@agenticprimitives/contracts 1.0.0-alpha.26 → 1.0.0-alpha.27

package/dist/abi/TreasurySpendPolicy.json

@@ -0,0 +1,369 @@
+[
+  {
+    "type": "function",
+    "name": "budget",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "asset",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "ceiling",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "windowSeconds",
+        "type": "uint64",
+        "internalType": "uint64"
+      },
+      {
+        "name": "windowStart",
+        "type": "uint64",
+        "internalType": "uint64"
+      },
+      {
+        "name": "windowIndex",
+        "type": "uint64",
+        "internalType": "uint64"
+      },
+      {
+        "name": "spent",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "installed",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "decodeBatch",
+    "inputs": [
+      {
+        "name": "msgData",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "tuple[]",
+        "internalType": "struct TreasurySpendPolicy.Call[]",
+        "components": [
+          {
+            "name": "target",
+            "type": "address",
+            "internalType": "address"
+          },
+          {
+            "name": "value",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
+          {
+            "name": "data",
+            "type": "bytes",
+            "internalType": "bytes"
+          }
+        ]
+      }
+    ],
+    "stateMutability": "pure"
+  },
+  {
+    "type": "function",
+    "name": "decodeSingle",
+    "inputs": [
+      {
+        "name": "msgData",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "stateMutability": "pure"
+  },
+  {
+    "type": "function",
+    "name": "isModuleType",
+    "inputs": [
+      {
+        "name": "moduleTypeId",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "pure"
+  },
+  {
+    "type": "function",
+    "name": "moduleId",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "string",
+        "internalType": "string"
+      }
+    ],
+    "stateMutability": "pure"
+  },
+  {
+    "type": "function",
+    "name": "onInstall",
+    "inputs": [
+      {
+        "name": "initData",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "onUninstall",
+    "inputs": [
+      {
+        "name": "",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "postCheck",
+    "inputs": [
+      {
+        "name": "",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "preCheck",
+    "inputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "msgData",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "remaining",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "left",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "ceiling",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "event",
+    "name": "BudgetInstalled",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "asset",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "ceiling",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      },
+      {
+        "name": "windowSeconds",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      },
+      {
+        "name": "windowStart",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "event",
+    "name": "BudgetUninstalled",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "event",
+    "name": "Spent",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "windowIndex",
+        "type": "uint64",
+        "indexed": true,
+        "internalType": "uint64"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      },
+      {
+        "name": "spentInWindow",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "error",
+    "name": "AlreadyInstalledOn",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "BadBudget",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "BudgetExceeded",
+    "inputs": [
+      {
+        "name": "ceiling",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "spentInWindow",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "NotInstalledOn",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  }
+]

package/dist/abi/index.d.ts

@@ -24,6 +24,7 @@ export declare const CaveatEnforcerBase: Abi;
 export declare const CustodyPolicy: Abi;
 export declare const DelegationManager: Abi;
 export declare const DigestBindingEnforcer: Abi;
+export declare const EstateProjectionRegistry: Abi;
 export declare const GeoFeatureRegistry: Abi;
 export declare const GovernanceManaged: Abi;
 export declare const IAgentAccount: Abi;
@@ -32,6 +33,7 @@ export declare const IAgentAccountFactoryView: Abi;
 export declare const IAgentAccountPauseView: Abi;
 export declare const IAgenticPrimitivesAgentAccount: Abi;
 export declare const IApprovedHashRegistryView: Abi;
+export declare const IApprovedHashRegistryWrite: Abi;
 export declare const IAttributeReader: Abi;
 export declare const ICaveatEnforcer: Abi;
 export declare const ICustodyPolicyAccountModuleView: Abi;
@@ -50,6 +52,7 @@ export declare const MultiSendCallOnly: Abi;
 export declare const MultiSendCallOnlyHarness: Abi;
 export declare const OntologyTermRegistry: Abi;
 export declare const P256Verifier: Abi;
+export declare const PayloadClassesEnforcer: Abi;
 export declare const PaymentEnforcer: Abi;
 export declare const PaymentEscrow: Abi;
 export declare const PaymentReceiptRegistry: Abi;
@@ -63,6 +66,7 @@ export declare const SkillDefinitionRegistry: Abi;
 export declare const SmartAgentModuleTypes: Abi;
 export declare const SmartAgentPaymaster: Abi;
 export declare const TimestampEnforcer: Abi;
+export declare const TreasurySpendPolicy: Abi;
 export declare const UniversalSignatureValidator: Abi;
 export declare const ValueEnforcer: Abi;
 export declare const WebAuthnLib: Abi;

