@callcium/sdk 0.11.1 → 0.12.0

package/src/descriptor-coder.ts

@@ -1,3 +1,5 @@
+import { concatBytes } from "@noble/hashes/utils.js";
+
 import { readU16 } from "./bytes";
 import { DescriptorFormat as DF, TypeCode } from "./constants";
 import { Descriptor, readNode } from "./descriptor";
@@ -12,8 +14,7 @@ import type { DecodedParam, Hex } from "./types";
 ///////////////////////////////////////////////////////////////////////////
 
 /**
- * Collect the positions of depth-0 commas in input[start..end).
- * Commas inside `()` or `[]` are skipped.
+ * Collect the positions of depth-0 commas in input[start..end). Commas inside `()` or `[]` are skipped.
  */
 function commaPositions(input: string, start: number, end: number): number[] {
   const positions: number[] = [];
@@ -47,8 +48,8 @@ const MAX_TYPE_STRING_NUMBER = 256 ** DF.ARRAY_LENGTH_SIZE - 1;
 /**
  * Parse a decimal integer from input[start..end).
  *
- * Rejects an empty span, a non-digit, a leading zero, and a value too wide for the fields a type
- * string feeds. Width and length validity are out of scope here.
+ * Rejects an empty span, a non-digit, a leading zero, and a value too wide for the fields a type string feeds. Width
+ * and length validity are out of scope here.
  */
 function parseUint(input: string, start: number, end: number): number {
   if (start >= end) {
@@ -77,8 +78,7 @@ function parseUint(input: string, start: number, end: number): number {
 ///////////////////////////////////////////////////////////////////////////
 
 /**
- * Parse a tuple literal `(field0,field1,...)` where the opening `(` is at
- * `start` and the substring to parse ends before `end`.
+ * Parse a tuple literal `(field0,field1,...)` whose opening `(` is at `start` and whose content ends before `end`.
  */
 function parseTuple(input: string, start: number, end: number): Uint8Array {
   if (input[start] !== "(") {
@@ -137,8 +137,8 @@ function parseBaseType(input: string, start: number, end: number): Uint8Array {
   if (segment === "string") return string_();
   if (segment.startsWith("(")) return parseTuple(input, start, end);
 
-  // A prefix with no width after it spells no type, so it falls through to the unknown-type report
-  // rather than being read as a width that is not there.
+  // A prefix with no width after it spells no type, so it falls through to the unknown-type report rather than being
+  // read as a width that is not there.
   if (segment.length > 4 && segment.startsWith("uint")) return uintN(parseUint(input, start + 4, end));
   if (segment.length > 3 && segment.startsWith("int")) return intN(parseUint(input, start + 3, end));
   if (segment.length > 5 && segment.startsWith("bytes")) return bytesN(parseUint(input, start + 5, end));
@@ -153,16 +153,16 @@ function parseBaseType(input: string, start: number, end: number): Uint8Array {
 /**
  * Parse a type segment from input[start..end).
  *
- * Scans backward from end to collect all `[...]` suffixes, identifies the
- * base type extent, parses the base, then applies suffixes left-to-right.
+ * Scans backward from end to collect all `[...]` suffixes, identifies the base type extent, parses the base, then
+ * applies suffixes left-to-right.
  */
 function parseType(input: string, start: number, end: number): Uint8Array {
   if (start >= end) {
     throw new CallciumError("MALFORMED_TYPE_STRING", "Empty type segment");
   }
 
-  // Locate array suffixes by scanning backward, reading no length yet: the base names the type, so
-  // an unrecognised one is reported before a suffix it carries is parsed.
+  // Locate array suffixes by scanning backward, reading no length yet: the base names the type, so an unrecognised one
+  // is reported before a suffix it carries is parsed.
   const spans: Array<[number, number]> = [];
   let baseEnd = end;
 
@@ -182,8 +182,7 @@ function parseType(input: string, start: number, end: number): Uint8Array {
 
   let desc = parseBaseType(input, start, baseEnd);
 
