@callcium/sdk 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,12 +1,7 @@
 import { keccak_256 } from "@noble/hashes/sha3";
 //#region src/errors.ts
-/**
-* Thrown when a policy or descriptor blob is structurally malformed.
-* The optional `offset` indicates the byte position in the source blob where the error was detected.
-*/
 var CallciumError = class CallciumError extends Error {
 	code;
-	/** Byte position in the source blob where the error was detected, if applicable. */
 	offset;
 	constructor(code, message, offset) {
 		const prefix = offset !== void 0 ? `[offset ${offset}] ` : "";
@@ -16,16 +11,15 @@ var CallciumError = class CallciumError extends Error {
 		Object.setPrototypeOf(this, CallciumError.prototype);
 	}
 };
-/**
-* Thrown by `PolicyEnforcer.enforce` when calldata fails policy enforcement.
-* Distinct from `CallciumError("VALIDATION_ERROR")`, which signals static
-* issues in the policy itself.
-*
-* Carries the full list of structured violations (one per failed group). The
-* `Error.message` is a minimal non-lossy diagnostic summary built from the
-* first violation's structured fields — not a presentation contract. Consumers
-* rendering violations to users should iterate `violations` directly.
-*/
+var ValidationError = class ValidationError extends CallciumError {
+	issues;
+	constructor(issues) {
+		super("VALIDATION_ERROR", issues[0]?.message ?? "Policy validation failed");
+		this.name = "ValidationError";
+		this.issues = issues;
+		Object.setPrototypeOf(this, ValidationError.prototype);
+	}
+};
 var PolicyViolationError = class PolicyViolationError extends Error {
 	violations;
 	constructor(violations) {
@@ -35,7 +29,6 @@ var PolicyViolationError = class PolicyViolationError extends Error {
 		Object.setPrototypeOf(this, PolicyViolationError.prototype);
 	}
 };
-/** Build a stack-trace-friendly diagnostic line from a violation's code and coordinates. */
 function formatDiagnostic(violation) {
 	if (!violation) return "Policy violation";
 	const location = "group" in violation ? ` at group ${violation.group} rule ${violation.rule}` : "";
@@ -43,56 +36,61 @@ function formatDiagnostic(violation) {
 }
 //#endregion
 //#region src/bytes.ts
-/** Regex that matches a valid hex body (even number of hex chars). */
 const HEX_BODY_RE = /^[0-9a-fA-F]*$/;
-/** Convert a hex string to a byte array, stripping the 0x prefix if present. */
+const HEX_DIGITS = "0123456789abcdef";
+const NIBBLE = new Int8Array(128).fill(-1);
+for (let value = 0; value < 16; value++) {
+	NIBBLE[HEX_DIGITS.charCodeAt(value)] = value;
+	NIBBLE[HEX_DIGITS.toUpperCase().charCodeAt(value)] = value;
+}
 function hexToBytes(hex) {
 	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
 	if (clean.length % 2 !== 0) throw new CallciumError("INVALID_HEX", "Odd-length hex string");
-	if (!HEX_BODY_RE.test(clean)) throw new CallciumError("INVALID_HEX", "Invalid hex characters");
 	const bytes = new Uint8Array(clean.length / 2);
-	for (let i = 0; i < clean.length; i += 2) bytes[i / 2] = parseInt(clean.substring(i, i + 2), 16);
+	for (let i = 0; i < bytes.length; i++) {
+		const high = NIBBLE[clean.charCodeAt(i * 2)] ?? -1;
+		const low = NIBBLE[clean.charCodeAt(i * 2 + 1)] ?? -1;
+		if (high < 0 || low < 0) throw new CallciumError("INVALID_HEX", "Invalid hex characters");
+		bytes[i] = high << 4 | low;
+	}
 	return bytes;
 }
 const HEX_LUT = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
-/** Convert a byte array to a 0x-prefixed lowercase hex string. */
 function bytesToHex(bytes) {
 	let body = "";
 	for (let i = 0; i < bytes.length; i++) body += HEX_LUT[bytes[i]];
 	return `0x${body}`;
 }
-/** Extract a subarray and return it as a 0x-prefixed hex string. */
 function toHex(data, start, end) {
 	return bytesToHex(data.subarray(start, end));
 }
-/** Read a big-endian uint16 from a byte array at the given offset. */
 function readU16(data, offset) {
 	return data[offset] << 8 | data[offset + 1];
 }
-/** Read a big-endian uint24 from a byte array at the given offset. */
 function readU24(data, offset) {
 	return data[offset] << 16 | data[offset + 1] << 8 | data[offset + 2];
 }
-/** Read a big-endian uint32 from a byte array at the given offset. */
 function readU32(data, offset) {
 	return (data[offset] << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3]) >>> 0;
 }
-/** Write a 16-bit big-endian value into a Uint8Array at offset. */
 function writeBE16(buffer, offset, value) {
 	buffer[offset] = value >>> 8 & 255;
 	buffer[offset + 1] = value & 255;
 }
-/** Write a 24-bit big-endian value into a Uint8Array at offset. */
 function writeBE24(buffer, offset, value) {
 	buffer[offset] = value >>> 16 & 255;
 	buffer[offset + 1] = value >>> 8 & 255;
 	buffer[offset + 2] = value & 255;
 }
-/** Format a bigint as a zero-padded 32-byte hex string. */
+function writeBE32(buffer, offset, value) {
+	buffer[offset] = value >>> 24 & 255;
+	buffer[offset + 1] = value >>> 16 & 255;
+	buffer[offset + 2] = value >>> 8 & 255;
+	buffer[offset + 3] = value & 255;
+}
 function bigintToHex(value) {
 	return `0x${value.toString(16).padStart(64, "0")}`;
 }
-/** Validate and brand a hex string as an address. Throws if the runtime length is not exactly 20 bytes. */
 function toAddress(hex) {
 	const body = hex.startsWith("0x") ? hex.slice(2) : hex;
 	if (body.length !== 40) throw new CallciumError("INVALID_HEX", `Invalid address length: expected 40 hex chars, got ${body.length}`);
@@ -101,9 +99,8 @@ function toAddress(hex) {
 }
 //#endregion
 //#region src/constants.ts
-/** Binary layout constants for the Callcium descriptor format. */
 const DescriptorFormat = {
-	VERSION: 1,
+	VERSION: 2,
 	HEADER_SIZE: 2,
 	TYPECODE_SIZE: 1,
 	COMPOSITE_META_SIZE: 3,
@@ -116,12 +113,12 @@ const DescriptorFormat = {
 	MAX_NODE_LENGTH: 4095,
 	MAX_STATIC_ARRAY_LENGTH: 4095,
 	MAX_TUPLE_FIELDS: 4089,
+	MAX_STATIC_WORDS: 4095,
 	MAX_PARAMS: 255,
 	MAX_NESTING_DEPTH: 64
 };
-/** Binary layout constants for the Callcium policy format. */
 const PolicyFormat = {
-	VERSION: 1,
+	VERSION: 2,
 	VERSION_MASK: 15,
 	FLAG_NO_SELECTOR: 16,
 	RESERVED_MASK: 224,
@@ -143,9 +140,31 @@ const PolicyFormat = {
 	RULE_OPCODE_SIZE: 1,
 	RULE_DATALENGTH_SIZE: 2,
 	RULE_FIXED_OVERHEAD: 7,
-	RULE_MIN_SIZE: 9
+	RULE_MIN_SIZE: 9,
+	HINT_HEADER_SIZE: 1,
+	HINT_HOP_SIZE: 8,
+	HINT_HOP_INDEX_OFFSET: 4,
+	HINT_HOP_META_OFFSET: 6,
+	HINT_FRAME_PREFIX_SIZE: 8,
+	HINT_FRAME_COUNT_OFFSET: 4,
+	HINT_FRAME_META_OFFSET: 6,
+	HINT_TARGET_SIZE: 7,
+	HINT_TARGET_META_OFFSET: 4,
+	HINT_TARGET_TYPECODE_OFFSET: 6,
+	HINT_KIND_NONE: 0,
+	HINT_KIND_ALL: 1,
+	HINT_KIND_ANY: 2,
+	HINT_KIND_MAX: 2,
+	HINT_KIND_SHIFT: 6,
+	HINT_HOP_COUNT_MASK: 63,
+	HINT_SUFFIX_RESERVED_MASK: 192,
+	HINT_NO_INDEX: 65535,
+	HINT_INDEX_RESERVED: 65534,
+	HINT_META_ELEM_DYNAMIC: 32768,
+	HINT_META_DYNAMIC_ARRAY: 16384,
+	HINT_META_RESERVED_MASK: 12288,
+	HINT_META_STRIDE_MASK: 4095
 };
-/** Build a plain `{ KEY: code }` object from a table at runtime. */
 function buildCodeMap(table) {
 	return Object.fromEntries(table.map((e) => [e.key, e.code]));
 }
@@ -158,29 +177,21 @@ const SCOPE_TABLE = [{
 	code: 1,
 	label: "calldata"
 }];
-/** Rule scope discriminant: context (EVM environment) vs. calldata (ABI payload). */
 const Scope = buildCodeMap(SCOPE_TABLE);
 const scopeByCode = new Map(SCOPE_TABLE.map((e) => [e.code, { label: e.label }]));
-/**
-* Map a scope code to its display label.
-* @param code - Scope byte value.
-* @returns Display metadata for the scope.
-* @throws {CallciumError} If the code is not a recognised scope.
-*/
 function lookupScope(code) {
 	const info = scopeByCode.get(code);
 	if (!info) throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${code}`);
 	return info;
 }
-/** ABI type code ranges and sentinel values for the descriptor format. */
 const TypeCode = {
-	UINT_MIN: 0,
-	UINT_MAX: 31,
-	INT_MIN: 32,
-	INT_MAX: 63,
-	ADDRESS: 64,
-	BOOL: 65,
-	FUNCTION: 66,
+	UINT_MIN: 1,
+	UINT_MAX: 32,
+	INT_MIN: 33,
+	INT_MAX: 64,
+	ADDRESS: 65,
+	BOOL: 66,
+	FUNCTION: 67,
 	FIXED_BYTES_MIN: 80,
 	FIXED_BYTES_MAX: 111,
 	BYTES: 112,
@@ -239,11 +250,8 @@ const CTX_PROP_TABLE = [
 		typeCode: TypeCode.UINT_MAX
 	}
 ];
-/** Well-known context property IDs for context-scope rules. */
 const ContextProperty = buildCodeMap(CTX_PROP_TABLE);
-/** Maximum valid context property ID. */
 const MAX_CONTEXT_PROPERTY_ID = Math.max(...CTX_PROP_TABLE.map((e) => e.code));
-/** Maps each context property table key to its camelCase Context key. */
 const CTX_KEY_MAP = {
 	MSG_SENDER: "msgSender",
 	MSG_VALUE: "msgValue",
@@ -259,23 +267,16 @@ const ctxPropByCode = new Map(CTX_PROP_TABLE.map((e) => [e.code, {
 	contextKey: CTX_KEY_MAP[e.key],
 	typeCode: e.typeCode
 }]));
-/**
-* Map a context property code to its display label and ABI type code.
-* @param code - Context property ID.
-* @returns Display metadata including the Solidity type code for the property value.
-* @throws {CallciumError} If the code is not a recognised context property.
-*/
 function lookupContextProperty(code) {
 	const info = ctxPropByCode.get(code);
-	if (!info) throw new CallciumError("INVALID_CONTEXT_PROPERTY", `Unknown context property ${code}`);
+	if (!info) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ${code}`);
 	return info;
 }
-/** Protocol-imposed safety limits for path depth and quantifier array size. */
 const Limits = {
 	MAX_PATH_DEPTH: 32,
-	MAX_QUANTIFIED_ARRAY_LENGTH: 256
+	MAX_QUANTIFIED_ARRAY_LENGTH: 256,
+	MAX_SET_MEMBERS: Math.floor((256 ** PolicyFormat.RULE_DATALENGTH_SIZE - 1) / 32)
 };
-/** @internal */
 const OP_TABLE = [
 	{
 		key: "EQ",
@@ -374,7 +375,6 @@ const OP_TABLE = [
 		operands: "range"
 	}
 ];
-/** Callcium policy operator codes. */
 const Op = {
 	...buildCodeMap(OP_TABLE),
 	NOT: 128
@@ -383,24 +383,12 @@ const opByCode = new Map(OP_TABLE.map((e) => [e.code, {
 	label: e.label,
 	operands: e.operands
 }]));
-/**
-* Map an operator code to its display label. Strips the NOT flag automatically.
-* @param code - Operator byte value (may include the NOT flag).
-* @returns Display metadata for the base operator.
-* @throws {CallciumError} If the base code is not a recognised operator.
-*/
 function lookupOp(code) {
 	const base = code & ~Op.NOT;
 	const info = opByCode.get(base);
-	if (!info) throw new CallciumError("INVALID_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}`);
+	if (!info) throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}`);
 	return info;
 }
-/**
-* Check whether an operator's data payload has the correct length.
-* @param opBase - Base operator code with the NOT flag stripped.
-* @param dataLength - Byte length of the operator's data payload.
-* @returns True if the data length is valid for the given operator.
-*/
 function isValidOperatorData(opBase, dataLength) {
 	const operands = opByCode.get(opBase)?.operands;
 	if (operands === "single") return dataLength === 32;
@@ -408,42 +396,25 @@ function isValidOperatorData(opBase, dataLength) {
 	if (operands === "variadic") return dataLength > 0 && dataLength % 32 === 0;
 	return false;
 }
-const QUANTIFIER_TABLE = [
-	{
-		key: "ALL_OR_EMPTY",
-		code: 65535,
-		label: "all or empty"
-	},
-	{
-		key: "ALL",
-		code: 65534,
-		label: "all"
-	},
-	{
-		key: "ANY",
-		code: 65533,
-		label: "any"
-	}
-];
-/** Reserved path step values that trigger quantified evaluation over array elements. */
+const QUANTIFIER_TABLE = [{
+	key: "ALL",
+	code: 65535,
+	label: "all"
+}, {
+	key: "ANY",
+	code: 65534,
+	label: "any"
+}];
 const Quantifier = buildCodeMap(QUANTIFIER_TABLE);
 const quantifierByCode = new Map(QUANTIFIER_TABLE.map((e) => [e.code, { label: e.label }]));
-/** Check whether a path step is a quantifier (ALL_OR_EMPTY, ALL, or ANY). */
 function isQuantifier(step) {
 	return step >= Quantifier.ANY;
 }
-/**
-* Map a quantifier path step to its display label.
-* @param code - Quantifier step value.
-* @returns Display metadata for the quantifier.
-* @throws {CallciumError} If the code is not a recognised quantifier.
-*/
 function lookupQuantifier(code) {
 	const info = quantifierByCode.get(code);
-	if (!info) throw new CallciumError("INVALID_QUANTIFIER", `Unknown quantifier step 0x${code.toString(16)}`);
+	if (!info) throw new CallciumError("UNKNOWN_QUANTIFIER", `Unknown quantifier step 0x${code.toString(16)}`);
 	return info;
 }
-/** Throw an UNKNOWN_TYPE_CODE error. */
 function unknownTypeCode(code) {
 	throw new CallciumError("UNKNOWN_TYPE_CODE", `Unknown type code 0x${code.toString(16).padStart(2, "0")}`);
 }
@@ -467,18 +438,11 @@ const TUPLE = {
 	typeClass: "tuple",
 	isDynamic: false
 };
-/**
-* Classify a type code into its structural category and dynamism.
-* Lightweight variant of `lookupTypeCode` that skips label computation.
-* @param code - A single-byte descriptor type code.
-* @returns Type class and whether the type is ABI-dynamic.
-* @throws {CallciumError} If the code is not a recognised type code.
-*/
 function classifyTypeCode(code) {
 	if (code >= TypeCode.UINT_MIN && code <= TypeCode.UINT_MAX) return ELEMENTARY;
 	if (code >= TypeCode.INT_MIN && code <= TypeCode.INT_MAX) return ELEMENTARY;
 	if (code === TypeCode.ADDRESS || code === TypeCode.BOOL || code === TypeCode.FUNCTION) return ELEMENTARY;
-	if (code >= 67 && code <= 79) unknownTypeCode(code);
+	if (code >= 68 && code <= 79) unknownTypeCode(code);
 	if (code >= TypeCode.FIXED_BYTES_MIN && code <= TypeCode.FIXED_BYTES_MAX) return ELEMENTARY;
 	if (code === TypeCode.BYTES || code === TypeCode.STRING) return ELEMENTARY_DYN;
 	if (code >= 114 && code <= 127) unknownTypeCode(code);
@@ -488,7 +452,15 @@ function classifyTypeCode(code) {
 	if (code === TypeCode.TUPLE) return TUPLE;
 	unknownTypeCode(code);
 }
-/** Compute the Solidity type label for a type code. */
+function isAddressableTarget(code) {
+	let info;
+	try {
+		info = classifyTypeCode(code);
+	} catch {
+		return false;
+	}
+	return info.typeClass === "elementary" || info.typeClass === "dynamicArray";
+}
 function typeCodeLabel(code) {
 	if (code >= TypeCode.UINT_MIN && code <= TypeCode.UINT_MAX) return `uint${(code - TypeCode.UINT_MIN + 1) * 8}`;
 	if (code >= TypeCode.INT_MIN && code <= TypeCode.INT_MAX) return `int${(code - TypeCode.INT_MIN + 1) * 8}`;
@@ -503,12 +475,6 @@ function typeCodeLabel(code) {
 	if (code === TypeCode.TUPLE) return "tuple";
 	return `0x${code.toString(16).padStart(2, "0")}`;
 }
-/**
-* Map a raw type code byte to its Solidity label, structural category, and dynamism.
-* @param code - A single-byte descriptor type code.
-* @returns Label, type class, and whether the type is ABI-dynamic.
-* @throws {CallciumError} If the code is not a recognised type code.
-*/
 function lookupTypeCode(code) {
 	return {
 		label: typeCodeLabel(code),
@@ -517,42 +483,25 @@ function lookupTypeCode(code) {
 }
 //#endregion
 //#region src/descriptor.ts
-/**
-* Return the byte length of the node at `offset`.
