AllDigestsRevoked', inputs: [] },
     { type: 'function', name: 'factory', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
     { type: 'function', name: 'delegationManager', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
     // Phase 6f.4 — passkey-direct custody surface.
-    { type: 'function', name: 'passkeyIdentity', stateMutability: 'pure', inputs: [{ name: 'x', type: 'uint256' }, { name: 'y', type: 'uint256' }], outputs: [{ type: 'address' }] },
+    { type: 'function', name: 'passkeyIdentity', stateMutability: 'view', inputs: [{ name: 'x', type: 'uint256' }, { name: 'y', type: 'uint256' }], outputs: [{ type: 'address' }] },
     { type: 'function', name: 'hasPasskey', stateMutability: 'view', inputs: [{ name: 'credentialIdDigest', type: 'bytes32' }], outputs: [{ type: 'bool' }] },
     { type: 'function', name: 'getPasskey', stateMutability: 'view', inputs: [{ name: 'credentialIdDigest', type: 'bytes32' }], outputs: [{ name: 'x', type: 'uint256' }, { name: 'y', type: 'uint256' }] },
     { type: 'function', name: 'passkeyCount', stateMutability: 'view', inputs: [], outputs: [{ type: 'uint256' }] },
-    { type: 'function', name: 'addPasskey', stateMutability: 'nonpayable', inputs: [{ name: 'credentialIdDigest', type: 'bytes32' }, { name: 'x', type: 'uint256' }, { name: 'y', type: 'uint256' }], outputs: [] },
+    { type: 'function', name: 'addPasskey', stateMutability: 'nonpayable', inputs: [{ name: 'credentialIdDigest', type: 'bytes32' }, { name: 'x', type: 'uint256' }, { name: 'y', type: 'uint256' }, { name: 'rpIdHash', type: 'bytes32' }], outputs: [] },
     { type: 'function', name: 'removePasskey', stateMutability: 'nonpayable', inputs: [{ name: 'credentialIdDigest', type: 'bytes32' }], outputs: [] },
     { type: 'function', name: 'addCustodian', stateMutability: 'nonpayable', inputs: [{ name: 'owner', type: 'address' }], outputs: [] },
     { type: 'function', name: 'removeCustodian', stateMutability: 'nonpayable', inputs: [{ name: 'owner', type: 'address' }], outputs: [] },
@@ -134,7 +156,8 @@ export const agentAccountAbi = [
     // Events.
     { type: 'event', name: 'CustodianAdded', inputs: [{ name: 'owner', type: 'address', indexed: true }] },
     { type: 'event', name: 'CustodianRemoved', inputs: [{ name: 'owner', type: 'address', indexed: true }] },
-    { type: 'event', name: 'PasskeyAdded', inputs: [{ name: 'credentialIdDigest', type: 'bytes32', indexed: true }, { name: 'x', type: 'uint256', indexed: false }, { name: 'y', type: 'uint256', indexed: false }] },
+    // Spec 302 W1 — the event carries ONLY the digest (raw pubkey coords removed: cross-account correlator).
+    { type: 'event', name: 'PasskeyAdded', inputs: [{ name: 'credentialIdDigest', type: 'bytes32', indexed: true }] },
     { type: 'event', name: 'PasskeyRemoved', inputs: [{ name: 'credentialIdDigest', type: 'bytes32', indexed: true }] },
 ];
 // custodyPolicyAbi was relocated to `@agenticprimitives/account-custody` per
@@ -146,6 +169,10 @@ export const agentAccountAbi = [
  * ECDSA sig. `QuorumEnforcer.beforeHook` (and the
  * `_verifyQuorum(..., guardianMode=true)` path in AgentAccount) check
  * `isApproved(signer, hash)` for v=1 slots in the packed blob.
+ *
+ * R917-C-2 (spec 408 §1.2): an AgentAccount's `0x03` ERC-1271 sentinel consults
+ * `isApproved(account, approvedHashKey(hash))` — the EPOCH-BOUND key, never the raw
+ * hash. Approve with `approvedHashKey(hash, epoch)` from `./approved-hash.js`.
  */
 export const approvedHashRegistryAbi = [
     {
@@ -172,9 +199,15 @@ export const approvedHashRegistryAbi = [
         ],
         outputs: [{ type: 'bool' }],
     },
+    // R917-C-2 — void every approval the signer ever made, in one call; `epochOf` is informational.