-  // Apply suffixes left-to-right: the leftmost suffix is the outermost array.
-  // A dynamic array spells no length at all.
+  // Apply suffixes left-to-right: the leftmost suffix is the innermost array. A dynamic array spells no length at all.
   for (const [innerStart, innerEnd] of spans) {
     desc = array(desc, innerStart === innerEnd ? undefined : parseUint(input, innerStart, innerEnd));
   }
@@ -223,15 +222,7 @@ function fromTypes(typesCsv: string): Uint8Array {
   if (paramDescs.length > DF.MAX_PARAMS) {
     throw new CallciumError("TOO_MANY_PARAMS", `Parameter count ${paramDescs.length} exceeds maximum ${DF.MAX_PARAMS}`);
   }
-  const totalBytes = paramDescs.reduce((sum, d) => sum + d.length, 0);
-  const result = new Uint8Array(DF.HEADER_SIZE + totalBytes);
-  result[0] = DF.VERSION;
-  result[1] = paramDescs.length;
-  let offset = DF.HEADER_SIZE;
-  for (const desc of paramDescs) {
-    result.set(desc, offset);
-    offset += desc.length;
-  }
+  const result = concatBytes(Uint8Array.of(DF.VERSION, paramDescs.length), ...paramDescs);
   // Nesting depth is a property of the assembled descriptor, not of any single node.
   decodeDescriptor(result);
   return result;

package/src/descriptor.ts

@@ -46,11 +46,10 @@ type HintWalk = {
 type Node = { typeCode: number; staticWords: number; nodeLength: number };
 
 /**
- * Read the node at `offset`.
- * Elementary nodes occupy exactly one byte; composite nodes encode their static
- * word count and length in the 24-bit meta field that follows the type code.
- * @throws {CallciumError} When the node starts past the descriptor, carries an undefined type code,
- * or declares a length below its own header or beyond the descriptor.
+ * Read the node at `offset`. Elementary nodes occupy exactly one byte; composite nodes encode their static word count
+ * and length in the 24-bit meta field that follows the type code.
+ * @throws {CallciumError} When the node starts past the descriptor, carries an undefined type code, or declares a
+ * length below its own header or beyond the descriptor.
  */
 export function readNode(desc: Uint8Array, offset: number): Node {
   if (offset >= desc.length) {
@@ -90,8 +89,8 @@ function nodeLength(desc: Uint8Array, offset: number): number {
 }
 
 /**
- * Return the byte offset of the `fieldIndex`-th field inside a tuple node.
- * Starts at the first field and skips `fieldIndex` nodes using `nodeLength`.
+ * Return the byte offset of the `fieldIndex`-th field inside a tuple node. Starts at the first field and skips
+ * `fieldIndex` nodes using `nodeLength`.
  */
 function tupleFieldOffset(desc: Uint8Array, tupleOffset: number, fieldIndex: number): number {
   let cursor = tupleOffset + DF.TUPLE_HEADER_SIZE;
@@ -144,27 +143,27 @@ function inspect(desc: Uint8Array, offset: number): TypeInfo {
 /**
  * Resolve the type at a calldata path (array of step indices).
  *
- * The first step selects a top-level param. Each subsequent step descends
- * into the current node: for tuples it selects a field, for arrays it
- * advances to the element descriptor.
+ * The first step selects a top-level param. Each subsequent step descends into the current node: for tuples it selects
+ * a field, for arrays it advances to the element descriptor.
  *
  * @param desc - Raw descriptor bytes.
  * @param steps - Path steps, length >= 1.
  * @returns TypeInfo for the node at the resolved path.
- * @throws {CallciumError} On empty steps, out-of-bounds param or array index, or descent into elementary type.
+ * @throws {CallciumError} On empty steps, an out-of-bounds param index, tuple field or static array index, or descent
+ * into an elementary type.
  */
 function typeAt(desc: Uint8Array, steps: number[]): TypeInfo {
   return walkPath(desc, steps).typeInfo;
 }
 