-* Elementary nodes occupy exactly one byte; composite nodes encode their
-* length in the lower 12 bits of the 24-bit meta field.
-*/
 function nodeLength(desc, offset) {
 	if (desc[offset] < TypeCode.STATIC_ARRAY) return DescriptorFormat.TYPECODE_SIZE;
 	return readU24(desc, offset + 1) & DescriptorFormat.META_NODE_LENGTH_MASK;
 }
-/**
-* Return the byte offset of the `fieldIndex`-th field inside a tuple node.
-* Starts at the first field and skips `fieldIndex` nodes using `nodeLength`.
-*/
 function tupleFieldOffset(desc, tupleOffset, fieldIndex) {
 	let cursor = tupleOffset + DescriptorFormat.TUPLE_HEADER_SIZE;
 	for (let i = 0; i < fieldIndex; i++) cursor += nodeLength(desc, cursor);
 	return cursor;
 }
-/** Return paramCount from header byte 1. */
 function paramCount(desc) {
 	return desc[1];
 }
-/** Return byte offset of the N-th top-level param (0-indexed). */
 function paramOffset(desc, index) {
 	const count = desc[1];
-	if (index >= count) throw new CallciumError("INVALID_PATH", `Param index ${index} out of range (paramCount=${count}).`);
+	if (index >= count) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${index} out of range (paramCount=${count}).`);
 	let cursor = DescriptorFormat.HEADER_SIZE;
 	for (let i = 0; i < index; i++) cursor += nodeLength(desc, cursor);
 	return cursor;
 }
-/**
-* Inspect the type node at a given byte offset.
-* @param desc - Raw descriptor bytes.
-* @param offset - Byte position of the node.
-* @returns typeCode, isDynamic, and staticSize in bytes.
-*/
 function inspect$1(desc, offset) {
 	const typeCode = desc[offset];
 	let staticWords;
@@ -564,35 +513,14 @@ function inspect$1(desc, offset) {
 		staticSize: staticWords * 32
 	};
 }
-/**
-* Resolve the type at a calldata path (array of step indices).
-*
-* The first step selects a top-level param. Each subsequent step descends
-* into the current node: for tuples it selects a field, for arrays it
-* advances to the element descriptor.
-*
-* @param desc - Raw descriptor bytes.
-* @param steps - Path steps, length >= 1.
-* @returns TypeInfo for the node at the resolved path.
-* @throws {CallciumError} On empty steps, out-of-bounds param, or descent into elementary type.
-*/
 function typeAt(desc, steps) {
 	return walkPath(desc, steps).typeInfo;
 }
-/**
-* Resolve the type at the path and the declared length of the static array a
-* quantifier step descends into (zero when the path holds no quantifier step
-* over a static array).
-* @param desc - Raw descriptor bytes.
-* @param steps - Path steps, length >= 1.
-* @returns TypeInfo at the resolved path and the quantified static array length.
-* @throws {CallciumError} On empty steps, out-of-bounds param, or descent into elementary type.
-*/
 function walkPath(desc, steps) {
-	if (steps.length === 0) throw new CallciumError("INVALID_PATH", "Path must have at least one step.");
+	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
 	const paramIndex = steps[0];
 	const count = desc[1];
-	if (paramIndex >= count) throw new CallciumError("INVALID_PATH", `Param index ${paramIndex} out of range (paramCount=${count}).`);
+	if (paramIndex >= count) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${paramIndex} out of range (paramCount=${count}).`);
 	let cursor = paramOffset(desc, paramIndex);
 	let quantifiedStaticLength = 0;
 	for (let stepIndex = 1; stepIndex < steps.length; stepIndex++) {
@@ -600,43 +528,162 @@ function walkPath(desc, steps) {
 		const step = steps[stepIndex];
 		if (typeCode === TypeCode.TUPLE) {
 			const fields = tupleFieldCount(desc, cursor);
-			if (step >= fields) throw new CallciumError("INVALID_PATH", `Tuple field index ${step} out of range (tuple has ${fields} fields).`);
+			if (step >= fields) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fields} fields).`);
 			cursor = tupleFieldOffset(desc, cursor, step);
 		} else if (typeCode === TypeCode.STATIC_ARRAY || typeCode === TypeCode.DYNAMIC_ARRAY) {
-			if (typeCode === TypeCode.STATIC_ARRAY && isQuantifier(step)) quantifiedStaticLength = staticArrayLength(desc, cursor);
+			if (typeCode === TypeCode.STATIC_ARRAY) if (isQuantifier(step)) quantifiedStaticLength = staticArrayLength(desc, cursor);
+			else {
+				const length = staticArrayLength(desc, cursor);
+				if (step >= length) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (length=${length}).`);
+			}
 			cursor = arrayElementOffset(cursor);
-		} else throw new CallciumError("INVALID_PATH", `Cannot descend into elementary type at offset ${cursor}.`);
+		} else throw new CallciumError("NOT_COMPOSITE", `Cannot descend into elementary type at offset ${cursor}.`);
 	}
 	return {
 		typeInfo: inspect$1(desc, cursor),
 		quantifiedStaticLength
 	};
 }
-/**
-* Return tuple field count at a tuple node offset.
-* @param desc - Raw descriptor bytes.
-* @param offset - Byte position of the tuple node.
-*/
 function tupleFieldCount(desc, offset) {
 	return readU16(desc, offset + 4);
 }
-/**
-* Return static array length at a static array node offset.
-* @param desc - Raw descriptor bytes.
-* @param offset - Byte position of the static array node.
-*/
 function staticArrayLength(desc, offset) {
 	const elemOffset = arrayElementOffset(offset);
 	return readU16(desc, elemOffset + nodeLength(desc, elemOffset));
 }
-/**
-* Return the byte offset of the array element descriptor.
-* @param offset - Byte position of the array node (static or dynamic).
-*/
 function arrayElementOffset(offset) {
 	return offset + DescriptorFormat.ARRAY_HEADER_SIZE;
 }
-/** Inspect and navigate raw descriptor bytes. */
+function uncompilablePath(stepIndex) {
+	return new CallciumError("UNCOMPILABLE_PATH", `Path step ${stepIndex} does not resolve to a hop-chain target.`);
+}
+function headSpan(desc, offset, count) {
+	let span = 0;
+	let nodeOffset = offset;
+	for (let i = 0; i < count; i++) {
+		const node = inspect$1(desc, nodeOffset);
+		span += node.isDynamic ? 32 : node.staticSize;
+		nodeOffset += nodeLength(desc, nodeOffset);
+	}
+	return {
+		span,
+		nodeOffset
+	};
+}
+function arrayMeta(desc, arrayOffset, code) {
+	const element = inspect$1(desc, arrayElementOffset(arrayOffset));
+	let meta = element.isDynamic ? 1 : element.staticSize >> 5;
+	if (element.isDynamic) meta |= PolicyFormat.HINT_META_ELEM_DYNAMIC;
+	if (code === TypeCode.DYNAMIC_ARRAY) meta |= PolicyFormat.HINT_META_DYNAMIC_ARRAY;
+	return {
+		meta,
+		elemIsDynamic: element.isDynamic
+	};
+}
+function enterNode(walk, needed) {
+	if (!needed) return;
+	walk.chain.push([
+		walk.delta,
+		PolicyFormat.HINT_NO_INDEX,
+		0
+	]);
+	walk.delta = 0;
+}
+function walkStep(desc, walk, descOffset, step, stepIndex) {
+	const node = inspect$1(desc, descOffset);
+	if (node.typeCode === TypeCode.TUPLE) {
+		if (step >= tupleFieldCount(desc, descOffset)) throw uncompilablePath(stepIndex);
+		enterNode(walk, node.isDynamic && !walk.entered);
+		const field = headSpan(desc, descOffset + DescriptorFormat.TUPLE_HEADER_SIZE, step);
+		walk.delta += field.span;
+		walk.entered = false;
+		return field.nodeOffset;
+	}
+	if (node.typeCode !== TypeCode.STATIC_ARRAY && node.typeCode !== TypeCode.DYNAMIC_ARRAY) throw uncompilablePath(stepIndex);
+	if (node.typeCode === TypeCode.STATIC_ARRAY && !isQuantifier(step) && step >= staticArrayLength(desc, descOffset)) throw uncompilablePath(stepIndex);
+	const { meta, elemIsDynamic } = arrayMeta(desc, descOffset, node.typeCode);
+	if (isQuantifier(step)) {
+		if (walk.kind !== PolicyFormat.HINT_KIND_NONE) throw uncompilablePath(stepIndex);
+		enterNode(walk, node.isDynamic && !walk.entered);
+		const count = node.typeCode === TypeCode.DYNAMIC_ARRAY ? 0 : staticArrayLength(desc, descOffset);
+		walk.frame = {
+			arrayDelta: walk.delta,
+			count,
+			meta
+		};
+		walk.kind = step === Quantifier.ALL ? PolicyFormat.HINT_KIND_ALL : PolicyFormat.HINT_KIND_ANY;
+		walk.mainHops = walk.chain;
+		walk.chain = [];
+		walk.delta = 0;
+	} else if (node.isDynamic) {
+		enterNode(walk, !walk.entered);
+		walk.chain.push([
+			0,
+			step,
+			meta
+		]);
+		walk.delta = 0;
+	} else walk.delta += step * (meta & PolicyFormat.HINT_META_STRIDE_MASK) * 32;
+	walk.entered = elemIsDynamic;
+	return arrayElementOffset(descOffset);
+}
+function writeHops(out, offset, hops) {
+	for (const [delta, index, meta] of hops) {
+		writeBE32(out, offset, delta);
+		writeBE16(out, offset + PolicyFormat.HINT_HOP_INDEX_OFFSET, index);
+		writeBE16(out, offset + PolicyFormat.HINT_HOP_META_OFFSET, meta);
+		offset += PolicyFormat.HINT_HOP_SIZE;
+	}
+	return offset;
+}
+function encodeHint(walk, targetMeta, typeCode, depth) {
+	let suffixHops = [];
+	if (walk.kind === PolicyFormat.HINT_KIND_NONE) walk.mainHops = walk.chain;
+	else suffixHops = walk.chain;
+	const mainHopCount = walk.mainHops.length;
+	const suffixHopCount = suffixHops.length;
+	if (mainHopCount > PolicyFormat.HINT_HOP_COUNT_MASK || suffixHopCount > PolicyFormat.HINT_HOP_COUNT_MASK) throw uncompilablePath(depth);
+	const quantified = walk.kind !== PolicyFormat.HINT_KIND_NONE;
+	const frameSize = quantified ? PolicyFormat.HINT_FRAME_PREFIX_SIZE + PolicyFormat.HINT_HEADER_SIZE + suffixHopCount * PolicyFormat.HINT_HOP_SIZE : 0;
+	const out = new Uint8Array(PolicyFormat.HINT_HEADER_SIZE + mainHopCount * PolicyFormat.HINT_HOP_SIZE + frameSize + PolicyFormat.HINT_TARGET_SIZE);
+	let offset = 0;
+	out[offset] = walk.kind << PolicyFormat.HINT_KIND_SHIFT | mainHopCount;
+	offset = writeHops(out, offset + PolicyFormat.HINT_HEADER_SIZE, walk.mainHops);
+	if (quantified) {
+		writeBE32(out, offset, walk.frame.arrayDelta);
+		writeBE16(out, offset + PolicyFormat.HINT_FRAME_COUNT_OFFSET, walk.frame.count);
+		writeBE16(out, offset + PolicyFormat.HINT_FRAME_META_OFFSET, walk.frame.meta);
+		out[offset + PolicyFormat.HINT_FRAME_PREFIX_SIZE] = suffixHopCount;
+		offset = writeHops(out, offset + PolicyFormat.HINT_FRAME_PREFIX_SIZE + PolicyFormat.HINT_HEADER_SIZE, suffixHops);
+	}
+	writeBE32(out, offset, walk.delta);
+	writeBE16(out, offset + PolicyFormat.HINT_TARGET_META_OFFSET, targetMeta);
+	out[offset + PolicyFormat.HINT_TARGET_TYPECODE_OFFSET] = typeCode;
+	return out;
+}
+function compileHint(desc, steps) {
+	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
+	const argIndex = steps[0];
+	if (argIndex >= paramCount(desc)) throw uncompilablePath(0);
+	const arg = headSpan(desc, DescriptorFormat.HEADER_SIZE, argIndex);
+	const walk = {
+		chain: [],
+		mainHops: [],
+		delta: arg.span,
+		frame: {
+			arrayDelta: 0,
+			count: 0,
+			meta: 0
+		},
+		kind: PolicyFormat.HINT_KIND_NONE,
+		entered: false
+	};
+	let descOffset = arg.nodeOffset;
+	for (let stepIndex = 1; stepIndex < steps.length; stepIndex++) descOffset = walkStep(desc, walk, descOffset, steps[stepIndex], stepIndex);
+	const target = inspect$1(desc, descOffset);
+	enterNode(walk, target.isDynamic && !walk.entered);
+	return encodeHint(walk, target.typeCode === TypeCode.DYNAMIC_ARRAY ? arrayMeta(desc, descOffset, target.typeCode).meta : 0, target.typeCode, steps.length);
+}
 const Descriptor = {
 	paramCount,
 	paramOffset,
@@ -647,88 +694,47 @@ const Descriptor = {
 	staticArrayLength,
 	nodeLength,
 	arrayElementOffset,
-	walkPath
+	walkPath,
+	compileHint
 };
 //#endregion
 //#region src/type-desc.ts
-/**
-* Extract the staticWords count from a descriptor node.
-*
-* For elementary types (typeCode < STATIC_ARRAY), returns 1 unless the type is
-* BYTES or STRING, which are ABI-dynamic and return 0. For composite types,
-* reads the 24-bit meta field at offset 1 and shifts right by
-* META_STATIC_WORDS_SHIFT.
-*/
 function extractStaticWords(desc) {
 	const typeCode = desc[0];
 	if (typeCode < TypeCode.STATIC_ARRAY) return typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING ? 0 : 1;
 	return readU24(desc, 1) >> DescriptorFormat.META_STATIC_WORDS_SHIFT;
 }
-/** Build a descriptor node for `address`. */
 function address() {
 	return new Uint8Array([TypeCode.ADDRESS]);
 }
-/** Build a descriptor node for `bool`. */
 function bool() {
 	return new Uint8Array([TypeCode.BOOL]);
 }
-/** Build a descriptor node for `function`. */
 function function_() {
 	return new Uint8Array([TypeCode.FUNCTION]);
 }
-/** Build a descriptor node for `uint256`. */
-function uint256() {
-	return new Uint8Array([TypeCode.UINT_MAX]);
-}
-/**
-* Build a descriptor node for `uintN`.
-* @param bits - Bit width, 8–256 in steps of 8.
-* @throws {CallciumError} If bits is out of range or not a multiple of 8.
-*/
 function uintN(bits) {
-	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("INVALID_TYPE_STRING", `Invalid uintN bits: ${bits}. Must be 8–256 in steps of 8.`);
+	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid uintN bits: ${bits}. Must be 8–256 in steps of 8.`);
 	return new Uint8Array([TypeCode.UINT_MIN + (bits / 8 - 1)]);
 }
-/**
-* Build a descriptor node for `intN`.
-* @param bits - Bit width, 8–256 in steps of 8.
-* @throws {CallciumError} If bits is out of range or not a multiple of 8.
-*/
 function intN(bits) {
-	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("INVALID_TYPE_STRING", `Invalid intN bits: ${bits}. Must be 8–256 in steps of 8.`);
+	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid intN bits: ${bits}. Must be 8–256 in steps of 8.`);
 	return new Uint8Array([TypeCode.INT_MIN + (bits / 8 - 1)]);
 }
-/** Build a descriptor node for `bytes` (dynamic). */
 function bytes() {
 	return new Uint8Array([TypeCode.BYTES]);
 }
-/** Build a descriptor node for `string`. */
 function string_() {
 	return new Uint8Array([TypeCode.STRING]);
 }
-/**
-* Build a descriptor node for `bytesN`.
-* @param n - Byte width, 1–32.
-* @throws {CallciumError} If n is out of range.
-*/
 function bytesN(n) {
-	if (n < 1 || n > 32) throw new CallciumError("INVALID_TYPE_STRING", `Invalid bytesN size: ${n}. Must be 1–32.`);
+	if (n < 1 || n > 32) throw new CallciumError("UNKNOWN_TYPE", `Invalid bytesN size: ${n}. Must be 1–32.`);
 	return new Uint8Array([TypeCode.FIXED_BYTES_MIN + (n - 1)]);
 }
-/**
-* Build a descriptor node for a dynamic array `T[]` or static array `T[length]`.
-*
-* Dynamic form: `[0x81][meta:3][elemDesc]`
-* Static form:  `[0x80][meta:3][elemDesc][length:be16]`
-*
-* @param elemDesc - Descriptor bytes for the element type.
-* @param length - Fixed array length. When omitted, produces a dynamic array.
-* @throws {CallciumError} If length is 0 or exceeds MAX_STATIC_ARRAY_LENGTH.
-*/
 function array(elemDesc, length) {
 	if (length === void 0) {
 		const nodeLength = DescriptorFormat.ARRAY_HEADER_SIZE + elemDesc.length;
-		if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("DESCRIPTOR_TOO_LARGE", `Dynamic array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+		if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Dynamic array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
 		const meta24 = 0 << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 		const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + elemDesc.length);
 		buf[0] = TypeCode.DYNAMIC_ARRAY;
@@ -738,10 +744,10 @@ function array(elemDesc, length) {
 	}
 	if (length <= 0 || length > DescriptorFormat.MAX_STATIC_ARRAY_LENGTH) throw new CallciumError("INVALID_ARRAY_LENGTH", `Static array length ${length} out of range. Must be 1–${DescriptorFormat.MAX_STATIC_ARRAY_LENGTH}.`);
 	const nodeLength = DescriptorFormat.ARRAY_HEADER_SIZE + elemDesc.length + DescriptorFormat.ARRAY_LENGTH_SIZE;
-	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("DESCRIPTOR_TOO_LARGE", `Static array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Static array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
 	const elemStaticWords = extractStaticWords(elemDesc);
 	const staticWords = elemStaticWords === 0 ? 0 : length * elemStaticWords;
-	if (staticWords > DescriptorFormat.META_NODE_LENGTH_MASK) throw new CallciumError("DESCRIPTOR_TOO_LARGE", `Static array static words ${staticWords} exceeds 12-bit maximum ${DescriptorFormat.META_NODE_LENGTH_MASK}.`);
+	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Static array static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}.`);
 	const meta24 = staticWords << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 	const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + elemDesc.length + DescriptorFormat.ARRAY_LENGTH_SIZE);
 	buf[0] = TypeCode.STATIC_ARRAY;
@@ -750,19 +756,11 @@ function array(elemDesc, length) {
 	writeBE16(buf, 4 + elemDesc.length, length);
 	return buf;
 }
-/**
-* Build a descriptor node for a tuple.
-*
-* Format: `[0x90][meta:3][fieldCount:be16][field0][field1]...`
-*
-* @param fieldDescs - Descriptor bytes for each field, in order.
-* @throws {CallciumError} If fieldDescs is empty, exceeds MAX_TUPLE_FIELDS, or nodeLength overflows MAX_NODE_LENGTH.
-*/
 function tuple(fieldDescs) {
 	if (fieldDescs.length === 0 || fieldDescs.length > DescriptorFormat.MAX_TUPLE_FIELDS) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", `Tuple field count ${fieldDescs.length} out of range. Must be 1–${DescriptorFormat.MAX_TUPLE_FIELDS}.`);
 	const totalFieldBytes = fieldDescs.reduce((sum, f) => sum + f.length, 0);
 	const nodeLength = DescriptorFormat.TUPLE_HEADER_SIZE + totalFieldBytes;
-	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", `Tuple node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Tuple node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
 	let anyDynamic = false;
 	let staticWordsSum = 0;
 	for (const field of fieldDescs) {
@@ -771,7 +769,7 @@ function tuple(fieldDescs) {
 		staticWordsSum += staticWords;
 	}
 	const staticWords = anyDynamic ? 0 : staticWordsSum;
-	if (staticWords > DescriptorFormat.META_NODE_LENGTH_MASK) throw new CallciumError("DESCRIPTOR_TOO_LARGE", `Tuple static words ${staticWords} exceeds 12-bit maximum ${DescriptorFormat.META_NODE_LENGTH_MASK}.`);
+	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Tuple static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}.`);
 	const meta24 = staticWords << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 	const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + DescriptorFormat.TUPLE_FIELDCOUNT_SIZE + totalFieldBytes);
 	buf[0] = TypeCode.TUPLE;
@@ -786,10 +784,6 @@ function tuple(fieldDescs) {
 }
 //#endregion
 //#region src/descriptor-coder.ts
-/**
-* Collect the positions of depth-0 commas in input[start..end).
-* Commas inside `()` or `[]` are skipped.
-*/
 function commaPositions(input, start, end) {
 	const positions = [];
 	let depth = 0;
@@ -801,26 +795,21 @@ function commaPositions(input, start, end) {
 	}
 	return positions;
 }
-/**
-* Parse a decimal integer from input[start..end).
-* Returns -1 if the substring is empty or contains non-digit characters.
-*/
+const MAX_TYPE_STRING_NUMBER = 256 ** DescriptorFormat.ARRAY_LENGTH_SIZE - 1;
 function parseUint(input, start, end) {
-	if (start >= end) return -1;
+	if (start >= end) throw new CallciumError("MALFORMED_TYPE_STRING", `Missing number at position ${start}`);
+	if (end - start > 1 && input.charCodeAt(start) === 48) throw new CallciumError("MALFORMED_TYPE_STRING", `Zero-padded number at position ${start}`);
 	let value = 0;
 	for (let i = start; i < end; i++) {
 		const code = input.charCodeAt(i);
-		if (code < 48 || code > 57) return -1;
+		if (code < 48 || code > 57) throw new CallciumError("MALFORMED_TYPE_STRING", `Non-digit character at position ${i}`);
 		value = value * 10 + (code - 48);
 	}
+	if (value > MAX_TYPE_STRING_NUMBER) throw new CallciumError("MALFORMED_TYPE_STRING", `Number at position ${start} is too wide`);
 	return value;
 }
-/**
-* Parse a tuple literal `(field0,field1,...)` where the opening `(` is at
-* `start` and the substring to parse ends before `end`.
-*/
 function parseTuple(input, start, end) {
-	if (input[start] !== "(") throw new CallciumError("INVALID_TYPE_STRING", `Expected '(' at position ${start}`);
+	if (input[start] !== "(") throw new CallciumError("MALFORMED_TYPE_STRING", `Expected '(' at position ${start}`);
 	let depth = 0;
 	let closePos = -1;
 	for (let i = start; i < end; i++) if (input[i] === "(") depth++;
@@ -831,7 +820,8 @@ function parseTuple(input, start, end) {
 			break;
 		}
 	}
-	if (closePos === -1) throw new CallciumError("INVALID_TYPE_STRING", `Unmatched '(' at position ${start}`);
+	if (closePos === -1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '(' at position ${start}`);
+	if (closePos !== end - 1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unexpected characters after ')' at position ${closePos + 1}`);
 	const innerStart = start + 1;
 	const innerEnd = closePos;
 	const commas = commaPositions(input, innerStart, innerEnd);
@@ -842,10 +832,9 @@ function parseTuple(input, start, end) {
 		segStart = comma + 1;
 	}
 	segments.push([segStart, innerEnd]);
-	if (segments.length === 1 && segments[0][0] === segments[0][1]) throw new CallciumError("INVALID_TYPE_STRING", "Empty tuple is not allowed");
+	if (segments.length === 1 && segments[0][0] === segments[0][1]) return tuple([]);
 	return tuple(segments.map(([fieldStart, fieldEnd]) => parseType(input, fieldStart, fieldEnd)));
 }
-/** Parse the base type (no array suffixes) from input[start..end). */
 function parseBaseType(input, start, end) {
 	const segment = input.slice(start, end);
 	if (segment === "address") return address();
@@ -853,63 +842,31 @@ function parseBaseType(input, start, end) {
 	if (segment === "function") return function_();
 	if (segment === "bytes") return bytes();
 	if (segment === "string") return string_();
-	if (segment === "uint256") return uint256();
-	if (segment === "int256") return intN(256);
 	if (segment.startsWith("(")) return parseTuple(input, start, end);
-	if (segment.startsWith("uint")) {
-		const bits = parseUint(input, start + 4, end);
-		if (bits === -1) throw new CallciumError("UNKNOWN_TYPE", `Unrecognised type '${segment}'`);
-		return uintN(bits);
-	}
-	if (segment.startsWith("int")) {
-		const bits = parseUint(input, start + 3, end);
-		if (bits === -1) throw new CallciumError("UNKNOWN_TYPE", `Unrecognised type '${segment}'`);
-		return intN(bits);
-	}
-	if (segment.startsWith("bytes")) {
-		const n = parseUint(input, start + 5, end);
-		if (n === -1) throw new CallciumError("UNKNOWN_TYPE", `Unrecognised type '${segment}'`);
-		return bytesN(n);
-	}
+	if (segment.startsWith("uint")) return uintN(parseUint(input, start + 4, end));
+	if (segment.startsWith("int")) return intN(parseUint(input, start + 3, end));
+	if (segment.startsWith("bytes")) return bytesN(parseUint(input, start + 5, end));
 	throw new CallciumError("UNKNOWN_TYPE", `Unrecognised type '${segment}'`);
 }
-/**
-* Parse a type segment from input[start..end).
-*
-* Scans backward from end to collect all `[...]` suffixes, identifies the
-* base type extent, parses the base, then applies suffixes left-to-right.
-*/
 function parseType(input, start, end) {
-	if (start >= end) throw new CallciumError("INVALID_TYPE_STRING", "Empty type segment");
+	if (start >= end) throw new CallciumError("MALFORMED_TYPE_STRING", "Empty type segment");
 	const suffixes = [];
 	let baseEnd = end;
 	while (baseEnd > start && input[baseEnd - 1] === "]") {
 		const closePos = baseEnd - 1;
 		let openPos = closePos - 1;
 		while (openPos > start && input[openPos] !== "[") openPos--;
-		if (input[openPos] !== "[") throw new CallciumError("INVALID_TYPE_STRING", `Unmatched ']' at position ${closePos}`);
+		if (input[openPos] !== "[") throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched ']' at position ${closePos}`);
 		const innerStart = openPos + 1;
 		const innerEnd = closePos;
-		if (innerStart === innerEnd) suffixes.unshift(void 0);
-		else {
-			const length = parseUint(input, innerStart, innerEnd);
-			if (length === -1) throw new CallciumError("INVALID_TYPE_STRING", `Invalid array length at position ${innerStart}`);
-			suffixes.unshift(length);
-		}
+		suffixes.unshift(innerStart === innerEnd ? void 0 : parseUint(input, innerStart, innerEnd));
 		baseEnd = openPos;
 	}
+	if (input[start] !== "(" && input.slice(start, baseEnd).includes("[")) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '[' in '${input.slice(start, baseEnd)}'`);
 	let desc = parseBaseType(input, start, baseEnd);
 	for (const length of suffixes) desc = array(desc, length);
 	return desc;
 }
-/**
-* Encode a comma-separated list of ABI type strings into a binary descriptor.
-*
-* @param typesCsv - Comma-separated ABI type strings, e.g. `"address,uint256,(bool,bytes32)[],string"`.
-* @returns Binary descriptor bytes starting with the version+paramCount header.
-* @throws {CallciumError} With code `INVALID_TYPE_STRING` for malformed input.
-* @throws {CallciumError} With code `UNKNOWN_TYPE` for unrecognised type names.
-*/
 function fromTypes(typesCsv) {
 	if (typesCsv === "") return new Uint8Array([DescriptorFormat.VERSION, 0]);
 	const commas = commaPositions(typesCsv, 0, typesCsv.length);
@@ -921,7 +878,7 @@ function fromTypes(typesCsv) {
 	}
 	segments.push([segStart, typesCsv.length]);
 	const paramDescs = segments.map(([start, end]) => parseType(typesCsv, start, end));
-	if (paramDescs.length > DescriptorFormat.MAX_PARAMS) throw new CallciumError("DESCRIPTOR_TOO_LARGE", `Parameter count ${paramDescs.length} exceeds maximum ${DescriptorFormat.MAX_PARAMS}.`);
+	if (paramDescs.length > DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Parameter count ${paramDescs.length} exceeds maximum ${DescriptorFormat.MAX_PARAMS}.`);
 	const totalBytes = paramDescs.reduce((sum, d) => sum + d.length, 0);
 	const result = new Uint8Array(DescriptorFormat.HEADER_SIZE + totalBytes);
 	result[0] = DescriptorFormat.VERSION;
@@ -933,7 +890,6 @@ function fromTypes(typesCsv) {
 	}
 	return result;
 }
-/** Reconstruct a Solidity type string from a descriptor node at the given offset. */
 function nodeToTypeString(desc, offset) {
 	const typeCode = desc[offset];
 	if (typeCode === TypeCode.TUPLE) {
@@ -953,15 +909,6 @@ function nodeToTypeString(desc, offset) {
 	if (typeCode === TypeCode.DYNAMIC_ARRAY) return `${nodeToTypeString(desc, Descriptor.arrayElementOffset(offset))}[]`;
 	return lookupTypeCode(typeCode).label;
 }
-/**
-* Reconstruct a comma-separated list of ABI type strings from a binary descriptor.
-*
-* Inverse of `fromTypes`: `toTypes(fromTypes(s))` returns `s` for any valid input.
-*
-* @param desc - Binary descriptor bytes (with version+paramCount header).
-* @returns Comma-separated ABI type strings, e.g. `"address,uint256,(bool,bytes32)[]"`.
-* @throws {CallciumError} If the descriptor is malformed.
-*/
 function toTypes(desc) {
 	const count = Descriptor.paramCount(desc);
 	const types = [];
@@ -972,23 +919,15 @@ function toTypes(desc) {
 	}
 	return types.join(",");
 }
-/** Recursively parse a single descriptor node starting at offset. */
 function parseNode(data, offset, depth) {
 	if (offset >= data.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end of descriptor", offset);
 	const code = data[offset];
 	const info = classifyTypeCode(code);
 	const metaOffset = offset + DescriptorFormat.TYPECODE_SIZE;
 	if (info.typeClass === "elementary") return {
-		node: {
-			type: "elementary",
-			typeCode: code,
-			isDynamic: info.isDynamic,
-			staticSize: info.isDynamic ? 0 : 32,
-			span: {
-				start: offset,
-				end: metaOffset
-			}
-		},
+		typeCode: code,
+		isDynamic: info.isDynamic,
+		staticSize: info.isDynamic ? 0 : 32,
 		next: metaOffset
 	};
 	if (depth > DescriptorFormat.MAX_NESTING_DEPTH) throw new CallciumError("NESTING_TOO_DEEP", `Composite nesting exceeds maximum depth ${DescriptorFormat.MAX_NESTING_DEPTH}`, offset);
@@ -998,7 +937,7 @@ function parseNode(data, offset, depth) {
 	const staticWords = meta >> DescriptorFormat.META_STATIC_WORDS_SHIFT;
 	const nodeLength = meta & DescriptorFormat.META_NODE_LENGTH_MASK;
 	const minHeader = info.typeClass === "tuple" ? DescriptorFormat.TUPLE_HEADER_SIZE : DescriptorFormat.ARRAY_HEADER_SIZE;
-	if (nodeLength < minHeader) throw new CallciumError("MALFORMED_HEADER", `Composite node length ${nodeLength} is smaller than minimum header ${minHeader}`, offset);
+	if (nodeLength < minHeader) throw new CallciumError("NODE_LENGTH_TOO_SMALL", `Composite node length ${nodeLength} is smaller than minimum header ${minHeader}`, offset);
 	if (offset + nodeLength > data.length) throw new CallciumError("NODE_OVERFLOW", "Composite node extends beyond descriptor", offset);
 	const isDynamic = staticWords === 0;
 	const staticSize = isDynamic ? 0 : staticWords * 32;
@@ -1009,89 +948,54 @@ function parseNode(data, offset, depth) {
 		const fieldCount = readU16(data, fieldCountOffset);
 		if (fieldCount === 0) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", "Tuple must have at least one field", offset);
 		if (fieldCount > DescriptorFormat.MAX_TUPLE_FIELDS) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", `Tuple field count ${fieldCount} exceeds maximum ${DescriptorFormat.MAX_TUPLE_FIELDS}`, offset);
-		const fields = [];
 		let cursor = offset + DescriptorFormat.TUPLE_HEADER_SIZE;
-		for (let i = 0; i < fieldCount; i++) {
-			const result = parseNode(data, cursor, depth + 1);
-			fields.push(result.node);
-			cursor = result.next;
-		}
+		for (let i = 0; i < fieldCount; i++) cursor = parseNode(data, cursor, depth + 1).next;
 		return {
-			node: {
-				type: "tuple",
-				typeCode: code,
-				isDynamic,
-				staticSize,
-				fields,
-				span: {
-					start: offset,
-					end: nodeEnd
-				}
-			},
+			typeCode: code,
+			isDynamic,
+			staticSize,
 			next: nodeEnd
 		};
 	}
 	if (info.typeClass === "staticArray") {
-		const elemResult = parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1);
-		const lengthOffset = elemResult.next;
+		const lengthOffset = parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1).next;
 		if (lengthOffset + DescriptorFormat.ARRAY_LENGTH_SIZE > data.length) throw new CallciumError("UNEXPECTED_END", "Missing static array length suffix", offset);
 		const length = readU16(data, lengthOffset);
 		if (length === 0) throw new CallciumError("INVALID_ARRAY_LENGTH", "Static array length must be greater than zero", offset);
 		if (length > DescriptorFormat.MAX_STATIC_ARRAY_LENGTH) throw new CallciumError("INVALID_ARRAY_LENGTH", `Static array length ${length} exceeds maximum ${DescriptorFormat.MAX_STATIC_ARRAY_LENGTH}`, offset);
 		return {
-			node: {
-				type: "staticArray",
-				typeCode: code,
-				isDynamic,
-				staticSize,
-				element: elemResult.node,
-				length,
-				span: {
-					start: offset,
-					end: nodeEnd
-				}
-			},
+			typeCode: code,
+			isDynamic,
+			staticSize,
 			next: nodeEnd
 		};
 	}
+	parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1);
 	return {
-		node: {
-			type: "dynamicArray",
-			typeCode: code,
-			isDynamic: true,
-			staticSize: 0,
-			element: parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1).node,