package/dist/abi/index.js

@@ -24,6 +24,7 @@ export { default as CaveatEnforcerBase } from './CaveatEnforcerBase.json' with {
 export { default as CustodyPolicy } from './CustodyPolicy.json' with { type: 'json' };
 export { default as DelegationManager } from './DelegationManager.json' with { type: 'json' };
 export { default as DigestBindingEnforcer } from './DigestBindingEnforcer.json' with { type: 'json' };
+export { default as EstateProjectionRegistry } from './EstateProjectionRegistry.json' with { type: 'json' };
 export { default as GeoFeatureRegistry } from './GeoFeatureRegistry.json' with { type: 'json' };
 export { default as GovernanceManaged } from './GovernanceManaged.json' with { type: 'json' };
 export { default as IAgentAccount } from './IAgentAccount.json' with { type: 'json' };
@@ -32,6 +33,7 @@ export { default as IAgentAccountFactoryView } from './IAgentAccountFactoryView.
 export { default as IAgentAccountPauseView } from './IAgentAccountPauseView.json' with { type: 'json' };
 export { default as IAgenticPrimitivesAgentAccount } from './IAgenticPrimitivesAgentAccount.json' with { type: 'json' };
 export { default as IApprovedHashRegistryView } from './IApprovedHashRegistryView.json' with { type: 'json' };
+export { default as IApprovedHashRegistryWrite } from './IApprovedHashRegistryWrite.json' with { type: 'json' };
 export { default as IAttributeReader } from './IAttributeReader.json' with { type: 'json' };
 export { default as ICaveatEnforcer } from './ICaveatEnforcer.json' with { type: 'json' };
 export { default as ICustodyPolicyAccountModuleView } from './ICustodyPolicyAccountModuleView.json' with { type: 'json' };
@@ -50,6 +52,7 @@ export { default as MultiSendCallOnly } from './MultiSendCallOnly.json' with { t
 export { default as MultiSendCallOnlyHarness } from './MultiSendCallOnlyHarness.json' with { type: 'json' };
 export { default as OntologyTermRegistry } from './OntologyTermRegistry.json' with { type: 'json' };
 export { default as P256Verifier } from './P256Verifier.json' with { type: 'json' };
+export { default as PayloadClassesEnforcer } from './PayloadClassesEnforcer.json' with { type: 'json' };
 export { default as PaymentEnforcer } from './PaymentEnforcer.json' with { type: 'json' };
 export { default as PaymentEscrow } from './PaymentEscrow.json' with { type: 'json' };
 export { default as PaymentReceiptRegistry } from './PaymentReceiptRegistry.json' with { type: 'json' };
@@ -63,6 +66,7 @@ export { default as SkillDefinitionRegistry } from './SkillDefinitionRegistry.js
 export { default as SmartAgentModuleTypes } from './SmartAgentModuleTypes.json' with { type: 'json' };
 export { default as SmartAgentPaymaster } from './SmartAgentPaymaster.json' with { type: 'json' };
 export { default as TimestampEnforcer } from './TimestampEnforcer.json' with { type: 'json' };
+export { default as TreasurySpendPolicy } from './TreasurySpendPolicy.json' with { type: 'json' };
 export { default as UniversalSignatureValidator } from './UniversalSignatureValidator.json' with { type: 'json' };
 export { default as ValueEnforcer } from './ValueEnforcer.json' with { type: 'json' };
 export { default as WebAuthnLib } from './WebAuthnLib.json' with { type: 'json' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.26",
+  "version": "1.0.0-alpha.27",
   "type": "module",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "homepage": "https://agenticprimitives.dev",

package/src/AgentAccount.sol

@@ -56,6 +56,16 @@ interface IApprovedHashRegistryView {
     function isApproved(address signer, bytes32 hash) external view returns (bool);
 }
 