 /**
- * Resolve the type at the path and the declared length of the static array a
- * quantifier step descends into (zero when the path holds no quantifier step
- * over a static array).
+ * Resolve the type at the path and the declared length of the static array a quantifier step descends into (zero when
+ * the path holds no quantifier step over a static array).
  * @param desc - Raw descriptor bytes.
  * @param steps - Path steps, length >= 1.
  * @returns TypeInfo at the resolved path and the quantified static array length.
- * @throws {CallciumError} On empty steps, out-of-bounds param or array index, or descent into elementary type.
+ * @throws {CallciumError} On empty steps, an out-of-bounds param index, tuple field or static array index, or descent
+ * into an elementary type.
  */
 function walkPath(desc: Uint8Array, steps: number[]): { typeInfo: TypeInfo; quantifiedStaticLength: number } {
   if (steps.length === 0) {
@@ -188,8 +187,8 @@ function walkPath(desc: Uint8Array, steps: number[]): { typeInfo: TypeInfo; quan
       }
       cursor = tupleFieldOffset(desc, cursor, step);
     } else if (typeCode === TypeCode.STATIC_ARRAY || typeCode === TypeCode.DYNAMIC_ARRAY) {
-      // Quantifier sentinels descend into the element type; only concrete
-      // indices are bounds-checked against the declared array length.
+      // Quantifier sentinels descend into the element type; only concrete indices are bounds-checked against the
+      // declared array length.
       if (typeCode === TypeCode.STATIC_ARRAY) {
         if (isQuantifier(step)) {
           quantifiedStaticLength = staticArrayLength(desc, cursor);
@@ -377,8 +376,8 @@ function encodeHint(walk: HintWalk, targetMeta: number, typeCode: number, depth:
  * @param desc - Raw descriptor bytes.
  * @param steps - Path steps, length >= 1.
  * @returns The hint block bytes.
- * @throws {CallciumError} When a step leaves the structure the descriptor declares, quantifies over
- * a non-array node, or repeats a quantifier.
+ * @throws {CallciumError} When a step leaves the structure the descriptor declares, quantifies over a non-array node,
+ * or repeats a quantifier.
  */
 function compileHint(desc: Uint8Array, steps: number[]): Uint8Array {
   if (steps.length === 0) {

package/src/errors.ts

@@ -1,11 +1,10 @@
 /**
  * Machine-readable error code for structural decoding and validation failures.
  *
- * Each code names one invariant. Where Solidity detects the same invariant, the code is its error
- * name transliterated from `PascalCase` to `SCREAMING_SNAKE_CASE`. The codes under "Inputs and
- * validation" have no counterpart: they name input a Solidity signature cannot express.
- * `OUT_OF_PHYSICAL_BOUNDS` names an invariant Solidity carries twice, as the error
- * `PolicyBuilder.OutOfPhysicalBounds` and as an issue code, so the name is shared with `IssueCode`.
+ * Each code names one invariant. Where Solidity detects the same invariant, the code is its error name transliterated
+ * from `PascalCase` to `SCREAMING_SNAKE_CASE`. The codes under "Inputs and validation" have no counterpart: they name
+ * input a Solidity signature cannot express. `OUT_OF_PHYSICAL_BOUNDS` names an invariant Solidity carries twice, as the
+ * error `PolicyBuilder.OutOfPhysicalBounds` and as an issue code, so the name is shared with `IssueCode`.
  */
 export type CallciumErrorCode =
   // Policy and descriptor framing.
@@ -73,18 +72,18 @@ export type CallciumErrorCode =
   | "RULE_COUNT_OVERFLOW"
   | "RULE_SIZE_OVERFLOW"
   | "DESC_LENGTH_OVERFLOW"
+  // Strict build.
+  | "VALIDATION_ERROR"
   // Inputs and validation.
   | "UNKNOWN_QUANTIFIER"
   | "INVALID_HEX"
   | "MALFORMED_SELECTOR"
   | "PATH_STEP_OVERFLOW"
   | "OPERAND_OVERFLOW"
-  | "CONTEXT_VALUE_OVERFLOW"
-  | "VALIDATION_ERROR";
+  | "CONTEXT_VALUE_OVERFLOW";
 