-			span: {
-				start: offset,
-				end: nodeEnd
-			}
-		},
+		typeCode: code,
+		isDynamic: true,
+		staticSize: 0,
 		next: nodeEnd
 	};
 }
-/** Convert a zero-based param index to a BE16 hex path step. */
 function indexToPath(index) {
 	return `0x${index.toString(16).padStart(4, "0")}`;
 }
-/** Decode a binary descriptor blob, returning the structural representation and AST. */
 function decodeDescriptor(data) {
 	if (data.length < 1) throw new CallciumError("MALFORMED_HEADER", "Descriptor is empty");
 	const version = data[0];
 	if (version !== DescriptorFormat.VERSION) throw new CallciumError("UNSUPPORTED_VERSION", `Version ${version} is not supported (expected ${DescriptorFormat.VERSION})`);
 	if (data.length < DescriptorFormat.HEADER_SIZE) throw new CallciumError("MALFORMED_HEADER", "Descriptor too short for header");
-	const declaredCount = data[1];
 	const params = [];
-	const tree = [];
 	let cursor = DescriptorFormat.HEADER_SIZE;
 	while (cursor < data.length) {
-		if (params.length >= DescriptorFormat.MAX_PARAMS) throw new CallciumError("PARAM_COUNT_MISMATCH", `Descriptor exceeds the maximum of ${DescriptorFormat.MAX_PARAMS} top-level params`);
-		const { node, next } = parseNode(data, cursor, 1);
-		tree.push(node);
+		if (params.length >= DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Descriptor exceeds the maximum of ${DescriptorFormat.MAX_PARAMS} top-level params`);
+		const { typeCode, isDynamic, staticSize, next } = parseNode(data, cursor, 1);
 		params.push({
 			index: params.length,
-			typeCode: node.typeCode,
-			isDynamic: node.isDynamic,
-			staticSize: node.staticSize,
+			typeCode,
+			isDynamic,
+			staticSize,
 			path: indexToPath(params.length),
 			span: {
 				start: cursor,
@@ -1100,34 +1004,146 @@ function decodeDescriptor(data) {
 		});
 		cursor = next;
 	}
+	const declaredCount = data[1];
 	if (params.length !== declaredCount) throw new CallciumError("PARAM_COUNT_MISMATCH", `Header declares ${declaredCount} params but ${params.length} were parsed`);
-	return {
-		descriptor: {
-			version,
-			params
-		},
-		tree
-	};
+	return { descriptor: {
+		version,
+		params
+	} };
 }
-/** Encode and decode descriptors. */
 const DescriptorCoder = {
 	fromTypes,
 	toTypes
 };
 //#endregion
+//#region src/operators.ts
+function toBigInt(bytes, offset = 0) {
+	const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 32);
+	return view.getBigUint64(0, false) << 192n | view.getBigUint64(8, false) << 128n | view.getBigUint64(16, false) << 64n | view.getBigUint64(24, false);
+}
+function isSigned(typeCode) {
+	return typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
+}
+function isLeftAligned(typeCode) {
+	return typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX || typeCode === TypeCode.FUNCTION;
+}
+function canonicalize(value, typeCode) {
+	if (typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX) {
+		const bits = BigInt(typeCode * 8);
+		return bits === 256n ? value : value & (1n << bits) - 1n;
+	}
+	if (typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX) {
+		const bits = (typeCode - TypeCode.INT_MIN + 1) * 8;
+		return bits === 256 ? value : BigInt.asUintN(256, BigInt.asIntN(bits, value));
+	}
+	if (typeCode === TypeCode.ADDRESS) return value & (1n << 160n) - 1n;
+	if (typeCode === TypeCode.BOOL) return value & 1n;
+	if (typeCode === TypeCode.FUNCTION) return value >> 64n << 64n;
+	if (typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX) {
+		const n = typeCode - TypeCode.FIXED_BYTES_MIN + 1;
+		if (n === 32) return value;
+		const padBits = BigInt((32 - n) * 8);
+		return value >> padBits << padBits;
+	}
+	return value;
+}
+function isLengthOp(opCode) {
+	const base = opCode & ~Op.NOT;
+	return base >= Op.LENGTH_EQ && base <= Op.LENGTH_BETWEEN;
+}
+function lengthToValueOp(base) {
+	if (base === Op.LENGTH_EQ) return Op.EQ;
+	if (base === Op.LENGTH_GT) return Op.GT;
+	if (base === Op.LENGTH_LT) return Op.LT;
+	if (base === Op.LENGTH_GTE) return Op.GTE;
+	if (base === Op.LENGTH_LTE) return Op.LTE;
+	return Op.BETWEEN;
+}
+function isLengthValidType(typeCode) {
+	return typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING || typeCode === TypeCode.DYNAMIC_ARRAY;
+}
+function compareTyped(a, b, typeCode) {
+	if (isSigned(typeCode)) {
+		const sa = BigInt.asIntN(256, a);
+		const sb = BigInt.asIntN(256, b);
+		return sa < sb ? -1 : sa > sb ? 1 : 0;
+	}
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function isIn(value, data) {
+	const count = data.length / 32;
+	let lo = 0;
+	let hi = count - 1;
+	while (lo <= hi) {
+		const mid = lo + hi >>> 1;
+		const elem = toBigInt(data, mid * 32);
+		if (value === elem) return true;
+		if (value < elem) hi = mid - 1;
+		else lo = mid + 1;
+	}
+	return false;
+}
+function applyOperator(opCode, value, valueLength, operandData, typeCode) {
+	let base = opCode & ~Op.NOT;
+	if (isLengthOp(base)) {
+		value = BigInt(valueLength);
+		typeCode = TypeCode.UINT_MAX;
+		base = lengthToValueOp(base);
+	}
+	let result;
+	switch (base) {
+		case Op.EQ:
+			result = value === toBigInt(operandData, 0);
+			break;
+		case Op.GT:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) > 0;
+			break;
+		case Op.LT:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) < 0;
+			break;
+		case Op.GTE:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) >= 0;
+			break;
+		case Op.LTE:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) <= 0;
+			break;
+		case Op.BETWEEN: {
+			const min = toBigInt(operandData, 0);
+			const max = toBigInt(operandData, 32);
+			result = compareTyped(value, min, typeCode) >= 0 && compareTyped(value, max, typeCode) <= 0;
+			break;
+		}
+		case Op.IN:
+			result = isIn(value, operandData);
+			break;
+		case Op.BITMASK_ALL: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) === mask;
+			break;
+		}
+		case Op.BITMASK_ANY: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) !== 0n;
+			break;
+		}
+		case Op.BITMASK_NONE: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) === 0n;
+			break;
+		}
+		default: throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}.`);
+	}
+	return (opCode & Op.NOT) !== 0 ? !result : result;
+}
+//#endregion
 //#region src/policy-coder.ts
-/**
-* Parse a BE16-encoded hex path into an array of step values.
-* @param path - 0x-prefixed hex string containing BE16-encoded path steps.
-* @returns Array of numeric step values.
-*/
 function parsePathSteps(path) {
-	const body = path.slice(2);
+	const bytes = hexToBytes(path);
+	if (bytes.length % PolicyFormat.PATH_STEP_SIZE !== 0) throw new CallciumError("MALFORMED_PATH", `Path byte length ${bytes.length} is not a whole number of steps`);
 	const steps = [];
-	for (let i = 0; i < body.length; i += 4) steps.push(parseInt(body.slice(i, i + 4), 16));
+	for (let offset = 0; offset < bytes.length; offset += PolicyFormat.PATH_STEP_SIZE) steps.push(readU16(bytes, offset));
 	return steps;
 }
-/** Wrap a value with its byte span for positional tracking. */
 function field(value, start, end) {
 	return {
 		value,
@@ -1137,7 +1153,60 @@ function field(value, start, end) {
 		}
 	};
 }
-/** Decode a policy blob, returning the structural representation and descriptor AST. */
+function resolveHintSize(data, hintStart, ruleEnd, ruleOffset) {
+	const overrun = () => {
+		throw new CallciumError("RULE_FIELD_OUT_OF_BOUNDS", "Rule is too small to hold a hint block", ruleOffset);
+	};
+	if (hintStart + PolicyFormat.HINT_HEADER_SIZE > ruleEnd) overrun();
+	const header = data[hintStart];
+	const hopsEnd = hintStart + PolicyFormat.HINT_HEADER_SIZE + (header & PolicyFormat.HINT_HOP_COUNT_MASK) * PolicyFormat.HINT_HOP_SIZE;
+	let hintSize = hopsEnd - hintStart + PolicyFormat.HINT_TARGET_SIZE;
+	if (header >> PolicyFormat.HINT_KIND_SHIFT !== PolicyFormat.HINT_KIND_NONE) {
+		const suffixHeaderOffset = hopsEnd + PolicyFormat.HINT_FRAME_PREFIX_SIZE;
+		if (suffixHeaderOffset >= ruleEnd) overrun();
+		const suffixHeader = data[suffixHeaderOffset];
+		hintSize += PolicyFormat.HINT_FRAME_PREFIX_SIZE + PolicyFormat.HINT_HEADER_SIZE + (suffixHeader & PolicyFormat.HINT_HOP_COUNT_MASK) * PolicyFormat.HINT_HOP_SIZE;
+	}
+	if (hintStart + hintSize > ruleEnd) overrun();
+	return hintSize;
+}
+function malformedHint(detail, ruleOffset) {
+	throw new CallciumError("MALFORMED_HINT", detail, ruleOffset);
+}
+function validateHops(data, start, end, ruleOffset) {
+	for (let offset = start; offset < end; offset += PolicyFormat.HINT_HOP_SIZE) {
+		const index = readU16(data, offset + PolicyFormat.HINT_HOP_INDEX_OFFSET);
+		if (index === PolicyFormat.HINT_INDEX_RESERVED) malformedHint("Hop index is a reserved value", ruleOffset);
+		const meta = readU16(data, offset + PolicyFormat.HINT_HOP_META_OFFSET);
+		if (index === PolicyFormat.HINT_NO_INDEX) {
+			if (meta !== 0) malformedHint("Plain hop carries a meta word", ruleOffset);
+		} else {
+			if (readU32(data, offset) !== 0) malformedHint("Element hop carries a delta", ruleOffset);
+			if ((meta & PolicyFormat.HINT_META_RESERVED_MASK) !== 0) malformedHint("Hop meta carries reserved bits", ruleOffset);
+		}
+	}
+}
+function validateHint(data, hintStart, hintSize, ruleOffset) {
+	const header = data[hintStart];
+	const kind = header >> PolicyFormat.HINT_KIND_SHIFT;
+	if (kind > PolicyFormat.HINT_KIND_MAX) malformedHint("Header kind is a reserved value", ruleOffset);
+	const hopsStart = hintStart + PolicyFormat.HINT_HEADER_SIZE;
+	const hopsEnd = hopsStart + (header & PolicyFormat.HINT_HOP_COUNT_MASK) * PolicyFormat.HINT_HOP_SIZE;
+	validateHops(data, hopsStart, hopsEnd, ruleOffset);
+	const targetOffset = hintStart + hintSize - PolicyFormat.HINT_TARGET_SIZE;
+	if (kind !== PolicyFormat.HINT_KIND_NONE) {
+		if ((readU16(data, hopsEnd + PolicyFormat.HINT_FRAME_META_OFFSET) & PolicyFormat.HINT_META_RESERVED_MASK) !== 0) malformedHint("Frame meta carries reserved bits", ruleOffset);
+		if ((data[hopsEnd + PolicyFormat.HINT_FRAME_PREFIX_SIZE] & PolicyFormat.HINT_SUFFIX_RESERVED_MASK) !== 0) malformedHint("Suffix header carries reserved bits", ruleOffset);
+		validateHops(data, hopsEnd + PolicyFormat.HINT_FRAME_PREFIX_SIZE + PolicyFormat.HINT_HEADER_SIZE, targetOffset, ruleOffset);
+	}
+	const targetMeta = readU16(data, targetOffset + PolicyFormat.HINT_TARGET_META_OFFSET);
+	const targetTypeCode = data[targetOffset + PolicyFormat.HINT_TARGET_TYPECODE_OFFSET];
+	if (!(targetTypeCode === TypeCode.DYNAMIC_ARRAY ? (targetMeta & PolicyFormat.HINT_META_RESERVED_MASK) === 0 : targetMeta === 0)) malformedHint("Target meta carries reserved or unused state", ruleOffset);
+	if (!isAddressableTarget(targetTypeCode)) malformedHint("Target type code addresses no value", ruleOffset);
+}
+function hintTargetTypeCode(data, hintStart, hintSize) {
+	return data[hintStart + hintSize - PolicyFormat.HINT_TARGET_SIZE + PolicyFormat.HINT_TARGET_TYPECODE_OFFSET];
+}
 function decodePolicy(blob) {
 	const data = hexToBytes(blob);
 	if (data.length < PolicyFormat.DESC_OFFSET + 1) throw new CallciumError("MALFORMED_HEADER", "Policy blob is too short");
@@ -1145,10 +1214,10 @@ function decodePolicy(blob) {
 	const version = headerByte & PolicyFormat.VERSION_MASK;
 	if (version !== PolicyFormat.VERSION) throw new CallciumError("UNSUPPORTED_VERSION", `Version ${version} is not supported (expected ${PolicyFormat.VERSION})`);
 	if ((headerByte & PolicyFormat.RESERVED_MASK) !== 0) throw new CallciumError("MALFORMED_HEADER", "Reserved header bits must be zero");
-	const isSelectorless = (headerByte & PolicyFormat.FLAG_NO_SELECTOR) !== 0;
 	const selectorStart = PolicyFormat.SELECTOR_OFFSET;
 	const selectorEnd = selectorStart + PolicyFormat.SELECTOR_SIZE;
 	const selectorHex = toHex(data, selectorStart, selectorEnd);
+	const isSelectorless = (headerByte & PolicyFormat.FLAG_NO_SELECTOR) !== 0;
 	if (isSelectorless && selectorHex !== "0x00000000") throw new CallciumError("MALFORMED_HEADER", "Selectorless policy must have a zeroed selector slot");
 	const descLengthStart = PolicyFormat.DESC_LENGTH_OFFSET;
 	const descLengthValue = readU16(data, descLengthStart);
@@ -1157,7 +1226,7 @@ function decodePolicy(blob) {
 	const descEnd = descStart + descLengthValue;
 	const groupCountOffset = descEnd;
 	if (data.length < groupCountOffset + PolicyFormat.GROUP_COUNT_SIZE) throw new CallciumError("MALFORMED_HEADER", "Policy blob is too short for descriptor and group count");
-	const { descriptor: desc, tree } = decodeDescriptor(data.subarray(descStart, descEnd));
+	const { descriptor: desc } = decodeDescriptor(data.subarray(descStart, descEnd));
 	const params = desc.params.map((param) => ({
 		...param,
 		span: {
@@ -1174,55 +1243,66 @@ function decodePolicy(blob) {
 	const groups = [];
 	for (let groupIndex = 0; groupIndex < groupCountValue; groupIndex++) {
 		if (offset + PolicyFormat.GROUP_HEADER_SIZE > data.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end while reading group header", offset);
-		const ruleCountStart = offset;
-		const ruleCountValue = readU16(data, ruleCountStart);
 		const groupSizeStart = offset + PolicyFormat.GROUP_RULECOUNT_SIZE;
 		const groupSizeValue = readU32(data, groupSizeStart);
 		const groupBodyStart = offset + PolicyFormat.GROUP_HEADER_SIZE;
 		const groupEnd = groupBodyStart + groupSizeValue;
+		const ruleCountStart = offset;
+		const ruleCountValue = readU16(data, ruleCountStart);
 		if (ruleCountValue === 0) throw new CallciumError("EMPTY_GROUP", "Group must contain at least one rule", offset);
-		if (groupSizeValue < ruleCountValue * PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("GROUP_SIZE_MISMATCH", "Declared group size is too small for its rule count", offset);
+		if (groupSizeValue < ruleCountValue * PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("GROUP_TOO_SMALL", "Declared group size is too small for its rule count", offset);
 		if (groupEnd > data.length) throw new CallciumError("GROUP_OVERFLOW", "Group extends beyond policy blob", offset);
 		const rules = [];
 		let ruleOffset = groupBodyStart;
 		for (let ruleIndex = 0; ruleIndex < ruleCountValue; ruleIndex++) {
 			if (ruleOffset + PolicyFormat.RULE_SIZE_SIZE > data.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end while reading rule size", ruleOffset);
 			const ruleSizeValue = readU16(data, ruleOffset);
-			if (ruleSizeValue < PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("RULE_SIZE_MISMATCH", `Rule size ${ruleSizeValue} is below minimum ${PolicyFormat.RULE_MIN_SIZE}`, ruleOffset);
+			if (ruleSizeValue < PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("RULE_TOO_SMALL", `Rule size ${ruleSizeValue} is below minimum ${PolicyFormat.RULE_MIN_SIZE}`, ruleOffset);
 			if (ruleOffset + ruleSizeValue > groupEnd) throw new CallciumError("RULE_OVERFLOW", "Rule extends beyond group boundary", ruleOffset);
 			const scopeOffset = ruleOffset + PolicyFormat.RULE_SCOPE_OFFSET;
 			const scopeValue = data[scopeOffset];
 			if (scopeValue !== Scope.CONTEXT && scopeValue !== Scope.CALLDATA) throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${scopeValue}`, ruleOffset);
 			const depthOffset = ruleOffset + PolicyFormat.RULE_DEPTH_OFFSET;
 			const depthValue = data[depthOffset];
-			if (depthValue === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step", ruleOffset);
-			if (depthValue > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depthValue} exceeds maximum ${Limits.MAX_PATH_DEPTH}`, ruleOffset);
-			if (scopeValue === Scope.CONTEXT && depthValue !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step", ruleOffset);
 			const pathStart = ruleOffset + PolicyFormat.RULE_PATH_OFFSET;
 			const pathLength = depthValue * PolicyFormat.PATH_STEP_SIZE;
-			const pathHex = toHex(data, pathStart, pathStart + pathLength);
-			if (scopeValue === Scope.CONTEXT) {
-				const contextPropertyId = readU16(data, pathStart);
-				if (contextPropertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("INVALID_CONTEXT_PROPERTY", `Context rule references undefined context property 0x${contextPropertyId.toString(16).padStart(4, "0")}`, ruleOffset);
+			const ruleEnd = ruleOffset + ruleSizeValue;
+			const hintStart = pathStart + pathLength;
+			let hintSize = 0;
+			if (scopeValue === Scope.CALLDATA) {
+				hintSize = resolveHintSize(data, hintStart, ruleEnd, ruleOffset);
+				validateHint(data, hintStart, hintSize, ruleOffset);
 			}
-			const opCodeOffset = pathStart + pathLength;