+    { type: 'function', name: 'revokeAll', stateMutability: 'nonpayable', inputs: [], outputs: [] },
+    { type: 'function', name: 'epochOf', stateMutability: 'view', inputs: [{ name: 'signer', type: 'address' }], outputs: [{ type: 'uint64' }] },
 ];
 /** ERC-1271 magic value returned by isValidSignature on success. */
-export const ERC1271_MAGIC_VALUE = '0x1626ba7e';
+// The protocol constant lives in `types` — the one package everything may import, including
+// `connect-auth`, which cannot reach here without creating a cycle. Re-exported so existing
+// consumers of `agent-account` are unaffected.
+export { ERC1271_MAGIC_VALUE } from '@agenticprimitives/types';
 /**
  * Minimal EntryPoint ABI for our bundler client + UserOp hashing.
  * Source: account-abstraction/contracts/core/EntryPoint.sol (v0.9).

package/dist/abis.js.map

@@ -1 +1 @@
-{"version":3,"file":"abis.js","sourceRoot":"","sources":["../src/abis.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,0CAA0C;AAE1C,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,OAAO;IACb,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;QAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE;QACzC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;QACvC,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7D,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;KAC7C;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yEAAyE;IACzE;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN,eAAe;YACf,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAChD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,2BAA2B;QACjC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,eAAe;YACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IAED,wEAAwE;IACxE;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,uBAAuB;QAC7B,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IAED,wEAAwE;IACxE;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;YACnD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC/C,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAChE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;YACrD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAClD;KACF;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,8BAA8B;QACpC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/I,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACjH,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAC1G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACpH,+CAA+C;IAC/C,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAChL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACzJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACvM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAC/G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/M,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IAClJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACpI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACvI,gFAAgF;IAChF,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACrM,iEAAiE;IACjE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iCAAiC,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/H,UAAU;IACV,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACtG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACxG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;IACjN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;CAC3G,CAAC;AAEX,6EAA6E;AAC7E,gEAAgE;AAEhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,aAAa;QACnB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;CACO,CAAC;AAEX,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAqB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7C,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7C,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;YACD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;SACzC;QACD,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE;SACjC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,iEAAiE;IACjE,sEAAsE;IACtE,yDAAyD;IACzD;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;YACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;YACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SACjC;KACF;CACO,CAAC"}
+{"version":3,"file":"abis.js","sourceRoot":"","sources":["../src/abis.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,0CAA0C;AAE1C,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,OAAO;IACb,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;QAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE;QACzC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;QACvC,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7D,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,sEAAsE;QACtE,iEAAiE;QACjE,gEAAgE;QAChE,6DAA6D;QAC7D,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE;KACpD;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yEAAyE;IACzE;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,oBAAoB;QAC1B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN,eAAe;YACf,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAChD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,2BAA2B;QACjC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,eAAe;YACf,2EAA2E;YAC3E,4EAA4E;YAC5E,+DAA+D;YAC/D,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;YAChD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IAED,wEAAwE;IACxE;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,uBAAuB;QAC7B,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IAED,wEAAwE;IACxE;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;YACnD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC/C,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAChE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;YACrD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAClD;KACF;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,8BAA8B;QACpC,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/I,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACjH,mGAAmG;IACnG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;IAC9G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACnJ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;IAC1G,4GAA4G;IAC5G,wGAAwG;IACxG,gFAAgF;IAChF,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACtI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACrI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC9G,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;IAC1J,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;IACzJ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE;IACxD,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAC1G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACpH,+CAA+C;IAC/C,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAChL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACzJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IACvM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;IAC/G,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACtP,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IAClJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACpI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACvI,gFAAgF;IAChF,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACrM,iEAAiE;IACjE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iCAAiC,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/H,UAAU;IACV,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACtG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACxG,yGAAyG;IACzG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACjH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;CAC3G,CAAC;AAEX,6EAA6E;AAC7E,gEAAgE;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,aAAa;QACnB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAClC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;IACD,gGAAgG;IAChG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/F,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;CACpI,CAAC;AAEX,oEAAoE;AACpE,4FAA4F;AAC5F,4FAA4F;AAC5F,+CAA+C;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7C,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;oBACnC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7C,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;YACD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;SACzC;QACD,OAAO,EAAE,EAAE;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE;SACjC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,iEAAiE;IACjE,sEAAsE;IACtE,yDAAyD;IACzD;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;YACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;YACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SACjC;KACF;CACO,CAAC"}

package/dist/approved-hash.d.ts

@@ -0,0 +1,108 @@
+import { type Address, type Hex } from 'viem';
+import { agentAccountAbi } from './abis.js';
+import type { ContractCall } from './execute.js';
+/** Which contracts an estate runs: 1 = pre-spec-408 (raw approved hashes, 32-byte digest-binding args,
+ *  `anchorOf(digest)`); 2 = spec 408 (epoch-bound keys, per-step nonces, `anchorOf(agent, digest)`);
+ *  3 = spec 410 (`approveDigest` on the account, the registry never an execute target, `RotateCredential`,
+ *  `revokeAll` at the end of every recovery path). */
+export type ContractsGeneration = 1 | 2 | 3;
+/** The generation a deployments JSON records; absent ⇒ 1 (the field arrived with spec 408). Anything else throws. */
+export declare function contractsGenerationOf(deployments: {
+    contractsGeneration?: unknown;
+} | null | undefined): ContractsGeneration;
+/** How an approval is keyed on this estate: generation 1 approves the raw digest; generation 2 the epoch-bound
+ *  key, computed here; generation 3 approves the DIGEST through the account, which derives the key itself —
+ *  the scheme names the account because the approval is a self-call on it. */
+export type ApprovalScheme = {
+    generation: 1;
+} | {
+    generation: 2;
+    epoch: bigint | number;
+} | {
+    generation: 3;
+    account: Address;
+};
+/** The 32 bytes the account approves for `digest` under `scheme`. On generation 3 there is nothing for a caller
+ *  to compute — the account derives the key on chain — so this throws rather than guess an epoch (ADR-0013). */
+export declare function approvalKey(digest: Hex, scheme: ApprovalScheme): Hex;
+/** The scheme for `account` on an estate of `generation`: generation 1 needs no read; generation 2 reads the
+ *  account's custody epoch (0 for an address with no code); generation 3 needs no read either — the account
+ *  will derive the key under whatever epoch it is in when the call lands. */
+export declare function readApprovalScheme(client: {
+    getCode(args: {
+        address: Address;
+    }): Promise<Hex | undefined>;
+    readContract(args: {
+        address: Address;
+        abi: typeof agentAccountAbi;
+        functionName: 'custodyEpoch';
+    }): Promise<bigint>;
+}, account: Address, generation: ContractsGeneration): Promise<ApprovalScheme>;
+/** The 32 bytes an account must approve for `digest` to validate through its `0x03` sentinel at `epoch`. */
+export declare function approvedHashKey(digest: Hex, epoch: bigint | number): Hex;
+/** The one read: a deployed account answers `custodyEpoch()`; an address with no code is at epoch 0. */
+export declare function readCustodyEpoch(client: {
+    getCode(args: {
+        address: Address;
+    }): Promise<Hex | undefined>;
+    readContract(args: {
+        address: Address;
+        abi: typeof agentAccountAbi;
+        functionName: 'custodyEpoch';
+    }): Promise<bigint>;
+}, account: Address): Promise<bigint>;
+/** `ApprovedHashRegistry.approveHash(approvalKey(digest, scheme))` as a `ContractCall` for the account's own
+ *  execute/executeBatch. The scheme is REQUIRED so a caller states which estate generation and (on generation 2)
+ *  which custody set it is approving under — `{ generation: 2, epoch: 0n }` for a counterfactual account being
+ *  deployed in the same batch. */
+export declare function buildApproveHashCall(registry: Address, digest: Hex, scheme: ApprovalScheme): ContractCall;
+/** `ApprovedHashRegistry.revokeAll()` as a `ContractCall`: void every approval the account ever made.