 /**
- * Thrown when a policy or descriptor blob is structurally malformed.
- * The optional `offset` indicates the byte position in the source blob where the error was detected.
+ * Thrown on malformed or inadmissible SDK input. `offset`, when set, is the error's byte position in the source blob.
  */
 export class CallciumError extends Error {
   public readonly code: CallciumErrorCode;
@@ -104,9 +103,8 @@ export class CallciumError extends Error {
 /**
  * Thrown by `PolicyBuilder.build` when validation reports any issue.
  *
- * Carries every issue the validator found. The `Error.message` is the first issue's
- * message — a diagnostic summary, not a presentation contract. Consumers rendering
- * issues to users should iterate `issues` directly.
+ * Carries every issue the validator found. The `Error.message` is the first issue's message — a diagnostic summary, not
+ * a presentation contract. Consumers rendering issues to users should iterate `issues` directly.
  */
 export class ValidationError extends CallciumError {
   public readonly issues: import("./types").Issue[];
@@ -119,12 +117,11 @@ export class ValidationError extends CallciumError {
 }
 
 /**
- * Thrown by `PolicyEnforcer.enforce` when calldata fails policy enforcement.
- * Distinct from `ValidationError`, which signals static issues in the policy itself.
+ * Thrown by `PolicyEnforcer.enforce` when calldata fails policy enforcement. Distinct from `ValidationError`, which
+ * signals static issues in the policy itself.
  *
- * Carries the full list of structured violations (one per failed group). The
- * `Error.message` is a minimal non-lossy diagnostic summary built from the
- * first violation's structured fields — not a presentation contract. Consumers
+ * Carries the full list of structured violations (one per failed group). The `Error.message` is a minimal non-lossy
+ * diagnostic summary built from the first violation's structured fields — not a presentation contract. Consumers
  * rendering violations to users should iterate `violations` directly.
  */
 export class PolicyViolationError extends Error {

package/src/index.ts

@@ -30,7 +30,7 @@ export { PolicyEnforcer } from "./policy-enforcer";
 // Utilities
 ///////////////////////////////////////////////////////////////////////////
 
-export { toAddress, hexToBytes, bytesToHex } from "./bytes";
+export { hexToBytes, bytesToHex } from "./bytes";
 export { Descriptor } from "./descriptor";
 export { DescriptorCoder } from "./descriptor-coder";
 export type { TypeInfo } from "./descriptor";
@@ -45,13 +45,12 @@ export {
   PolicyFormat,
   Scope,
   ContextProperty,
-  MAX_CONTEXT_PROPERTY_ID,
   findContextProperty,
   lookupOp,
   lookupScope,
   lookupContextProperty,
 } from "./constants";
-export { isLengthOp, lookupTypeCode } from "./operators";
+export { isContextOp, isLengthOp, lookupTypeCode } from "./operators";
 export type { TypeCodeInfo, TypeClassInfo, TypeClass } from "./operators";
 export type { Operands, OpInfo, ScopeInfo, ContextPropertyInfo } from "./constants";
 

package/src/operators.ts

@@ -21,8 +21,8 @@ export function isSigned(typeCode: number): boolean {
 }
 
 /**
- * Return true when the type code represents a left-aligned type (fixed bytes or function),
- * whose value occupies the high bytes of the word with zero padding below.
+ * Return true when the type code represents a left-aligned type (fixed bytes or function), whose value occupies the
+ * high bytes of the word with zero padding below.
  */
 export function isLeftAligned(typeCode: number): boolean {
   return (
@@ -31,11 +31,9 @@ export function isLeftAligned(typeCode: number): boolean {
 }
 