-			const opCodeValue = data[opCodeOffset];
+			const opCodeOffset = hintStart + hintSize;
 			const dataLengthOffset = opCodeOffset + PolicyFormat.RULE_OPCODE_SIZE;
 			const dataLengthValue = readU16(data, dataLengthOffset);
-			const dataStart = dataLengthOffset + PolicyFormat.RULE_DATALENGTH_SIZE;
-			const expectedRuleSize = PolicyFormat.RULE_FIXED_OVERHEAD + pathLength + dataLengthValue;
+			const expectedRuleSize = PolicyFormat.RULE_FIXED_OVERHEAD + pathLength + hintSize + dataLengthValue;
 			if (ruleSizeValue !== expectedRuleSize) throw new CallciumError("RULE_SIZE_MISMATCH", `Declared rule size ${ruleSizeValue} does not match computed size ${expectedRuleSize}`, ruleOffset);
+			const opCodeValue = data[opCodeOffset];
 			const opBase = opCodeValue & ~Op.NOT;
-			if (opBase === 0 || !isValidOperatorData(opBase, dataLengthValue)) throw new CallciumError("INVALID_OPERATOR", "Unrecognized or malformed operator", ruleOffset);
+			if (opBase === 0 || !isValidOperatorData(opBase, dataLengthValue)) throw new CallciumError("UNKNOWN_OPERATOR", "Unrecognized or malformed operator", ruleOffset);
+			if (hintSize !== 0) {
+				if (isLengthValidType(hintTargetTypeCode(data, hintStart, hintSize)) !== isLengthOp(opBase)) throw new CallciumError("OPERATOR_TARGET_MISMATCH", "Operator family does not match the type the target declares", ruleOffset);
+			}
+			const dataStart = dataLengthOffset + PolicyFormat.RULE_DATALENGTH_SIZE;
 			if (opBase === Op.IN) {
 				const wordCount = dataLengthValue / 32;
 				for (let word = 1; word < wordCount; word++) if (compareBytes(data.subarray(dataStart + (word - 1) * 32, dataStart + word * 32), data.subarray(dataStart + word * 32, dataStart + (word + 1) * 32)) >= 0) throw new CallciumError("UNSORTED_IN_SET", "IN operands must be strictly ascending", ruleOffset);
 			}
+			if (depthValue === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step", ruleOffset);
+			if (depthValue > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depthValue} exceeds maximum ${Limits.MAX_PATH_DEPTH}`, ruleOffset);
+			if (scopeValue === Scope.CONTEXT) {
+				if (depthValue !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step", ruleOffset);
+				const contextPropertyId = readU16(data, pathStart);
+				if (contextPropertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Context rule references undefined context property 0x${contextPropertyId.toString(16).padStart(4, "0")}`, ruleOffset);
+			}
+			const pathHex = toHex(data, pathStart, pathStart + pathLength);
 			rules.push({
 				ruleSize: field(ruleSizeValue, ruleOffset, ruleOffset + PolicyFormat.RULE_SIZE_SIZE),
 				scope: field(scopeValue, scopeOffset, scopeOffset + 1),
 				pathDepth: field(depthValue, depthOffset, depthOffset + 1),
 				path: field(pathHex, pathStart, pathStart + pathLength),
+				...hintSize > 0 && { hint: field(toHex(data, hintStart, hintStart + hintSize), hintStart, hintStart + hintSize) },
 				opCode: field(opCodeValue, opCodeOffset, opCodeOffset + PolicyFormat.RULE_OPCODE_SIZE),
 				dataLength: field(dataLengthValue, dataLengthOffset, dataLengthOffset + PolicyFormat.RULE_DATALENGTH_SIZE),
 				data: field(toHex(data, dataStart, dataStart + dataLengthValue), dataStart, dataStart + dataLengthValue),
@@ -1272,25 +1352,30 @@ function decodePolicy(blob) {
 			version,
 			isSelectorless
 		},
-		tree
+		data
 	};
 }
-/** Flatten a Constraint into one Rule per operator. */
-function flattenConstraint(constraint) {
+function flattenConstraint(constraint, desc) {
+	const operators = constraint.operators.map(hexToBytes);
+	for (const operator of operators) if (operator.length < 1) throw new CallciumError("INVALID_OPERATOR_BYTES", "Operator must have at least one byte (opcode).");
 	const path = hexToBytes(constraint.path);
-	return constraint.operators.map((op) => ({
+	if (path.length === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step.");
+	if ((path.length & 1) !== 0) throw new CallciumError("MALFORMED_PATH", "Path byte length must be even.");
+	const depth = path.length / 2;
+	if (depth > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depth} exceeds maximum ${Limits.MAX_PATH_DEPTH}.`);
+	const hint = constraint.scope === Scope.CALLDATA ? Descriptor.compileHint(desc, parsePathSteps(constraint.path)) : new Uint8Array(0);
+	return operators.map((operator) => ({
 		scope: constraint.scope,
 		path,
-		operator: hexToBytes(op)
+		operator,
+		hint
 	}));
 }
-/** Compare two byte arrays lexicographically. */
 function compareBytes(a, b) {
 	const length = Math.min(a.length, b.length);
 	for (let i = 0; i < length; i++) if (a[i] !== b[i]) return a[i] - b[i];
 	return a.length - b.length;
 }
-/** Sort rules by (scope, pathDepth, pathBytes, operatorBytes). */
 function sortRules(rules) {
 	rules.sort((a, b) => {
 		if (a.scope !== b.scope) return a.scope - b.scope;
@@ -1302,30 +1387,24 @@ function sortRules(rules) {
 		return compareBytes(a.operator, b.operator);
 	});
 }
-/** Serialize a single rule to its wire format bytes. */
 function encodeRule(rule) {
-	if (rule.path.length === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step.");
-	if ((rule.path.length & 1) !== 0) throw new CallciumError("INVALID_PATH", "Path byte length must be even.");
-	if (rule.operator.length < 1) throw new CallciumError("INVALID_OPERATOR", "Operator must have at least one byte (opcode).");
 	const depth = rule.path.length / 2;
-	if (depth > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depth} exceeds maximum ${Limits.MAX_PATH_DEPTH}.`);
 	if (rule.scope === Scope.CONTEXT && depth !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step.");
-	const opCode = rule.operator[0];
 	const data = rule.operator.subarray(1);
-	const ruleSize = PolicyFormat.RULE_FIXED_OVERHEAD + rule.path.length + data.length;
+	const ruleSize = PolicyFormat.RULE_FIXED_OVERHEAD + rule.path.length + rule.hint.length + data.length;
 	if (ruleSize > 65535) throw new CallciumError("RULE_SIZE_OVERFLOW", `Rule size ${ruleSize} exceeds maximum 65535`);
 	const buf = new Uint8Array(ruleSize);
 	writeBE16(buf, 0, ruleSize);
 	buf[2] = rule.scope;
 	buf[3] = depth;
 	buf.set(rule.path, 4);
-	const opOffset = 4 + rule.path.length;
-	buf[opOffset] = opCode;
+	buf.set(rule.hint, 4 + rule.path.length);
+	const opOffset = 4 + rule.path.length + rule.hint.length;
+	buf[opOffset] = rule.operator[0];
 	writeBE16(buf, opOffset + 1, data.length);
 	buf.set(data, opOffset + 3);
 	return buf;
 }
-/** Serialize all rules in a group to a single byte array. */
 function encodeGroupRules(rules) {
 	const parts = rules.map(encodeRule);
 	const totalSize = parts.reduce((sum, p) => sum + p.length, 0);
@@ -1337,40 +1416,35 @@ function encodeGroupRules(rules) {
 	}
 	return buf;
 }
-/** Build a single operator hex string from a decoded rule's opCode and data. */
 function buildOperatorHex(rule) {
 	return `0x${rule.opCode.value.toString(16).padStart(2, "0")}${rule.data.value.slice(2)}`;
 }
-/**
-* Encode a PolicyData structure into the canonical binary format.
-* @param data - The policy data to encode.
-* @returns The encoded policy as a 0x-prefixed hex string.
-*/
 function encode(data) {
+	const descBytes = hexToBytes(data.descriptor);
+	if (data.groups.length === 0) throw new CallciumError("EMPTY_POLICY", "Policy must contain at least one group");
+	if (data.groups.length > 255) throw new CallciumError("GROUP_COUNT_OVERFLOW", `Group count ${data.groups.length} exceeds maximum 255`);
 	const sortedGroups = data.groups.map((group) => {
-		const rules = group.flatMap(flattenConstraint);
+		const rules = group.flatMap((constraint) => flattenConstraint(constraint, descBytes));
 		sortRules(rules);
 		return rules;
 	});
-	if (sortedGroups.length === 0) throw new CallciumError("EMPTY_POLICY", "Policy must contain at least one group");
-	if (sortedGroups.length > 255) throw new CallciumError("GROUP_COUNT_OVERFLOW", `Group count ${sortedGroups.length} exceeds maximum 255`);
-	const groupsWithHash = sortedGroups.map((rules, groupIndex) => {
+	if (descBytes.length > 65535) throw new CallciumError("DESC_LENGTH_OVERFLOW", `Descriptor length ${descBytes.length} exceeds maximum 65535`);
+	const encodedGroups = sortedGroups.map((rules, groupIndex) => {
 		if (rules.length === 0) throw new CallciumError("EMPTY_GROUP", `Group ${groupIndex} is empty`);
 		if (rules.length > 65535) throw new CallciumError("RULE_COUNT_OVERFLOW", `Group ${groupIndex} rule count ${rules.length} exceeds maximum 65535`);
-		const wireBytes = encodeGroupRules(rules);
 		return {
-			wireBytes,
-			hash: keccak_256(wireBytes),
+			wireBytes: encodeGroupRules(rules),
 			ruleCount: rules.length
 		};
 	});
-	groupsWithHash.sort((a, b) => compareBytes(a.hash, b.hash));
-	const descBytes = hexToBytes(data.descriptor);
-	if (descBytes.length > 65535) throw new CallciumError("DESC_LENGTH_OVERFLOW", `Descriptor length ${descBytes.length} exceeds maximum 65535`);
+	if (encodedGroups.length > 1) {
+		const hashes = new Map(encodedGroups.map((group) => [group, keccak_256(group.wireBytes)]));
+		encodedGroups.sort((a, b) => compareBytes(hashes.get(a), hashes.get(b)));
+	}
 	const selectorBytes = data.isSelectorless ? new Uint8Array(4) : hexToBytes(data.selector);
 	const headerByte = PolicyFormat.VERSION | (data.isSelectorless ? PolicyFormat.FLAG_NO_SELECTOR : 0);
 	let totalSize = PolicyFormat.HEADER_SIZE + PolicyFormat.SELECTOR_SIZE + PolicyFormat.DESC_LENGTH_SIZE + descBytes.length + PolicyFormat.GROUP_COUNT_SIZE;
-	for (const g of groupsWithHash) totalSize += PolicyFormat.GROUP_HEADER_SIZE + g.wireBytes.length;
+	for (const g of encodedGroups) totalSize += PolicyFormat.GROUP_HEADER_SIZE + g.wireBytes.length;
 	const out = new Uint8Array(totalSize);
 	let offset = 0;
 	out[offset++] = headerByte;
@@ -1380,32 +1454,25 @@ function encode(data) {
 	offset += PolicyFormat.DESC_LENGTH_SIZE;
 	out.set(descBytes, offset);
 	offset += descBytes.length;
-	out[offset++] = groupsWithHash.length;
-	for (const g of groupsWithHash) {
+	out[offset++] = encodedGroups.length;
+	for (const g of encodedGroups) {
 		writeBE16(out, offset, g.ruleCount);
 		offset += PolicyFormat.GROUP_RULECOUNT_SIZE;
-		out[offset++] = g.wireBytes.length >>> 24 & 255;
-		out[offset++] = g.wireBytes.length >>> 16 & 255;
-		out[offset++] = g.wireBytes.length >>> 8 & 255;
-		out[offset++] = g.wireBytes.length & 255;
+		writeBE32(out, offset, g.wireBytes.length);
+		offset += PolicyFormat.GROUP_SIZE_SIZE;
 		out.set(g.wireBytes, offset);
 		offset += g.wireBytes.length;
 	}
 	return bytesToHex(out);
 }
-/**
-* Decode a binary policy blob into a PolicyData structure.
-* @param blob - Binary policy as 0x-prefixed hex string.
-* @returns The decoded policy data with constraints grouped by scope and path.
-* @throws {CallciumError} If the blob is structurally malformed.
-*/
 function decode(blob) {
 	const { policy } = decodePolicy(blob);
 	const groups = policy.groups.map((group) => {
 		const constraintMap = /* @__PURE__ */ new Map();
 		const constraintOrder = [];
 		for (const rule of group.rules) {
-			const key = `${rule.scope.value}:${rule.path.value}`;
+			const hintHex = rule.hint?.value;
+			const key = `${rule.scope.value}:${rule.path.value}:${hintHex ?? ""}`;
 			const opHex = buildOperatorHex(rule);
 			const existing = constraintMap.get(key);
 			if (existing !== void 0) existing.operators.push(opHex);
@@ -1414,6 +1481,7 @@ function decode(blob) {
 					scope: rule.scope.value,
 					path: rule.path.value,
 					operators: [opHex],
+					...hintHex !== void 0 && { hint: hintHex },
 					span: rule.span
 				};
 				constraintMap.set(key, constraint);
@@ -1426,180 +1494,21 @@ function decode(blob) {
 		isSelectorless: policy.isSelectorless,
 		selector: policy.selector.value,
 		descriptor: policy.descriptor.raw,
-		groups,
-		span: policy.span
-	};
-}
-/**
-* Inspect a binary policy blob, returning the structural representation with full byte-level spans.
-* @param blob - Binary policy as 0x-prefixed hex string.
-* @returns The inspected policy with per-field spans for every structural element.
-* @throws {CallciumError} If the blob is structurally malformed.
-*/
-function inspect(blob) {
-	return decodePolicy(blob).policy;
-}
-/** Encode, decode, and inspect policies in the canonical binary format. */
-const PolicyCoder = {
-	encode,
-	decode,
-	inspect
-};
-//#endregion
-//#region src/operators.ts
-/** Read a big-endian 256-bit unsigned integer from a 32-byte window. */
-function toBigInt(bytes, offset = 0) {
-	const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 32);
-	return view.getBigUint64(0, false) << 192n | view.getBigUint64(8, false) << 128n | view.getBigUint64(16, false) << 64n | view.getBigUint64(24, false);
-}
-/** Return true when the type code represents a signed integer (int8 through int256). */
-function isSigned(typeCode) {
-	return typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
-}
-/**
-* Return true when the type code represents a left-aligned type (fixed bytes or function),
-* whose value occupies the high bytes of the word with zero padding below.
-*/
-function isLeftAligned(typeCode) {
-	return typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX || typeCode === TypeCode.FUNCTION;
-}
-/**
-* Canonicalize a raw 256-bit calldata word to its ABI value for the declared type (Policy Spec §7.8).
-* A scalar loaded from untrusted calldata may carry bits outside the declared width; masking
-* unsigned/address/bool/function/bytesN to width and sign-extending signed integers makes the
-* comparison use the canonical ABI value rather than the raw bytes.
-* @param value - The raw 256-bit word loaded from calldata.
-* @param typeCode - The declared type code of the value.
-* @returns The canonicalized 256-bit value.
-*/
-function canonicalize(value, typeCode) {
-	if (typeCode <= TypeCode.UINT_MAX) {
-		const bits = BigInt((typeCode + 1) * 8);
-		return bits === 256n ? value : value & (1n << bits) - 1n;
-	}
-	if (typeCode <= TypeCode.INT_MAX) {
-		const bits = (typeCode - TypeCode.INT_MIN + 1) * 8;
-		return bits === 256 ? value : BigInt.asUintN(256, BigInt.asIntN(bits, value));
-	}
-	if (typeCode === TypeCode.ADDRESS) return value & (1n << 160n) - 1n;
-	if (typeCode === TypeCode.BOOL) return value & 1n;
-	if (typeCode === TypeCode.FUNCTION) return value >> 64n << 64n;
-	if (typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX) {
-		const n = typeCode - TypeCode.FIXED_BYTES_MIN + 1;
-		if (n === 32) return value;
-		const padBits = BigInt((32 - n) * 8);
-		return value >> padBits << padBits;
-	}
-	return value;
-}
-/** Return true when the operator code (with or without NOT flag) is a LENGTH_* variant. */
-function isLengthOp(opCode) {
-	const base = opCode & ~Op.NOT;
-	return base >= Op.LENGTH_EQ && base <= Op.LENGTH_BETWEEN;
-}
-/** Map a LENGTH_* opcode base to its core value-comparison twin. */
-function lengthToValueOp(base) {
-	if (base === Op.LENGTH_EQ) return Op.EQ;
-	if (base === Op.LENGTH_GT) return Op.GT;
-	if (base === Op.LENGTH_LT) return Op.LT;
-	if (base === Op.LENGTH_GTE) return Op.GTE;
-	if (base === Op.LENGTH_LTE) return Op.LTE;
-	return Op.BETWEEN;
-}
-/** Return true when LENGTH_* operators are valid for the given type code (bytes, string, or dynamic array). */
-function isLengthValidType(typeCode) {
-	return typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING || typeCode === TypeCode.DYNAMIC_ARRAY;
-}
-/** Compare two 256-bit values, using two's complement interpretation for signed type codes. */
-function compareTyped(a, b, typeCode) {
-	if (isSigned(typeCode)) {
-		const sa = BigInt.asIntN(256, a);
-		const sb = BigInt.asIntN(256, b);
-		return sa < sb ? -1 : sa > sb ? 1 : 0;
-	}
-	return a < b ? -1 : a > b ? 1 : 0;
-}
-/** Binary search over a sorted array of 32-byte words. Comparison is always unsigned. */
-function isIn(value, data) {
-	const count = data.length / 32;
-	let lo = 0;
-	let hi = count - 1;
-	while (lo <= hi) {
-		const mid = lo + hi >>> 1;
-		const elem = toBigInt(data, mid * 32);
-		if (value === elem) return true;
-		if (value < elem) hi = mid - 1;
-		else lo = mid + 1;
-	}
-	return false;
-}
-/**
-* Apply a single operator against a value and operand data.
-* Handles the NOT flag internally by inverting the base operator result.
-* @param opCode - Operator code, potentially OR'd with the NOT flag.
-* @param value - The 256-bit value to test (ignored for LENGTH_* operators).