+ *  Generations 1 and 2 only — on generation 3 the registry is not an execute target; use
+ *  `buildRevokeAllApprovedDigestsCall(account)`. */
+export declare function buildRevokeAllApprovedHashesCall(registry: Address): ContractCall;
+/** Spec 410 §1 (generation 3) — `AgentAccount.revokeAllApprovedDigests()` as a self-call: void every approval
+ *  the account ever made, under any epoch, including one planted for a future epoch. The last step of a
+ *  mode-0 self-recovery batch; `CustodyPolicy` does the same for every governed recovery. */
+export declare function buildRevokeAllApprovedDigestsCall(account: Address): ContractCall;
+/** A credential to register or retire. */
+export type CredentialRef = {
+    kind: 'custodian';
+    address: Address;
+} | {
+    kind: 'passkey';
+    credentialIdDigest: Hex;
+    x: bigint;
+    y: bigint;
+    rpIdHash: Hex;
+};
+/** Spec 410 §1.2 — the mode-0 ROTATION batch: `add → retire → approveDigest × N`. Order is the builder's, not
+ *  the caller's: the account is never credential-less, and every re-approval lands after the retirement so
+ *  the account derives each key under the NEW epoch. Generation 3 only — an older estate has no
+ *  `approveDigest`, and pretending with a computed future-epoch key is the exact hole this closes. */
+export declare function buildRotationBatch(args: {
+    scheme: ApprovalScheme;
+    add: CredentialRef;
+    retire: {
+        kind: 'custodian';
+        address: Address;
+    } | {
+        kind: 'passkey';
+        credentialIdDigest: Hex;
+    };
+    /** Every standing approved-digest wire the account issued — the reviewed list. */
+    reapprove: readonly Hex[];
+}): ContractCall[];
+/** Spec 410 §1.2 — the mode-0 SELF-RECOVERY batch: `add → retire → revokeAllApprovedDigests`. It carries no
+ *  re-approval list — the type has no field for one. Generation 3 only. */
+export declare function buildSelfRecoveryBatch(args: {
+    scheme: ApprovalScheme;
+    add: CredentialRef;
+    retire: {
+        kind: 'custodian';
+        address: Address;
+    } | {
+        kind: 'passkey';
+        credentialIdDigest: Hex;
+    };
+}): ContractCall[];
+//# sourceMappingURL=approved-hash.d.ts.map

package/dist/approved-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved-hash.d.ts","sourceRoot":"","sources":["../src/approved-hash.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAsD,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAClG,OAAO,EAAE,eAAe,EAA2B,MAAM,WAAW,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;sDAGsD;AACtD,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE5C,qHAAqH;AACrH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,CAM5H;AAED;;8EAE8E;AAC9E,MAAM,MAAM,cAAc,GACtB;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,GACjB;IAAE,UAAU,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACzC;IAAE,UAAU,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAExC;gHACgH;AAChH,wBAAgB,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,GAAG,CAKpE;AAED;;6EAE6E;AAC7E,wBAAsB,kBAAkB,CACtC,MAAM,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,eAAe,CAAC;QAAC,YAAY,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,EAC/L,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAIzB;AAED,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAKxE;AAED,wGAAwG;AACxG,wBAAsB,gBAAgB,CACpC,MAAM,EAAE;IAAE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,eAAe,CAAC;QAAC,YAAY,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,EAC/L,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;kCAGkC;AAClC,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,YAAY,CAYzG;AAED;;oDAEoD;AACpD,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,OAAO,GAAG,YAAY,CAEhF;AAED;;6FAE6F;AAC7F,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAEhF;AAaD,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,GAAG,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAA;CAAE,CAAC;AActF;;;sGAGsG;AACtG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,cAAc,CAAC;IACvB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,kBAAkB,EAAE,GAAG,CAAA;KAAE,CAAC;IAC/F,kFAAkF;IAClF,SAAS,EAAE,SAAS,GAAG,EAAE,CAAC;CAC3B,GAAG,YAAY,EAAE,CASjB;AAED;2EAC2E;AAC3E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,cAAc,CAAC;IACvB,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,kBAAkB,EAAE,GAAG,CAAA;KAAE,CAAC;CAChG,GAAG,YAAY,EAAE,CAIjB"}

package/dist/approved-hash.js

@@ -0,0 +1,139 @@
+// R917-C-2 (spec 408 §1.2) — THE EPOCH-BOUND APPROVED-HASH KEY.
+//
+// An AgentAccount's `0x03` ERC-1271 sentinel does not ask the ApprovedHashRegistry about the raw digest;
+// it asks about `keccak256(abi.encode(digest, custodyEpoch))`, where the custody epoch increments every
+// time the account retires a credential (`removeCustodian`, `removePasskey` — recovery and rotation
+// remove through these). So an approval planted by a custodian who is later removed is void the moment
+// the custody set no longer contains that custodian: an ECDSA signature dies with its key, and an
+// approved hash dies with its custody set.