 /**
- * Canonicalize a raw 256-bit calldata word to its ABI value for the declared type.
- * A scalar loaded from untrusted calldata may carry bits outside the declared width; masking
- * unsigned/address/bool/function/bytesN to width and sign-extending signed integers makes the
- * comparison use the canonical ABI value rather than the raw bytes.
- * @param value - The raw 256-bit word loaded from calldata.
+ * Return the canonical encoding of a 256-bit word for the declared type. Masks unsigned/address/bool to width, clears
+ * bytesN/function padding, and sign-extends signed integers. A word is canonical when this leaves it unchanged.
+ * @param value - The 256-bit word.
  * @param typeCode - The declared type code of the value.
  * @returns The canonicalized 256-bit value.
  */
@@ -78,14 +76,10 @@ export function isLengthOp(opCode: number): boolean {
   return base >= Op.LENGTH_EQ && base <= Op.LENGTH_BETWEEN;
 }
 
-/** Map a LENGTH_* opcode base to its core value-comparison twin. */
-function lengthToValueOp(base: number): number {
-  if (base === Op.LENGTH_EQ) return Op.EQ;
-  if (base === Op.LENGTH_GT) return Op.GT;
-  if (base === Op.LENGTH_LT) return Op.LT;
-  if (base === Op.LENGTH_GTE) return Op.GTE;
-  if (base === Op.LENGTH_LTE) return Op.LTE;
-  return Op.BETWEEN;
+/** Return true when the operator code (with or without NOT flag) is a *_CTX variant. */
+export function isContextOp(opCode: number): boolean {
+  const base = opCode & ~Op.NOT;
+  return base >= Op.EQ_CTX && base <= Op.LTE_CTX;
 }
 
 /** Return true when LENGTH_* operators are valid for the given type code (bytes, string, or dynamic array). */
@@ -119,12 +113,12 @@ function isIn(value: bigint, data: Uint8Array): boolean {
 }
 
 /**
- * Apply a single operator against a value and operand data.
- * Handles the NOT flag internally by inverting the base operator result.
+ * Apply a single operator against a value and operand data. Handles the NOT flag by inverting the base result.
  * @param opCode - Operator code, potentially OR'd with the NOT flag.
  * @param value - The 256-bit value to test (ignored for LENGTH_* operators).
  * @param valueLength - Runtime byte or element count, only meaningful for LENGTH_* operators.
- * @param operandData - Raw operand bytes (32 per operand, 64 for range operators).
+ * @param operandData - Raw operand bytes (32 per operand, 64 for range operators); for a context reference operator,
+ *   the referenced property's value as one word.
  * @param typeCode - ABI type code, used to select signed vs. unsigned comparison.
  * @returns Whether the value satisfies the operator.
  */
@@ -135,17 +129,7 @@ export function applyOperator(
   operandData: Uint8Array,
   typeCode: number,
 ): boolean {
-  let base = opCode & ~Op.NOT;
-
-  // Length operators reuse the value-comparison core: the runtime count becomes the compared
-  // value and the opcode maps onto its EQ/GT/LT/GTE/LTE/BETWEEN twin. Counts are non-negative,
-  // so the comparison is always unsigned — force an unsigned type code regardless of the target.
-  if (isLengthOp(base)) {
-    value = valueLength;
-    typeCode = TypeCode.UINT_MAX;
-    base = lengthToValueOp(base);
-  }
-
+  const base = opCode & ~Op.NOT;
   let result: boolean;
 
   switch (base) {
@@ -198,6 +182,53 @@ export function applyOperator(
       break;
     }
 