-* @param valueLength - Runtime byte or element count, only meaningful for LENGTH_* operators.
-* @param operandData - Raw operand bytes (32 per operand, 64 for range operators).
-* @param typeCode - ABI type code, used to select signed vs. unsigned comparison.
-* @returns Whether the value satisfies the operator.
-*/
-function applyOperator(opCode, value, valueLength, operandData, typeCode) {
-	const negate = (opCode & Op.NOT) !== 0;
-	let base = opCode & ~Op.NOT;
-	if (isLengthOp(base)) {
-		value = BigInt(valueLength);
-		typeCode = TypeCode.UINT_MAX;
-		base = lengthToValueOp(base);
-	}
-	let result;
-	switch (base) {
-		case Op.EQ:
-			result = value === toBigInt(operandData, 0);
-			break;
-		case Op.GT:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) > 0;
-			break;
-		case Op.LT:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) < 0;
-			break;
-		case Op.GTE:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) >= 0;
-			break;
-		case Op.LTE:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) <= 0;
-			break;
-		case Op.BETWEEN: {
-			const min = toBigInt(operandData, 0);
-			const max = toBigInt(operandData, 32);
-			result = compareTyped(value, min, typeCode) >= 0 && compareTyped(value, max, typeCode) <= 0;
-			break;
-		}
-		case Op.IN:
-			result = isIn(value, operandData);
-			break;
-		case Op.BITMASK_ALL: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) === mask;
-			break;
-		}
-		case Op.BITMASK_ANY: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) !== 0n;
-			break;
-		}
-		case Op.BITMASK_NONE: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) === 0n;
-			break;
-		}
-		default: throw new CallciumError("INVALID_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}.`);
-	}
-	return negate ? !result : result;
+		groups,
+		span: policy.span
+	};
+}
+function inspect(blob) {
+	return decodePolicy(blob).policy;
 }
+const PolicyCoder = {
+	encode,
+	decode,
+	inspect
+};
 //#endregion
 //#region src/validation-issue.ts
 const ZERO = `0x${"0".repeat(64)}`;
-/** Create an issue from operator compatibility results. */
 function fromOpRule(code, message, groupIndex, constraintIndex, opCode) {
 	return {
 		severity: "error",
@@ -1612,7 +1521,42 @@ function fromOpRule(code, message, groupIndex, constraintIndex, opCode) {
 		message
 	};
 }
-/** Issue for an operand that is not canonically encoded for the declared type. */
+function unnavigablePath(groupIndex, constraintIndex) {
+	return {
+		severity: "error",
+		category: "typeMismatch",
+		groupIndex,
+		constraintIndex,
+		code: "UNNAVIGABLE_PATH",
+		value1: ZERO,
+		value2: ZERO,
+		message: "Path does not navigate the descriptor"
+	};
+}
+function nestedQuantifier(groupIndex, constraintIndex) {
+	return {
+		severity: "error",
+		category: "typeMismatch",
+		groupIndex,
+		constraintIndex,
+		code: "NESTED_QUANTIFIER",
+		value1: ZERO,
+		value2: ZERO,
+		message: "Path applies more than one quantifier"
+	};
+}
+function hintMismatch(groupIndex, constraintIndex) {
+	return {
+		severity: "error",
+		category: "typeMismatch",
+		groupIndex,
+		constraintIndex,
+		code: "HINT_MISMATCH",
+		value1: ZERO,
+		value2: ZERO,
+		message: "Hint does not match the path compiled against the descriptor"
+	};
+}
 function nonCanonicalOperand(groupIndex, constraintIndex, operand, canonical) {
 	return {
 		severity: "error",
@@ -1625,7 +1569,6 @@ function nonCanonicalOperand(groupIndex, constraintIndex, operand, canonical) {
 		message: "Operand is not the canonical encoding for the declared type"
 	};
 }
-/** eq(v)/neq(v) or lengthEq(v)/lengthNeq(v) on the same path. */
 function eqNeqContradiction(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "error",
@@ -1638,7 +1581,6 @@ function eqNeqContradiction(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "lengthEq(v) and lengthNeq(v) on same path" : "eq(v) and neq(v) on same path"
 	};
 }
-/** Multiple eq()/lengthEq() operators with different values. */
 function conflictingEquality(isLength, groupIndex, constraintIndex, existing, newValue) {
 	return {
 		severity: "error",
@@ -1651,7 +1593,6 @@ function conflictingEquality(isLength, groupIndex, constraintIndex, existing, ne
 		message: isLength ? "Multiple lengthEq() operators with different values" : "Multiple eq() operators with different values"
 	};
 }
-/** Value/length is outside the physical range of its type. */
 function outOfPhysicalBounds(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "error",
@@ -1664,7 +1605,6 @@ function outOfPhysicalBounds(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "Length value is outside the physical range" : "Value is outside the physical range of the type"
 	};
 }
-/** gt()/lengthGt() on the maximum is impossible. */
 function impossibleGt(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "error",
@@ -1677,7 +1617,6 @@ function impossibleGt(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "lengthGt() on maximum length is impossible" : "gt() on type maximum is impossible"
 	};
 }
-/** lt()/lengthLt() on the minimum is impossible. */
 function impossibleLt(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "error",
@@ -1690,7 +1629,6 @@ function impossibleLt(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "lengthLt() on minimum length is impossible" : "lt() on type minimum is impossible"
 	};
 }
-/** eq()/lengthEq() value is excluded by a bound. */
 function boundsExcludeEquality(isLength, groupIndex, constraintIndex, eq, bound) {
 	return {
 		severity: "error",
@@ -1703,7 +1641,6 @@ function boundsExcludeEquality(isLength, groupIndex, constraintIndex, eq, bound)
 		message: isLength ? "lengthEq() value is excluded by bound" : "eq() value is excluded by bound"
 	};
 }
-/** Lower bound/length exceeds the upper bound. */
 function impossibleRange(isLength, groupIndex, constraintIndex, lower, upper) {
 	return {
 		severity: "error",
@@ -1716,7 +1653,6 @@ function impossibleRange(isLength, groupIndex, constraintIndex, lower, upper) {
 		message: isLength ? "Lower length bound exceeds upper bound" : "Lower bound exceeds upper bound"
 	};
 }
-/** Set operation excludes existing eq() value. */
 function setExcludesEquality(groupIndex, constraintIndex, value) {
 	return {
 		severity: "error",
@@ -1729,7 +1665,6 @@ function setExcludesEquality(groupIndex, constraintIndex, value) {
 		message: "Set operation excludes existing eq() value"
 	};
 }
-/** Multiple isIn() sets have no intersection. */
 function emptySetIntersection(groupIndex, constraintIndex) {
 	return {
 		severity: "error",
@@ -1742,7 +1677,6 @@ function emptySetIntersection(groupIndex, constraintIndex) {
 		message: "Multiple isIn() sets have no intersection"
 	};
 }
-/** All values in isIn() set are excluded by neq/notIn. */
 function setFullyExcluded(groupIndex, constraintIndex) {
 	return {
 		severity: "error",
@@ -1755,7 +1689,6 @@ function setFullyExcluded(groupIndex, constraintIndex) {
 		message: "All values in isIn() set are excluded by neq/notIn"
 	};
 }
-/** Bitmask operators conflict. */
 function bitmaskContradiction(groupIndex, constraintIndex, mask, conflicting) {
 	return {
 		severity: "error",
@@ -1768,7 +1701,6 @@ function bitmaskContradiction(groupIndex, constraintIndex, mask, conflicting) {
 		message: "Bitmask operators conflict"
 	};
 }
-/** bitmaskAny is impossible because all bits are forbidden. */
 function bitmaskAnyImpossible(groupIndex, constraintIndex, mask, mustBeZero) {
 	return {
 		severity: "error",
@@ -1781,7 +1713,6 @@ function bitmaskAnyImpossible(groupIndex, constraintIndex, mask, mustBeZero) {
 		message: "bitmaskAny is impossible because all bits are forbidden"
 	};
 }
-/** isIn/notIn set is not strictly sorted and deduplicated. */
 function unsortedInSet(groupIndex, constraintIndex) {
 	return {
 		severity: "error",
@@ -1794,7 +1725,6 @@ function unsortedInSet(groupIndex, constraintIndex) {
 		message: "isIn/notIn set is not strictly sorted and deduplicated."
 	};
 }
-/** Group contains zero constraints. */
 function emptyGroup(groupIndex) {
 	return {
 		severity: "error",
@@ -1807,7 +1737,6 @@ function emptyGroup(groupIndex) {
 		message: "Group contains zero constraints."
 	};
 }
-/** Numeric/length bound dominated by a stricter bound. */
 function dominatedBound(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "warning",
@@ -1820,7 +1749,6 @@ function dominatedBound(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "Length bound is dominated by a stricter bound" : "Numeric bound is dominated by a stricter bound"
 	};
 }
-/** Bound redundant because eq()/lengthEq() is set. */
 function redundantBound(isLength, groupIndex, constraintIndex, bound, eq) {
 	return {
 		severity: "warning",
@@ -1833,7 +1761,6 @@ function redundantBound(isLength, groupIndex, constraintIndex, bound, eq) {
 		message: isLength ? "Length bound is redundant because lengthEq() is set" : "Bound is redundant because eq() is set"
 	};
 }
-/** notIn() value was present in isIn() set. */
 function setReduction(groupIndex, constraintIndex, value) {
 	return {
 		severity: "warning",
@@ -1846,7 +1773,6 @@ function setReduction(groupIndex, constraintIndex, value) {
 		message: "notIn() value was present in isIn() set"
 	};
 }
-/** isIn() sets partially overlap. */
 function setRedundancy(groupIndex, constraintIndex, intersectionCount) {
 	return {
 		severity: "warning",
@@ -1859,7 +1785,6 @@ function setRedundancy(groupIndex, constraintIndex, intersectionCount) {
 		message: "isIn() sets partially overlap"
 	};
 }
-/** Some values in isIn() set are excluded by neq/notIn. */
 function setPartiallyExcluded(groupIndex, constraintIndex, excludedCount) {
 	return {
 		severity: "warning",
@@ -1872,7 +1797,6 @@ function setPartiallyExcluded(groupIndex, constraintIndex, excludedCount) {
 		message: "Some values in isIn() set are excluded by neq/notIn"
 	};
 }
-/** Bitmask operation is redundant. */
 function redundantBitmask(groupIndex, constraintIndex, mask, existing) {
 	return {
 		severity: "warning",
@@ -1885,7 +1809,6 @@ function redundantBitmask(groupIndex, constraintIndex, mask, existing) {
 		message: "Bitmask operation is redundant"
 	};
 }
-/** gte/lte pair fusible into a single range operator. */
 function fusibleRange(isLength, groupIndex, constraintIndex, low, high) {
 	return {
 		severity: "warning",
@@ -1898,7 +1821,6 @@ function fusibleRange(isLength, groupIndex, constraintIndex, low, high) {
 		message: isLength ? "lengthGte() and lengthLte() fuse into a single lengthBetween()" : "gte() and lte() fuse into a single between()"
 	};
 }
-/** Duplicate operator in constraint. */
 function duplicateConstraint(groupIndex, constraintIndex) {
 	return {
 		severity: "warning",
@@ -1911,7 +1833,6 @@ function duplicateConstraint(groupIndex, constraintIndex) {
 		message: "Duplicate operator in constraint"
 	};
 }
-/** gte(min)/lengthGte(0) is always true. */
 function vacuousGte(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "info",
@@ -1924,7 +1845,6 @@ function vacuousGte(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "lengthGte(0) is always true" : "gte() bound equals type minimum (always true)"
 	};
 }
-/** lte(max)/lengthLte(max) is always true. */
 function vacuousLte(isLength, groupIndex, constraintIndex, value) {
 	return {
 		severity: "info",
@@ -1937,7 +1857,18 @@ function vacuousLte(isLength, groupIndex, constraintIndex, value) {
 		message: isLength ? "lengthLte() bound equals maximum (always true)" : "lte() bound equals type maximum (always true)"
 	};
 }
-/** Path deeper than the reference enforcer's cap. */
+function vacuousNegatedRange(isLength, groupIndex, constraintIndex, low, high) {
+	return {
+		severity: "info",
+		category: "vacuity",
+		groupIndex,
+		constraintIndex,
+		code: isLength ? "VACUOUS_NEGATED_LENGTH_RANGE" : "VACUOUS_NEGATED_RANGE",
+		value1: low,
+		value2: high,
+		message: isLength ? "Negated lengthBetween() with low > high excludes nothing (always true)" : "Negated between() with low > high excludes nothing (always true)"
+	};
+}
 function pathDepthExceeded(groupIndex, constraintIndex, depth, maxDepth) {
 	return {
 		severity: "warning",
@@ -1947,23 +1878,21 @@ function pathDepthExceeded(groupIndex, constraintIndex, depth, maxDepth) {
 		code: "PATH_DEPTH_EXCEEDED",
 		value1: depth,
 		value2: maxDepth,
-		message: "Path depth exceeds the reference enforcer cap"
+		message: "Path depth exceeds the maximum a well-formed policy may declare"
 	};
 }
-/** Quantifier over a static array beyond the reference enforcer's iteration cap. */
 function quantifierOverStaticLimit(groupIndex, constraintIndex, arrayLength, maxLength) {
 	return {
-		severity: "warning",
+		severity: "error",
 		category: "compatibility",
 		groupIndex,
 		constraintIndex,
 		code: "QUANTIFIER_OVER_STATIC_LIMIT",
 		value1: arrayLength,
 		value2: maxLength,
-		message: "Quantifier over static array exceeds the reference enforcer cap"
+		message: "Quantifier over static array exceeds the maximum quantified length"
 	};
 }
-/** Context property ID outside the assigned set. */
 function unknownContextProperty(groupIndex, constraintIndex, contextId, maxContextId) {
 	return {
 		severity: "warning",
@@ -1976,7 +1905,6 @@ function unknownContextProperty(groupIndex, constraintIndex, contextId, maxConte
 		message: "Unknown context property ID"
 	};
 }
-/** Negated operator under the existential quantifier. */
 function negationUnderAny(groupIndex, constraintIndex, opCode) {
 	return {
 		severity: "warning",
@@ -1991,41 +1919,29 @@ function negationUnderAny(groupIndex, constraintIndex, opCode) {
 }
 //#endregion
 //#region src/policy-validator.ts
-/**
-* Maximum number of tracked "holes" (neq exclusions) and notIn values per
-* domain. A hole is a single value excluded via a negated equality (neq).
-* During cross-operator analysis, holes punch values out of isIn sets — if
-* every member of an isIn set is excluded by holes or notIn, the constraint
-* is unsatisfiable (SET_FULLY_EXCLUDED). When only some are excluded, the
-* validator emits SET_PARTIALLY_EXCLUDED.
-*
-* Both caps are protocol-defined limits. Beyond these limits,
-* additional exclusions are silently ignored — the validator becomes
-* best-effort for set-reduction diagnostics but never produces false
-* positives, only potential false negatives (missed redundancy warnings).
-*/
-const MAX_HOLES = 8;
-const MAX_NOT_IN = 8;
+const NAVIGABILITY_CODES = new Set([
+	"EMPTY_PATH",
+	"PARAM_INDEX_OUT_OF_BOUNDS",
+	"TUPLE_FIELD_OUT_OF_BOUNDS",
+	"STATIC_ARRAY_INDEX_OUT_OF_BOUNDS",
+	"NOT_COMPOSITE"
+]);
 const LENGTH_MAX = 4294967295n;
 const UINT256_MAX = (1n << 256n) - 1n;
 const INT256_SIGN_BIT = 1n << 255n;
-/** Signed-aware difference of two raw uint256 values: negative if a<b, zero if equal, positive if a>b. */
 function signedCompare(a, b, signed) {
 	if (!signed) return a - b;
 	const toS = (v) => v >= INT256_SIGN_BIT ? v - (1n << 256n) : v;
 	return toS(a) - toS(b);
 }
-/** True for uint and int type codes. */
 function isNumericType(typeCode) {
-	return typeCode <= TypeCode.UINT_MAX || typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
+	return typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX || typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
 }
-/** True for uint and bytes32 type codes. */
 function isBitmaskCompatible(typeCode) {
-	return typeCode <= TypeCode.UINT_MAX || typeCode === TypeCode.FIXED_BYTES_MIN + 31;
+	return typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX || typeCode === TypeCode.FIXED_BYTES_MIN + 31;
 }
-/** Physical domain limits for a type code (returned as raw uint256 bigints). */
 function getDomainLimits(typeCode) {
-	if (typeCode <= TypeCode.UINT_MAX) {
+	if (typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX) {
 		const bits = BigInt(typeCode - TypeCode.UINT_MIN + 1) * 8n;
 		return {
 			min: 0n,
@@ -2058,19 +1974,15 @@ function getDomainLimits(typeCode) {
 		max: UINT256_MAX
 	};
 }
-/** True for EQ, GT, LT, GTE, LTE, BETWEEN, IN, BITMASK_*. */
 function isValueOp(opBase) {
 	return opBase <= Op.BITMASK_NONE;
 }
-/** True for GT, LT, GTE, LTE, BETWEEN. */
 function isComparisonOp(opBase) {
 	return opBase >= Op.GT && opBase <= Op.BETWEEN;
 }
-/** True for BITMASK_ALL, BITMASK_ANY, BITMASK_NONE. */
 function isBitmaskOp(opBase) {
 	return opBase >= Op.BITMASK_ALL && opBase <= Op.BITMASK_NONE;
 }
-/** Return the incompatibility reason, or null if the operator is allowed. */
 function getIncompat(opBase, typeInfo) {
 	const { typeCode, isDynamic, staticSize } = typeInfo;
 	if (isValueOp(opBase)) {
@@ -2108,18 +2020,12 @@ function getIncompat(opBase, typeInfo) {
 		message: "Unknown operator code"
 	};
 }
-/**
-* True if operator `opCode` is allowed on a target with the given type info.
-* Tolerates the NOT flag on `opCode`.