+/// @dev Spec 410 §1 (THESIS-1a) — the ONLY write path from this account to its registry. The account
+///      computes the epoch-bound key itself (`approveDigest`); `execute` / `executeBatch` /
+///      `executeFromModule` refuse the registry as a target unconditionally, so no caller — custodian,
+///      module or delegate — can approve a key under an epoch the account is not in.
+interface IApprovedHashRegistryWrite {
+    function approveHash(bytes32 hash) external;
+    function revokeHash(bytes32 hash) external;
+    function revokeAll() external;
+}
+
 /**
  * @title AgentAccount
  * @notice ERC-4337 + UUPS-upgradeable smart account — agent identity anchor.
@@ -268,6 +278,9 @@ contract AgentAccount is
     /// @notice A delegation-originated execution stack tried to self-call an
     ///         account-governance selector. Delegations may never reach governance.
     error DelegatedGovernanceForbidden();
+    /// @dev Spec 410 §1 (THESIS-1a): the approved-hash registry is reachable only through
+    ///      `approveDigest` / `revokeDigest` / `revokeAllApprovedDigests`, never as an execute target.
+    error ApprovedHashRegistryOnlyViaAccount();
 
     /// @notice Emitted when `setDelegationManager` rotates the DM via a
     ///         self-call (the only authorized path post-Wave-2A).
@@ -1057,6 +1070,7 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
+        _rejectDirectRegistryCall(target);
         // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action from the CANONICAL CustodyPolicy is a
         // custody-governed context (gated upstream by its own T5 quorum + timelock). `_custodyGovCtx`
         // authorizes every governance mutator this call dispatches (the ONLY way past
@@ -1146,6 +1160,7 @@ contract AgentAccount is
         // executeBatch(...)) nest) and forbid it from self-calling governance.
         bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
         if (setDelCtx) _delegationExecCtx = true;
+        _rejectDirectRegistryCall(target);
         _rejectDelegatedGovernance(target, data);
 
         ModulesStorage storage $ = _modulesStorage();
@@ -1232,6 +1247,7 @@ contract AgentAccount is
         }
 
         for (uint256 i = 0; i < calls.length; i++) {
+            _rejectDirectRegistryCall(calls[i].target);
             _rejectDelegatedGovernance(calls[i].target, calls[i].data);
             (bool ok, bytes memory ret) = calls[i].target.call{ value: calls[i].value }(calls[i].data);
             if (!ok) {
@@ -1328,6 +1344,16 @@ contract AgentAccount is
         if (_isAccountTrustedTarget(target)) revert DelegatedGovernanceForbidden();
     }
 
+    /// @dev Spec 410 §1 (THESIS-1a). `ApprovedHashRegistry.approveHash` stores whatever 32 bytes the account
+    ///      sends, and the custody epoch is public — so a custodian who could reach the registry through
+    ///      `execute` could approve `keccak256(abi.encode(h, epoch + 1))`: inert now, live the moment a
+    ///      recovery bumps the epoch to expel that very custodian. Closing it: the registry is never an
+    ///      execute target; the account derives the key on chain in `approveDigest`, under the epoch it is
+    ///      in, and nowhere else. Unconditional — not only under the delegation context (R917-C-1/C-2).
+    function _rejectDirectRegistryCall(address target) internal view {
+        if (target == _approvedHashRegistry && target != address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+    }
+
     /// @dev The contracts that take THIS ACCOUNT as principal when it is `msg.sender` — reachable only from
     ///      the account's own governance paths (`uninstallModule`, a custodian-signed userOp), never from a
     ///      delegation. The custody policy is read from the factory (the canonical one; a legacy direct
@@ -1357,7 +1383,10 @@ contract AgentAccount is
             s == IAgentAccount.removeCustodian.selector ||
             s == this.addPasskey.selector ||
             s == this.removePasskey.selector ||
-            s == this.acceptSessionDelegation.selector;
+            s == this.acceptSessionDelegation.selector ||
+            s == this.approveDigest.selector ||
+            s == this.revokeDigest.selector ||
+            s == this.revokeAllApprovedDigests.selector;
     }
 
     // ─── ERC-1271 ───────────────────────────────────────────────────
@@ -1697,6 +1726,11 @@ contract AgentAccount is
     event PasskeyRemoved(bytes32 indexed credentialIdDigest);
     /// @dev R917-C-2 — a credential was retired; every approved hash keyed to the previous epoch is void.
     event CustodyEpochBumped(uint64 epoch);
+    /// @dev Spec 410 §1 — `digest` approved under `epoch` through the account's own key derivation.
+    event DigestApproved(bytes32 indexed digest, uint64 epoch);
+    event DigestRevoked(bytes32 indexed digest, uint64 epoch);
+    /// @dev Spec 410 §1 — every approval this account ever made is void (registry-side epoch bump).
+    event AllDigestsRevoked();
 