+    case Op.LENGTH_EQ:
+      result = valueLength === toBigInt(operandData, 0);
+      break;
+
+    case Op.LENGTH_GT:
+      result = valueLength > toBigInt(operandData, 0);
+      break;
+
+    case Op.LENGTH_LT:
+      result = valueLength < toBigInt(operandData, 0);
+      break;
+
+    case Op.LENGTH_GTE:
+      result = valueLength >= toBigInt(operandData, 0);
+      break;
+
+    case Op.LENGTH_LTE:
+      result = valueLength <= toBigInt(operandData, 0);
+      break;
+
+    case Op.LENGTH_BETWEEN: {
+      const lower = toBigInt(operandData, 0);
+      const upper = toBigInt(operandData, 32);
+      result = valueLength >= lower && valueLength <= upper;
+      break;
+    }
+
+    case Op.EQ_CTX:
+      result = value === toBigInt(operandData, 0);
+      break;
+
+    case Op.GT_CTX:
+      result = value > toBigInt(operandData, 0);
+      break;
+
+    case Op.LT_CTX:
+      result = value < toBigInt(operandData, 0);
+      break;
+
+    case Op.GTE_CTX:
+      result = value >= toBigInt(operandData, 0);
+      break;
+
+    case Op.LTE_CTX:
+      result = value <= toBigInt(operandData, 0);
+      break;
+
     default:
       throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code ${formatCode(base, PF.RULE_OPCODE_SIZE)}`);
   }
@@ -260,10 +291,9 @@ const DYNAMIC_ARR = { typeClass: "dynamicArray", isDynamic: true } as const;
 const TUPLE = { typeClass: "tuple", isDynamic: false } as const;
 
 /**
- * Classify a type code into its structural category and dynamism.
- * Lightweight variant of `lookupTypeCode` that skips label computation.
+ * Classify a type code into its structural category and dynamism. A `lookupTypeCode` variant without labels.
  * @param code - A single-byte descriptor type code.
- * @returns Type class and whether the type is ABI-dynamic.
+ * @returns Type class, and whether the code alone implies ABI dynamism (false for tuples and static arrays).
  * @throws {CallciumError} If the code is not a recognised type code.
  */
 export function classifyTypeCode(code: number): TypeClassInfo {
@@ -296,8 +326,8 @@ export function isElementary(code: number): boolean {
 }
 
 /**
- * Determine whether a type code names a value an operator can read: a scalar word or a declared
- * length. Tuples, static arrays, and undefined codes address nothing.
+ * Determine whether a type code names a value an operator can read: a scalar word or a declared length. Tuples, static
+ * arrays, and undefined codes address nothing.
  * @param code - A single-byte descriptor type code.
  * @returns True when an operator can be applied to a target of this type.
  */
@@ -332,7 +362,7 @@ function typeCodeLabel(code: number): string {
 /**
  * Map a raw type code byte to its ABI type label, structural category, and dynamism.
  * @param code - A single-byte descriptor type code.
- * @returns Label, type class, and whether the type is ABI-dynamic.
+ * @returns Label, type class, and whether the code alone implies ABI dynamism (false for tuples and static arrays).
  * @throws {CallciumError} If the code is not a recognised type code.
  */
 export function lookupTypeCode(code: number): TypeCodeInfo {

package/src/path.ts

@@ -47,8 +47,7 @@ export function lookupQuantifier(code: number): QuantifierInfo {
 
 /**
  * Encode a sequence of uint16 path steps as a big-endian hex string.
- * @throws {CallciumError} When a step is not an integer the field holds. A wrapped step would
- * address a different argument.
+ * @throws {CallciumError} When a step is not an integer the field holds; a wrapped step addresses another argument.
  */
 export function encodePath(steps: readonly number[]): Hex {
   const buffer = new Uint8Array(steps.length * PF.PATH_STEP_SIZE);

package/src/policy-builder.ts

@@ -124,26 +124,24 @@ function reject(written: bigint, folded: bigint): never {
 }
 