-*/
 function isOpAllowed(opCode, typeInfo) {
 	return getIncompat(opCode & ~Op.NOT, typeInfo) === null;
 }
-/** Read a single uint256 from operator hex (bytes after the opcode byte). */
 function readValue(opHex) {
 	return BigInt(`0x${opHex.slice(4)}`);
 }
-/** First payload word deviating from the canonical encoding for the type, with its canonical form, or null. */
 function findNonCanonicalWord(opHex, typeCode) {
 	const body = opHex.slice(4);
 	for (let i = 0; i + 64 <= body.length; i += 64) {
@@ -2132,7 +2038,6 @@ function findNonCanonicalWord(opHex, typeCode) {
 	}
 	return null;
 }
-/** Read a pair of uint256 values from a BETWEEN operator. */
 function readPair(opHex) {
 	const body = opHex.slice(4);
 	return {
@@ -2140,7 +2045,6 @@ function readPair(opHex) {
 		high: BigInt(`0x${body.slice(64, 128)}`)
 	};
 }
-/** Unpack an IN operator's payload into an array of bigint values. */
 function unpackSet(opHex) {
 	const body = opHex.slice(4);
 	const count = body.length / 64;
@@ -2148,12 +2052,10 @@ function unpackSet(opHex) {
 	for (let i = 0; i < count; i++) values.push(BigInt(`0x${body.slice(i * 64, (i + 1) * 64)}`));
 	return values;
 }
-/** True if every element is strictly greater than the previous. */
 function isStrictlyAscending(values) {
 	for (let i = 1; i < values.length; i++) if (values[i] <= values[i - 1]) return false;
 	return true;
 }
-/** Convert LENGTH_* opcode to its core comparison equivalent. */
 function normalizeLengthOp(base) {
 	if (base === Op.LENGTH_EQ) return Op.EQ;
 	if (base === Op.LENGTH_GT) return Op.GT;
@@ -2162,7 +2064,6 @@ function normalizeLengthOp(base) {
 	if (base === Op.LENGTH_LTE) return Op.LTE;
 	return base;
 }
-/** Convert a negated bound opcode to its positive equivalent. */
 function negateBoundOp(base) {
 	if (base === Op.GT) return Op.LTE;
 	if (base === Op.GTE) return Op.LT;
@@ -2170,7 +2071,6 @@ function negateBoundOp(base) {
 	if (base === Op.LTE) return Op.GT;
 	return base;
 }
-/** Fresh bound domain with no constraints recorded yet. */
 function emptyBoundDomain(boundIsSigned, min, max) {
 	return {
 		isSigned: boundIsSigned,
@@ -2187,12 +2087,12 @@ function emptyBoundDomain(boundIsSigned, min, max) {
 		holes: []
 	};
 }
-/** Create a fresh constraint context with domain limits from the type. */
-function initContext(scope, path, typeInfo) {
+function initContext(scope, path, steps, typeInfo) {
 	const { min, max } = getDomainLimits(typeInfo.typeCode);
 	return {
 		scope,
 		path,
+		steps,
 		typeInfo,
 		numeric: emptyBoundDomain(isSigned(typeInfo.typeCode), min, max),
 		bitmask: {
@@ -2207,11 +2107,7 @@ function initContext(scope, path, typeInfo) {
 		}
 	};
 }
-/** Narrow the numeric bound domain with an operator and emit issues on contradiction or redundancy. */
 function updateBound(domain, base, isNegated, value, isLength, groupIndex, constraintIndex, issues) {
-	let changedEq = false;
-	let changedLower = false;
-	let changedUpper = false;
 	if (isNegated) {
 		if (base === Op.EQ) {
 			if (domain.hasEq && domain.eq === value) issues.push(eqNeqContradiction(isLength, groupIndex, constraintIndex, bigintToHex(value)));
@@ -2220,7 +2116,7 @@ function updateBound(domain, base, isNegated, value, isLength, groupIndex, const
 				alreadyHole = true;
 				break;
 			}
-			if (!alreadyHole && domain.holes.length < MAX_HOLES) domain.holes.push(value);
+			if (!alreadyHole) domain.holes.push(value);
 		} else updateBound(domain, negateBoundOp(base), false, value, isLength, groupIndex, constraintIndex, issues);
 		return;
 	}
@@ -2229,6 +2125,9 @@ function updateBound(domain, base, isNegated, value, isLength, groupIndex, const
 	if (signedCompare(value, domain.min, domain.isSigned) < 0n || signedCompare(value, domain.max, domain.isSigned) > 0n) issues.push(outOfPhysicalBounds(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	else if (base === Op.GT && value === domain.max) issues.push(impossibleGt(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	else if (base === Op.LT && value === domain.min) issues.push(impossibleLt(isLength, groupIndex, constraintIndex, bigintToHex(value)));
+	let changedEq = false;
+	let changedLower = false;
+	let changedUpper = false;
 	if (base === Op.EQ) {
 		if (!domain.hasEq || domain.eq !== value) changedEq = true;
 		if (domain.hasEq) {
@@ -2300,7 +2199,6 @@ function updateBound(domain, base, isNegated, value, isLength, groupIndex, const
 		}
 	}
 }
-/** Update the bitmask domain and emit issues on contradiction or redundancy. */
 function updateBitmask(ctx, base, isNegated, mask, groupIndex, constraintIndex, issues) {
 	if (isNegated) return;
 	if (base === Op.BITMASK_ALL) {
@@ -2316,7 +2214,6 @@ function updateBitmask(ctx, base, isNegated, mask, groupIndex, constraintIndex,
 		if ((ctx.bitmask.mustBeOne & mask) !== 0n) issues.push(redundantBitmask(groupIndex, constraintIndex, bigintToHex(mask), bigintToHex(ctx.bitmask.mustBeOne)));
 	}
 }
-/** Emit an issue if the IN set has been fully excluded by NOT_IN or NEQ holes. */
 function checkSetEmpty(ctx, groupIndex, constraintIndex, issues) {
 	if (!ctx.set.hasIn) return;
 	let possibleCount = 0;
@@ -2339,7 +2236,6 @@ function checkSetEmpty(ctx, groupIndex, constraintIndex, issues) {
 	if (possibleCount === 0) issues.push(setFullyExcluded(groupIndex, constraintIndex));
 	else if (possibleCount < inCount) issues.push(setPartiallyExcluded(groupIndex, constraintIndex, bigintToHex(BigInt(inCount - possibleCount))));
 }
-/** Update the set domain with IN or NOT_IN values and emit issues on contradiction or redundancy. */
 function updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues) {
 	if (isNegated) {
 		for (const value of values) {
@@ -2352,10 +2248,11 @@ function updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues)
 				}
 				if (inSet) issues.push(setReduction(groupIndex, constraintIndex, bigintToHex(value)));
 			}
-			if (ctx.set.notInValues.length < MAX_NOT_IN) ctx.set.notInValues.push(value);
+			ctx.set.notInValues.push(value);
 		}
 		checkSetEmpty(ctx, groupIndex, constraintIndex, issues);
 	} else {
+		for (const value of values) if (signedCompare(value, ctx.numeric.min, ctx.numeric.isSigned) < 0n || signedCompare(value, ctx.numeric.max, ctx.numeric.isSigned) > 0n) issues.push(outOfPhysicalBounds(false, groupIndex, constraintIndex, bigintToHex(value)));
 		if (ctx.numeric.hasEq) {
 			let found = false;
 			for (const candidate of values) if (candidate === ctx.numeric.eq) {
@@ -2380,7 +2277,6 @@ function updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues)
 		checkSetEmpty(ctx, groupIndex, constraintIndex, issues);
 	}
 }
-/** Emit a warning if the constraint contains any identical operators. */
 function checkDuplicates(issues, operators, groupIndex, constraintIndex) {
 	const seen = /* @__PURE__ */ new Set();
 	for (const op of operators) {
@@ -2392,18 +2288,12 @@ function checkDuplicates(issues, operators, groupIndex, constraintIndex) {
 		seen.add(key);
 	}
 }
-/**
-* Report a lone unnegated gte/lte pair (value or length domain) as fusible into the
-* corresponding single range operator. Fires only for a satisfiable pair on a compatible
-* type; contradictions and dominated bounds are already reported by the domain checks.
-*/
 function checkFusibleRange(ctx, operators, groupIndex, constraintIndex, issues) {
 	const numericPair = findLonePair(operators, Op.GTE, Op.LTE);
 	if (numericPair && getIncompat(Op.GTE, ctx.typeInfo) === null && signedCompare(numericPair.low, numericPair.high, ctx.numeric.isSigned) <= 0n) issues.push(fusibleRange(false, groupIndex, constraintIndex, bigintToHex(numericPair.low), bigintToHex(numericPair.high)));
 	const lengthPair = findLonePair(operators, Op.LENGTH_GTE, Op.LENGTH_LTE);
 	if (lengthPair && getIncompat(Op.LENGTH_GTE, ctx.typeInfo) === null && lengthPair.low <= lengthPair.high) issues.push(fusibleRange(true, groupIndex, constraintIndex, bigintToHex(lengthPair.low), bigintToHex(lengthPair.high)));
 }
-/** Return the operand pair when the operators contain exactly one of each unnegated bound opcode. */
 function findLonePair(operators, lowerOp, upperOp) {
 	let lowerCount = 0;
 	let upperCount = 0;
@@ -2426,19 +2316,18 @@ function findLonePair(operators, lowerOp, upperOp) {
 		high
 	} : null;
 }
-/** Validate all operators on a single constraint against its domain context. */
 function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues) {
 	const operators = constraint.operators;
-	const underAny = constraint.scope === Scope.CALLDATA && parsePathSteps(constraint.path).includes(Quantifier.ANY);
+	const underAny = constraint.scope === Scope.CALLDATA && ctx.steps.includes(Quantifier.ANY);
 	for (const opHex of operators) {
 		const opCode = parseInt(opHex.slice(2, 4), 16);
 		const base = opCode & ~Op.NOT;
-		const isNegated = (opCode & Op.NOT) !== 0;
 		const dataLength = (opHex.length - 4) / 2;
 		if (dataLength > 65535 || !isValidOperatorData(base, dataLength)) {
 			issues.push(fromOpRule("UNKNOWN_OPERATOR", "Unknown operator code", groupIndex, constraintIndex, bigintToHex(BigInt(opCode))));
 			continue;
 		}
+		const isNegated = (opCode & Op.NOT) !== 0;
 		if (underAny && isNegated) issues.push(negationUnderAny(groupIndex, constraintIndex, bigintToHex(BigInt(opCode))));
 		const incompat = getIncompat(base, ctx.typeInfo);
 		if (incompat) {
@@ -2455,11 +2344,11 @@ function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues
 				}
 			}
 			if (base >= Op.EQ && base <= Op.BETWEEN) if (base === Op.BETWEEN) {
+				const { low, high } = readPair(opHex);
 				if (!isNegated) {
-					const { low, high } = readPair(opHex);
 					updateBound(ctx.numeric, Op.GTE, false, low, false, groupIndex, constraintIndex, issues);
 					updateBound(ctx.numeric, Op.LTE, false, high, false, groupIndex, constraintIndex, issues);
-				}
+				} else if (signedCompare(low, high, ctx.numeric.isSigned) > 0n) issues.push(vacuousNegatedRange(false, groupIndex, constraintIndex, bigintToHex(low), bigintToHex(high)));
 			} else {
 				const value = readValue(opHex);
 				const holesBefore = ctx.numeric.holes.length;
@@ -2473,11 +2362,11 @@ function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues
 				else updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues);
 			}
 		} else if (isLengthOp(base)) if (base === Op.LENGTH_BETWEEN) {
+			const { low, high } = readPair(opHex);
 			if (!isNegated) {
-				const { low, high } = readPair(opHex);
 				updateBound(ctx.length, Op.GTE, false, low, true, groupIndex, constraintIndex, issues);
 				updateBound(ctx.length, Op.LTE, false, high, true, groupIndex, constraintIndex, issues);
-			}
+			} else if (low > high) issues.push(vacuousNegatedRange(true, groupIndex, constraintIndex, bigintToHex(low), bigintToHex(high)));
 		} else {
 			const value = readValue(opHex);
 			updateBound(ctx.length, normalizeLengthOp(base), isNegated, value, true, groupIndex, constraintIndex, issues);
@@ -2485,7 +2374,6 @@ function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues
 	}
 	checkDuplicates(issues, operators, groupIndex, constraintIndex);
 }
-/** Validate all constraints in a group, building per-path contexts for cross-constraint analysis. */
 function validateGroup(data, descBytes, groupIndex, issues) {
 	const constraints = data.groups[groupIndex];
 	const contexts = [];
@@ -2498,15 +2386,28 @@ function validateGroup(data, descBytes, groupIndex, issues) {
 			break;
 		}
 		if (!ctx) {
+			const steps = parsePathSteps(constraint.path);
 			let typeInfo;
 			if (constraint.scope === Scope.CALLDATA) {
-				const steps = parsePathSteps(constraint.path);
 				if (steps.length > Limits.MAX_PATH_DEPTH) issues.push(pathDepthExceeded(groupIndex, constraintIndex, bigintToHex(BigInt(steps.length)), bigintToHex(BigInt(Limits.MAX_PATH_DEPTH))));
-				const walk = Descriptor.walkPath(descBytes, steps);
+				let walk;
+				try {
+					walk = Descriptor.walkPath(descBytes, steps);
+				} catch (error) {
+					if (error instanceof CallciumError && NAVIGABILITY_CODES.has(error.code)) {
+						issues.push(unnavigablePath(groupIndex, constraintIndex));
+						continue;
+					}
+					throw error;
+				}
+				if (steps.filter(isQuantifier).length > 1) {
+					issues.push(nestedQuantifier(groupIndex, constraintIndex));
+					continue;
+				}
 				if (walk.quantifiedStaticLength > Limits.MAX_QUANTIFIED_ARRAY_LENGTH) issues.push(quantifierOverStaticLimit(groupIndex, constraintIndex, bigintToHex(BigInt(walk.quantifiedStaticLength)), bigintToHex(BigInt(Limits.MAX_QUANTIFIED_ARRAY_LENGTH))));
 				typeInfo = walk.typeInfo;
 			} else {
-				const ctxId = parsePathSteps(constraint.path)[0];
+				const ctxId = steps[0];
 				if (ctxId > MAX_CONTEXT_PROPERTY_ID) {
 					issues.push(unknownContextProperty(groupIndex, constraintIndex, bigintToHex(BigInt(ctxId)), bigintToHex(BigInt(MAX_CONTEXT_PROPERTY_ID))));
 					typeInfo = {
@@ -2520,21 +2421,20 @@ function validateGroup(data, descBytes, groupIndex, issues) {
 					staticSize: 32
 				};
 			}
-			ctx = initContext(constraint.scope, normalizedPath, typeInfo);
+			ctx = initContext(constraint.scope, normalizedPath, steps, typeInfo);
 			contexts.push(ctx);
 		}
+		if (constraint.scope === Scope.CALLDATA && constraint.hint !== void 0 && ctx.steps.length <= Limits.MAX_PATH_DEPTH) {
+			if (bytesToHex(Descriptor.compileHint(descBytes, ctx.steps)) !== constraint.hint.toLowerCase()) issues.push(hintMismatch(groupIndex, constraintIndex));
+		}
 		validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues);
 		checkFusibleRange(ctx, constraint.operators, groupIndex, constraintIndex, issues);
 	}
 }
-/**
-* Validate a policy for type mismatches, contradictions, redundancies, and vacuities.
-* @param data - The canonical policy data to validate.
-* @returns All validation issues found, ordered by group and constraint index.
-*/
 function validate(data) {
-	const issues = [];
 	const descBytes = hexToBytes(data.descriptor);
+	decodeDescriptor(descBytes);
+	const issues = [];
 	for (let groupIndex = 0; groupIndex < data.groups.length; groupIndex++) {
 		if (data.groups[groupIndex].length === 0) {
 			issues.push(emptyGroup(groupIndex));
@@ -2544,102 +2444,80 @@ function validate(data) {
 	}
 	return issues;
 }
-/** Semantic validation for policies. */
 const PolicyValidator = { validate };
 //#endregion
 //#region src/signature.ts
-/** Return true if the char code is an ASCII letter. */
 function isAlpha(c) {
 	return c >= 65 && c <= 90 || c >= 97 && c <= 122;
 }
-/** Return true if the char code is an ASCII alphanumeric character. */
 function isAlphanum(c) {
 	return isAlpha(c) || c >= 48 && c <= 57;
 }
-/**
-* Parse an ABI function signature into its selector and types.
-*
-* Strict mode: no whitespace, name must match `[A-Za-z_][A-Za-z0-9_]*`,
-* structure must be `name(types)` with the final `)` as the last character.
-*
-* @param signature - A function signature string, e.g. `"transfer(address,uint256)"`.
-* @returns The 4-byte selector and the comma-separated types string.
-* @throws {CallciumError} with code `"INVALID_SIGNATURE"` if the signature is malformed.