     /// @notice Register a new WebAuthn credential bound to a specific RP.
     ///         `onlySelf` — callable via a UserOp signed by any existing signer
@@ -1802,6 +1836,41 @@ contract AgentAccount is
         emit CustodyEpochBumped(next);
     }
 
+    // ─── Approved digests (spec 410 §1, THESIS-1a) ───────────────────
+
+    /// @notice Approve `digest` for this account's `0x03` sentinel under the epoch the account is IN. The
+    ///         only path to the registry (`execute` refuses it as a target), so the key is never computed
+    ///         by a caller and never for an epoch other than the current one. `onlySelf`, not
+    ///         custody-gated: spec 253's one-prompt org-create batches it into the deploy userOp under the
+    ///         creating custodian, and the epoch (R917-C-2) plus `revokeAllApprovedDigests` on every
+    ///         recovery path (spec 410 §1.2) close the persistence risk instead. A delegation stack cannot
+    ///         reach it (`_isGovernanceSelector`).
+    function approveDigest(bytes32 digest) external onlySelf {
+        if (_approvedHashRegistry == address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+        IApprovedHashRegistryWrite(_approvedHashRegistry).approveHash(approvedHashKey(digest));
+        emit DigestApproved(digest, _custodyEpoch);
+    }
+
+    /// @notice Revoke one approval made under the current epoch.
+    function revokeDigest(bytes32 digest) external onlySelf {
+        if (_approvedHashRegistry == address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+        IApprovedHashRegistryWrite(_approvedHashRegistry).revokeHash(approvedHashKey(digest));
+        emit DigestRevoked(digest, _custodyEpoch);
+    }
+
+    /// @notice Void EVERY approval this account ever made, under any epoch — including one planted for a
+    ///         future epoch before this contract generation refused direct registry calls. `CustodyPolicy`
+    ///         calls it as the last step of every recovery path; a custody-governed account reaches it
+    ///         only through the module (`_requireCustodyGoverned`), a mode-0 person through her own userOp.
+    ///         Recovery re-approves nothing: the person re-issues from a reviewed list (spec 410 §1.2).
+    function revokeAllApprovedDigests() external onlySelf {
+        _requireCustodyGoverned();
+        // No registry wired: nothing was ever approvable (the sentinel fails closed, l. ~1388), so there is
+        // nothing to void — a no-op, never a revert, so a recovery on such an account still completes.
+        if (_approvedHashRegistry != address(0)) IApprovedHashRegistryWrite(_approvedHashRegistry).revokeAll();
+        emit AllDigestsRevoked();
+    }
+
     // ─── Custody policy + scheduled changes ───────────────────────────
     //
     // The schedule / apply / cancel custody-change surface, CustodyAction

package/src/IAgentAccount.sol

@@ -90,6 +90,29 @@ struct AgentAccountRecoveryArgs {
     bytes32[] removePasskeyCredentialIdDigests;
 }
 
+/**
+ * @notice Payload for `CustodyAction.RotateCredential` (T4) — spec 410 §1.2. A PLANNED rotation: the
+ *         old credential is still controlled, the person (or an org's quorum) registers the new one,
+ *         retires the old one, and re-approves every standing approved-digest wire under the new epoch
+ *         — in ONE applied change, so no wire is dead between the retirement and the re-approval.
+ *
+ *         Exactly one credential is added (`addOwner` XOR `addPasskey.x != 0`) and exactly one retired
+ *         (`removeOwner` XOR `removePasskeyCredentialIdDigest != 0`). `reapprove` lists the delegation
+ *         digests to approve after the retirement; the module calls `AgentAccount.approveDigest` for
+ *         each, so the key is derived on chain under the post-rotation epoch.
+ *
+ *         This is the ONLY custody action that carries a re-approval list. `AgentAccountRecoveryArgs`
+ *         has no such field by construction: a recovery is the moment a planted grant would otherwise
+ *         ride through, so recovery re-approves nothing and ends with `revokeAllApprovedDigests`.
+ */
+struct AgentAccountRotateCredentialArgs {
+    address addOwner;
+    AgentAccountRecoveryPasskeyAdd addPasskey;
+    address removeOwner;
+    bytes32 removePasskeyCredentialIdDigest;
+    bytes32[] reapprove;
+}
+
 /**
  * @title IAgentAccount
  * @notice Interface for an agent-native ERC-4337 smart account.