 /**
- * Reject an operand that two's complement folds onto a value the target admits.
- * Such an operand and the value it folds onto encode to one word, so the operands as written are
- * the only place the two stay distinct. An operand spans no more than one word, which leaves two
- * ways across: a negative's alias clears every target narrower than the whole word, and a positive
- * reaches a signed range only at that type's own minimum word.
+ * Reject an operand that two's complement folds onto a value the target admits. Such an operand and the value it folds
+ * onto encode to one word, so the operands as written are the only place the two stay distinct. An operand spans no
+ * more than one word, which leaves two ways across: a negative's alias clears every target narrower than the whole
+ * word, and a positive reaches a signed range only at that type's own minimum word.
  */
 function checkOperandDomain(constraint: Constraint, typeCode: number): void {
   const bounds = targetBounds(typeCode);
   const extremes = readOperandExtremes(constraint);
   if (bounds === null || extremes === undefined) return;
 
-  // A negative operand occupies the word its unsigned alias does, which only the target holding
-  // the whole word can hold too.
+  // A negative operand encodes as its unsigned alias's word, which only a whole-word target can hold too.
   if (extremes.leastNegative < 0n && typeCode === TypeCode.UINT_MAX) {
     reject(extremes.leastNegative, extremes.leastNegative + WORD_VALUES);
   }
 
   if (!isSigned(typeCode)) return;
-  // An operand at or above the signed minimum's own word denotes that negative, and every such
-  // operand already exceeds the signed maximum.
+  // An operand at or above the signed minimum's own word denotes that negative, and every such operand already exceeds
+  // the signed maximum.
   if (extremes.greatest >= WORD_VALUES + bounds.min) {
     reject(extremes.greatest, extremes.greatest - WORD_VALUES);
   }
@@ -195,9 +193,9 @@ export class PolicyBuilder {
   /**
    * Add a constraint to the current group.
    * @param constraint - A `Constraint` object or a `ConstraintBuilder` instance.
-   * @throws {CallciumError} With code `OUT_OF_PHYSICAL_BOUNDS` when a numeric operand lies outside
-   * the target type's range and encodes as a value inside it. Operands are read as written, so a
-   * `Constraint` carrying encoded operator bytes is left to {@link validate}.
+   * @throws {CallciumError} With code `OUT_OF_PHYSICAL_BOUNDS` when a numeric operand lies outside the target type's
+   * range and encodes as a value inside it. Operands are read as written, so a `Constraint` carrying encoded operator
+   * bytes is left to {@link validate}.
    */
   add(constraint: Constraint): this {
     // A builder compiles no hint; one arrives only on a constraint that came already encoded.
@@ -251,14 +249,12 @@ export class PolicyBuilder {
   }
 
   /**
-   * Build the policy into an encoded binary blob with strict validation.
-   * Throws on any issue, regardless of severity. Use {@link validate} to
-   * inspect issues, or {@link buildUnsafe} to encode without validation.
+   * Build the policy into an encoded binary blob with strict validation. Throws on any issue, regardless of severity.
+   * Use {@link validate} to inspect issues, or {@link buildUnsafe} to encode without validation.
    * @returns The policy as a 0x-prefixed hex string.
    * @throws {CallciumError} If any group is empty.
    * @throws {ValidationError} If validation finds any issue.
-   * @throws {CallciumError} With code `RULE_SIZE_OVERFLOW` when a rule's encoded bytes exceed the
-   * width of the rule size field.
+   * @throws {CallciumError} With code `RULE_SIZE_OVERFLOW` when a rule's encoded bytes exceed the rule size field.
    */
   build(): Hex {
     this.checkGroups();
@@ -271,9 +267,8 @@ export class PolicyBuilder {
   }
 
   /**
-   * Build the policy into an encoded binary blob without validation.
-   * The resulting policy may be invalid. Prefer {@link build}; use this
-   * only to knowingly bypass a reported issue.
+   * Build the policy into an encoded binary blob without validation. The resulting policy may be invalid. Prefer {@link
+   * build}; use this only to knowingly bypass a reported issue.
    * @returns The policy as a 0x-prefixed hex string.
    * @throws {CallciumError} If any group is empty.
    */