+//
+// What an SDK does: read the account's epoch (0 for a counterfactual account — a deploy-and-approve
+// batch, spec 253, is computable before the address has code) and approve the KEY. After a custodian
+// removal the account's standing approved-hash wires are re-approved under the new epoch — in one batch,
+// as the ceremony already does.
+//
+// THREE CONTRACT GENERATIONS. An estate whose contracts predate spec 408 (`contractsGeneration` absent from its
+// deployments JSON = generation 1) has accounts with no epoch: the sentinel there consults the RAW digest.
+// Generation 2 (spec 408) approves the epoch-bound KEY, computed here and sent to the registry. Generation 3
+// (spec 410 §1, THESIS-1a) closes the hole generation 2 left — a caller who can compute the key can compute it
+// for a FUTURE epoch, and the registry stores whatever it is sent — by making the ACCOUNT derive the key on
+// chain (`approveDigest`) and refusing the registry as an execute target for every caller. On generation 3 an
+// SDK never computes a key: it asks the account to approve the DIGEST. The generation is a DEPLOYMENT FACT the
+// app states (`CONTRACTS_GENERATION`), never inferred from a failed read (ADR-0013): one mechanism per
+// generation, chosen by configuration.
+import { encodeAbiParameters, encodeFunctionData, keccak256 } from 'viem';
+import { agentAccountAbi, approvedHashRegistryAbi } from './abis.js';
+/** The generation a deployments JSON records; absent ⇒ 1 (the field arrived with spec 408). Anything else throws. */
+export function contractsGenerationOf(deployments) {
+    const g = deployments?.contractsGeneration;
+    if (g === undefined || g === null || g === 1 || g === '1')
+        return 1;
+    if (g === 2 || g === '2')
+        return 2;
+    if (g === 3 || g === '3')
+        return 3;
+    throw new Error(`contractsGeneration ${String(g)} is not a generation this SDK knows (1, 2 or 3)`);
+}
+/** The 32 bytes the account approves for `digest` under `scheme`. On generation 3 there is nothing for a caller
+ *  to compute — the account derives the key on chain — so this throws rather than guess an epoch (ADR-0013). */
+export function approvalKey(digest, scheme) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(digest))
+        throw new Error('approvalKey: digest must be a bytes32 hex string');
+    if (scheme.generation === 1)
+        return digest;
+    if (scheme.generation === 2)
+        return approvedHashKey(digest, scheme.epoch);
+    throw new Error('approvalKey: on generation 3 the account derives the key on chain (approveDigest); read approvedHashKey(digest) from the account if you need the stored key');
+}
+/** The scheme for `account` on an estate of `generation`: generation 1 needs no read; generation 2 reads the
+ *  account's custody epoch (0 for an address with no code); generation 3 needs no read either — the account
+ *  will derive the key under whatever epoch it is in when the call lands. */
+export async function readApprovalScheme(client, account, generation) {
+    if (generation === 1)
+        return { generation: 1 };
+    if (generation === 3)
+        return { generation: 3, account };
+    return { generation: 2, epoch: await readCustodyEpoch(client, account) };
+}
+/** The 32 bytes an account must approve for `digest` to validate through its `0x03` sentinel at `epoch`. */
+export function approvedHashKey(digest, epoch) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(digest))
+        throw new Error('approvedHashKey: digest must be a bytes32 hex string');
+    const e = BigInt(epoch);
+    if (e < 0n || e > 0xffffffffffffffffn)
+        throw new Error('approvedHashKey: epoch must fit uint64');
+    return keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'uint64' }], [digest, e]));
+}
+/** The one read: a deployed account answers `custodyEpoch()`; an address with no code is at epoch 0. */
+export async function readCustodyEpoch(client, account) {
+    const code = await client.getCode({ address: account });
+    if (!code || code === '0x')
+        return 0n;
+    return BigInt(await client.readContract({ address: account, abi: agentAccountAbi, functionName: 'custodyEpoch' }));
+}
+/** `ApprovedHashRegistry.approveHash(approvalKey(digest, scheme))` as a `ContractCall` for the account's own
+ *  execute/executeBatch. The scheme is REQUIRED so a caller states which estate generation and (on generation 2)
+ *  which custody set it is approving under — `{ generation: 2, epoch: 0n }` for a counterfactual account being
+ *  deployed in the same batch. */
+export function buildApproveHashCall(registry, digest, scheme) {
+    if (scheme.generation === 3) {
+        // Spec 410 §1: a self-call — the account computes the key under the epoch it is in. `registry` is not a
+        // target on this generation (the account refuses it), so it is deliberately unused here.
+        if (!/^0x[0-9a-fA-F]{64}$/.test(digest))
+            throw new Error('buildApproveHashCall: digest must be a bytes32 hex string');
+        return { to: scheme.account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'approveDigest', args: [digest] }) };
+    }
+    return {
+        to: registry,
+        value: 0n,
+        data: encodeFunctionData({ abi: approvedHashRegistryAbi, functionName: 'approveHash', args: [approvalKey(digest, scheme)] }),
+    };
+}
+/** `ApprovedHashRegistry.revokeAll()` as a `ContractCall`: void every approval the account ever made.
+ *  Generations 1 and 2 only — on generation 3 the registry is not an execute target; use
+ *  `buildRevokeAllApprovedDigestsCall(account)`. */
+export function buildRevokeAllApprovedHashesCall(registry) {
+    return { to: registry, value: 0n, data: encodeFunctionData({ abi: approvedHashRegistryAbi, functionName: 'revokeAll' }) };
+}
+/** Spec 410 §1 (generation 3) — `AgentAccount.revokeAllApprovedDigests()` as a self-call: void every approval
+ *  the account ever made, under any epoch, including one planted for a future epoch. The last step of a
+ *  mode-0 self-recovery batch; `CustodyPolicy` does the same for every governed recovery. */
+export function buildRevokeAllApprovedDigestsCall(account) {
+    return { to: account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'revokeAllApprovedDigests' }) };
+}
+function credentialAddCall(account, c) {
+    return c.kind === 'custodian'
+        ? { to: account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'addCustodian', args: [c.address] }) }
+        : { to: account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'addPasskey', args: [c.credentialIdDigest, c.x, c.y, c.rpIdHash] }) };
+}
+function credentialRetireCall(account, c) {
+    return c.kind === 'custodian'
+        ? { to: account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'removeCustodian', args: [c.address] }) }
+        : { to: account, value: 0n, data: encodeFunctionData({ abi: agentAccountAbi, functionName: 'removePasskey', args: [c.credentialIdDigest] }) };
+}
+/** Spec 410 §1.2 — the mode-0 ROTATION batch: `add → retire → approveDigest × N`. Order is the builder's, not
+ *  the caller's: the account is never credential-less, and every re-approval lands after the retirement so
+ *  the account derives each key under the NEW epoch. Generation 3 only — an older estate has no
+ *  `approveDigest`, and pretending with a computed future-epoch key is the exact hole this closes. */
+export function buildRotationBatch(args) {
+    if (args.scheme.generation !== 3)
+        throw new Error('buildRotationBatch: the rotation ceremony needs contracts generation 3 (spec 410 §1); this estate runs ' + args.scheme.generation);
+    const account = args.scheme.account;
+    for (const d of args.reapprove)
+        if (!/^0x[0-9a-fA-F]{64}$/.test(d))
+            throw new Error('buildRotationBatch: every reapprove entry must be a bytes32 digest');
+    return [
+        credentialAddCall(account, args.add),
+        credentialRetireCall(account, args.retire),
+        ...args.reapprove.map((d) => buildApproveHashCall(account, d, args.scheme)),
+    ];
+}
+/** Spec 410 §1.2 — the mode-0 SELF-RECOVERY batch: `add → retire → revokeAllApprovedDigests`. It carries no
+ *  re-approval list — the type has no field for one. Generation 3 only. */
+export function buildSelfRecoveryBatch(args) {
+    if (args.scheme.generation !== 3)
+        throw new Error('buildSelfRecoveryBatch: needs contracts generation 3 (spec 410 §1); this estate runs ' + args.scheme.generation);
+    const account = args.scheme.account;
+    return [credentialAddCall(account, args.add), credentialRetireCall(account, args.retire), buildRevokeAllApprovedDigestsCall(account)];
+}
+//# sourceMappingURL=approved-hash.js.map