-*/
 function parse(signature) {
-	if (signature.length < 3) throw new CallciumError("INVALID_SIGNATURE", `Invalid signature: too short, got "${signature}"`);
+	if (signature.length < 3) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: too short, got "${signature}"`);
 	let openParen = -1;
 	for (let i = 0; i < signature.length; i++) {
 		const c = signature.charCodeAt(i);
-		if (c === 32 || c === 9 || c === 10 || c === 13) throw new CallciumError("INVALID_SIGNATURE", "Signature must not contain whitespace");
-		if (c > 126) throw new CallciumError("INVALID_SIGNATURE", "Signature must contain only ASCII characters");
+		if (c === 32 || c === 9 || c === 10 || c === 13) throw new CallciumError("SIGNATURE_CONTAINS_WHITESPACE", "Signature must not contain whitespace");
+		if (c > 126) throw new CallciumError("MALFORMED_SIGNATURE", "Signature must contain only ASCII characters");
 		if (openParen === -1 && c === 40) openParen = i;
 	}
-	if (openParen < 1) throw new CallciumError("INVALID_SIGNATURE", `Invalid signature: must have a function name followed by parentheses, got "${signature}"`);
-	if (!signature.endsWith(")")) throw new CallciumError("INVALID_SIGNATURE", `Invalid signature: must end with ")", got "${signature}"`);
+	if (openParen < 1) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: must have a function name followed by parentheses, got "${signature}"`);
+	if (!signature.endsWith(")")) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: must end with ")", got "${signature}"`);
 	const firstChar = signature.charCodeAt(0);
-	if (!isAlpha(firstChar) && firstChar !== 95) throw new CallciumError("INVALID_SIGNATURE", "Function name must start with a letter or underscore");
+	if (!isAlpha(firstChar) && firstChar !== 95) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must start with a letter or underscore");
 	for (let i = 1; i < openParen; i++) {
 		const c = signature.charCodeAt(i);
-		if (!isAlphanum(c) && c !== 95) throw new CallciumError("INVALID_SIGNATURE", "Function name must contain only alphanumeric characters or underscores");
+		if (!isAlphanum(c) && c !== 95) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must contain only alphanumeric characters or underscores");
 	}
-	const types = signature.slice(openParen + 1, signature.length - 1);
 	const encoded = new Uint8Array(signature.length);
 	for (let i = 0; i < signature.length; i++) encoded[i] = signature.charCodeAt(i);
 	return {
 		selector: bytesToHex(keccak_256(encoded).subarray(0, 4)),
-		types
+		types: signature.slice(openParen + 1, signature.length - 1)
 	};
 }
-/** ABI function signature parser. */
 const SignatureParser = { parse };
 //#endregion
 //#region src/policy-builder.ts
-/** Validate a context-scope path. */
-function validateContextPath(pathBytes) {
-	if (pathBytes.length !== 2) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope path must be exactly one step (2 bytes).");
-	const step = readU16(pathBytes, 0);
-	if (step > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("INVALID_CONTEXT_PROPERTY", `Unknown context property ID 0x${step.toString(16).padStart(4, "0")}.`);
-}
-/** Validate a calldata-scope path against the descriptor. */
-function validateCalldataPath(path, desc) {
-	const steps = parsePathSteps(path);
-	if (steps.length === 0) throw new CallciumError("INVALID_PATH", "Calldata path must have at least one step.");
+function validateContextPath(steps) {
+	if (steps.length !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope path must be exactly one step.");
+	const step = steps[0];
+	if (step > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID 0x${step.toString(16).padStart(4, "0")}.`);
+}
+function validateCalldataPath(steps, desc) {
 	const argIndex = steps[0];
 	const paramCount = Descriptor.paramCount(desc);
-	if (argIndex >= paramCount) throw new CallciumError("INVALID_PATH", `Argument index ${argIndex} out of range (descriptor has ${paramCount} params).`);
+	if (argIndex >= paramCount) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${argIndex} out of range (descriptor has ${paramCount} params).`);
 	let offset = Descriptor.paramOffset(desc, argIndex);
 	let hasQuantifier = false;
 	for (let i = 1; i < steps.length; i++) {
 		const step = steps[i];
 		const info = Descriptor.inspect(desc, offset);
+		const isArray = info.typeCode === TypeCode.STATIC_ARRAY || info.typeCode === TypeCode.DYNAMIC_ARRAY;
+		if (isQuantifier(step)) {
+			if (!isArray) throw new CallciumError("QUANTIFIER_ON_NON_ARRAY", "Quantifier step is only valid on an array node.");
+			if (hasQuantifier) throw new CallciumError("NESTED_QUANTIFIER", "Nested quantifiers are not allowed.");
+			hasQuantifier = true;
+		}
 		if (info.typeCode === TypeCode.TUPLE) {
-			if (isQuantifier(step)) throw new CallciumError("INVALID_PATH", "Quantifier step is not valid on a tuple node.");
 			const fieldCount = Descriptor.tupleFieldCount(desc, offset);
-			if (step >= fieldCount) throw new CallciumError("INVALID_PATH", `Tuple field index ${step} out of range (tuple has ${fieldCount} fields).`);
+			if (step >= fieldCount) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fieldCount} fields).`);
 			offset = Descriptor.tupleFieldOffset(desc, offset, step);
-		} else if (info.typeCode === TypeCode.STATIC_ARRAY || info.typeCode === TypeCode.DYNAMIC_ARRAY) {
-			if (isQuantifier(step)) {
-				if (hasQuantifier) throw new CallciumError("INVALID_PATH", "Nested quantifiers are not allowed.");
-				hasQuantifier = true;
-			} else if (info.typeCode === TypeCode.STATIC_ARRAY) {
+		} else if (isArray) {
+			if (!isQuantifier(step) && info.typeCode === TypeCode.STATIC_ARRAY) {
 				const arrayLength = Descriptor.staticArrayLength(desc, offset);
-				if (step >= arrayLength) throw new CallciumError("INVALID_PATH", `Array index ${step} out of range (static array has ${arrayLength} elements).`);
+				if (step >= arrayLength) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (static array has ${arrayLength} elements).`);
 			}
 			offset = Descriptor.arrayElementOffset(offset);
-		} else throw new CallciumError("INVALID_PATH", "Cannot descend into an elementary type.");
+		} else throw new CallciumError("NOT_COMPOSITE", "Cannot descend into an elementary type.");
 	}
 }
-/** Fluent builder for constructing Callcium policies. */
 var PolicyBuilder = class PolicyBuilder {
 	draft;
 	constructor(draft) {
 		this.draft = draft;
 	}
-	/**
-	* Create a builder from a function signature.
-	* @param signature - ABI function signature, e.g. `"transfer(address,uint256)"`.
-	*/
 	static create(signature) {
 		const parsed = SignatureParser.parse(signature);
 		const descriptor = DescriptorCoder.fromTypes(parsed.types);
@@ -2651,10 +2529,6 @@ var PolicyBuilder = class PolicyBuilder {
 			pathHashes: [/* @__PURE__ */ new Set()]
 		});
 	}
-	/**
-	* Create a selectorless builder from a raw type string.
-	* @param typesCsv - Comma-separated ABI type strings, e.g. `"address,uint256"`.
-	*/
 	static createRaw(typesCsv) {
 		return new PolicyBuilder({
 			isSelectorless: true,
@@ -2664,73 +2538,50 @@ var PolicyBuilder = class PolicyBuilder {
 			pathHashes: [/* @__PURE__ */ new Set()]
 		});
 	}
-	/**
-	* Add a constraint to the current group.
-	* @param constraint - A `Constraint` object or a `ConstraintBuilder` instance.
-	*/
 	add(constraint) {
 		const c = {
 			scope: constraint.scope,
 			path: constraint.path,
 			operators: [...constraint.operators]
 		};
-		if (c.operators.length === 0) throw new CallciumError("INVALID_CONSTRAINT", "Constraint must have at least one operator.");
-		if (c.scope === Scope.CONTEXT) validateContextPath(hexToBytes(c.path));
-		else if (c.scope === Scope.CALLDATA) validateCalldataPath(c.path, this.draft.descriptor);
+		if (c.operators.length === 0) throw new CallciumError("NO_CONSTRAINT_OPERATORS", "Constraint must have at least one operator.");
+		const steps = parsePathSteps(c.path);
+		if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
+		if (c.scope === Scope.CONTEXT) validateContextPath(steps);
+		else if (c.scope === Scope.CALLDATA) validateCalldataPath(steps, this.draft.descriptor);
 		else throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${c.scope}.`);
 		const key = `${c.scope}:${c.path.toLowerCase()}`;
 		const currentHashes = this.draft.pathHashes[this.draft.pathHashes.length - 1];
-		if (currentHashes.has(key)) throw new CallciumError("DUPLICATE_PATH", `Duplicate path ${c.path} in the same group.`);
+		if (currentHashes.has(key)) throw new CallciumError("DUPLICATE_PATH_IN_GROUP", `Duplicate path ${c.path} in the same group.`);
 		currentHashes.add(key);
 		this.draft.groups[this.draft.groups.length - 1].push(c);
 		return this;
 	}
-	/** Start a new constraint group (OR branch). */
 	or() {
 		if (this.draft.groups[this.draft.groups.length - 1].length === 0) throw new CallciumError("EMPTY_GROUP", "Cannot start a new group when the current group is empty.");
 		this.draft.groups.push([]);
 		this.draft.pathHashes.push(/* @__PURE__ */ new Set());
 		return this;
 	}
-	/**
-	* Build the policy into an encoded binary blob with strict validation.
-	* Throws on any issue, regardless of severity. Use {@link validate} to
-	* inspect issues, or {@link buildUnsafe} to encode without validation.
-	* @returns The policy as a 0x-prefixed hex string.
-	* @throws {CallciumError} If any group is empty or validation finds any issue.
-	*/
 	build() {
 		this.checkGroups();
 		const policyData = this.toPolicyData();
 		const issues = PolicyValidator.validate(policyData);
-		if (issues.length > 0) throw new CallciumError("VALIDATION_ERROR", issues[0].message);
+		if (issues.length > 0) throw new ValidationError(issues);
 		return PolicyCoder.encode(policyData);
 	}
-	/**
-	* Build the policy into an encoded binary blob without validation.
-	* The resulting policy may be invalid. Prefer {@link build}; use this
-	* only to knowingly bypass a reported issue.
-	* @returns The policy as a 0x-prefixed hex string.
-	* @throws {CallciumError} If any group is empty.
-	*/
 	buildUnsafe() {
 		this.checkGroups();
 		return PolicyCoder.encode(this.toPolicyData());
 	}
-	/**
-	* Validate the policy without encoding.
-	* @returns All validation issues found.
-	*/
 	validate() {
 		this.checkGroups();
 		const policyData = this.toPolicyData();
 		return PolicyValidator.validate(policyData);
 	}
-	/** Throw if any group is empty. */
 	checkGroups() {
 		for (let i = 0; i < this.draft.groups.length; i++) if (this.draft.groups[i].length === 0) throw new CallciumError("EMPTY_GROUP", `Group ${i} is empty.`);
 	}
-	/** Convert the draft to a PolicyData structure. */
 	toPolicyData() {
 		return {
 			isSelectorless: this.draft.isSelectorless,
@@ -2742,13 +2593,9 @@ var PolicyBuilder = class PolicyBuilder {
 };
 //#endregion
 //#region src/constraint.ts
-/** Strip an optional 0x prefix and validate a 40-hex-char (20-byte) address body. */
 function addressBody(value) {
-	const body = value.startsWith("0x") ? value.slice(2) : value;
-	if (body.length !== 40) throw new CallciumError("INVALID_CONSTRAINT", `Invalid address length: expected 40 hex chars, got ${body.length}`);
-	return body;
+	return toAddress(value).slice(2);
 }
-/** Convert a scalar value to a 32-byte big-endian word. */
 function encodeWord(value) {
 	const word = new Uint8Array(32);
 	if (typeof value === "boolean") {
@@ -2757,11 +2604,7 @@ function encodeWord(value) {
 	}
 	if (typeof value === "string") {
 		const body = addressBody(value);
-		for (let i = 0; i < 20; i++) {
-			const byte = parseInt(body.substring(i * 2, i * 2 + 2), 16);
-			if (Number.isNaN(byte)) throw new CallciumError("INVALID_CONSTRAINT", `Invalid hex character in address at position ${i * 2}`);
-			word[12 + i] = byte;
-		}
+		for (let i = 0; i < 20; i++) word[12 + i] = parseInt(body.substring(i * 2, i * 2 + 2), 16);
 		return word;
 	}
 	let bigValue = typeof value === "number" ? BigInt(value) : value;
@@ -2771,14 +2614,12 @@ function encodeWord(value) {
 	}
 	return word;
 }
-/** Pack a scalar value as a hex operator payload (opCode byte + 32-byte word). */
 function singleOp(opCode, value) {
 	const buffer = new Uint8Array(33);
 	buffer[0] = opCode;
 	buffer.set(encodeWord(value), 1);
 	return bytesToHex(buffer);
 }
-/** Pack a range operator (opCode byte + min word + max word). */
 function rangeOp(opCode, min, max) {
 	if (min > max) throw new CallciumError("INVALID_RANGE", `Range min (${min}) must not exceed max (${max})`);
 	const buffer = new Uint8Array(65);
@@ -2787,7 +2628,7 @@ function rangeOp(opCode, min, max) {
 	buffer.set(encodeWord(max), 33);
 	return bytesToHex(buffer);
 }
-/** Convert values to bigint, sort ascending (unsigned), deduplicate, and pack as set payload. */
+const MAX_SET_MEMBERS = Limits.MAX_SET_MEMBERS;
 function setOp(opCode, values) {
 	const bigs = values.map((v) => {
 		if (typeof v === "bigint") return v;
@@ -2799,118 +2640,81 @@ function setOp(opCode, values) {
 	const deduped = [];
 	for (const value of bigs) if (deduped.length === 0 || deduped[deduped.length - 1] !== value) deduped.push(value);
 	if (deduped.length === 0) throw new CallciumError("EMPTY_SET", "Set must contain at least one value");
+	if (deduped.length > MAX_SET_MEMBERS) throw new CallciumError("SET_TOO_LARGE", `Set must contain at most ${MAX_SET_MEMBERS} values`);
 	const buffer = new Uint8Array(1 + deduped.length * 32);
 	buffer[0] = opCode;
 	for (let i = 0; i < deduped.length; i++) buffer.set(encodeWord(deduped[i]), 1 + i * 32);
 	return bytesToHex(buffer);
 }
-/** Encode a sequence of uint16 path steps as a big-endian hex string. */
 function encodePath(steps) {
 	const buffer = new Uint8Array(steps.length * 2);
 	for (let i = 0; i < steps.length; i++) writeBE16(buffer, i * 2, steps[i]);
 	return bytesToHex(buffer);
 }
-/**
-* Mutable builder that accumulates operators targeting a single path.
-* Implements the `Constraint` interface so it can be passed directly to policy builders.
-*/
 var ConstraintBuilder = class {
 	scope;
 	path;
 	operators;
-	/** @internal */
 	constructor(scope, path) {
 		this.scope = scope;
 		this.path = path;
 		this.operators = [];
 	}
-	/** Push a pre-encoded operator hex string and return this for chaining. */
 	push(opHex) {
 		this.operators.push(opHex);
 		return this;
 	}
-	/** Assert the value equals `value`. */
 	eq(value) {
 		return this.push(singleOp(Op.EQ, value));
 	}
-	/** Assert the value does not equal `value`. */
 	neq(value) {
 		return this.push(singleOp(Op.EQ | Op.NOT, value));
 	}
-	/** Assert the value is greater than `bound`. */
 	gt(bound) {
 		return this.push(singleOp(Op.GT, bound));
 	}
-	/** Assert the value is less than `bound`. */
 	lt(bound) {
 		return this.push(singleOp(Op.LT, bound));
 	}
-	/** Assert the value is greater than or equal to `bound`. */
 	gte(bound) {
 		return this.push(singleOp(Op.GTE, bound));
 	}
-	/** Assert the value is less than or equal to `bound`. */
 	lte(bound) {
 		return this.push(singleOp(Op.LTE, bound));
 	}
-	/**
-	* Assert the value is within [min, max] inclusive.
-	* @throws {CallciumError} If min > max.
-	*/
 	between(min, max) {
 		return this.push(rangeOp(Op.BETWEEN, BigInt(min), BigInt(max)));
 	}
-	/**
-	* Assert the value is a member of the set.
-	* Values are sorted and deduplicated before encoding.
-	* @throws {CallciumError} If the set is empty after deduplication.
-	*/
 	isIn(values) {
 		return this.push(setOp(Op.IN, values));
 	}
-	/**
-	* Assert the value is not a member of the set.
-	* @throws {CallciumError} If the set is empty after deduplication.
-	*/
 	notIn(values) {
 		return this.push(setOp(Op.IN | Op.NOT, values));
 	}
-	/** Assert all bits in `mask` are set. */
 	bitmaskAll(mask) {
 		return this.push(singleOp(Op.BITMASK_ALL, mask));
 	}
-	/** Assert at least one bit in `mask` is set. */
 	bitmaskAny(mask) {
 		return this.push(singleOp(Op.BITMASK_ANY, mask));
 	}
-	/** Assert no bit in `mask` is set. */
 	bitmaskNone(mask) {
 		return this.push(singleOp(Op.BITMASK_NONE, mask));
 	}
-	/** Assert the runtime length equals `n`. */
 	lengthEq(n) {
 		return this.push(singleOp(Op.LENGTH_EQ, n));
 	}
-	/** Assert the runtime length is greater than `n`. */
 	lengthGt(n) {
 		return this.push(singleOp(Op.LENGTH_GT, n));
 	}
-	/** Assert the runtime length is less than `n`. */
 	lengthLt(n) {
 		return this.push(singleOp(Op.LENGTH_LT, n));
 	}
-	/** Assert the runtime length is greater than or equal to `n`. */
 	lengthGte(n) {
 		return this.push(singleOp(Op.LENGTH_GTE, n));
 	}
-	/** Assert the runtime length is less than or equal to `n`. */
 	lengthLte(n) {
 		return this.push(singleOp(Op.LENGTH_LTE, n));
 	}
-	/**
-	* Assert the runtime length is within [min, max] inclusive.
-	* @throws {CallciumError} If min > max.
-	*/
 	lengthBetween(min, max) {
 		return this.push(rangeOp(Op.LENGTH_BETWEEN, BigInt(min), BigInt(max)));
 	}
@@ -2918,418 +2722,60 @@ var ConstraintBuilder = class {
 function arg(...steps) {
 	return new ConstraintBuilder(Scope.CALLDATA, encodePath(steps));
 }
-/** Target the `msg.sender` context property. */
 function msgSender() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_SENDER]));
 }
-/** Target the `msg.value` context property. */
 function msgValue() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_VALUE]));
 }
-/** Target the `block.timestamp` context property. */
 function blockTimestamp() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_TIMESTAMP]));
 }
-/** Target the `block.number` context property. */
 function blockNumber() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_NUMBER]));
 }
-/** Target the `block.chainid` context property. */
 function chainId() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.CHAIN_ID]));
 }
-/** Target the `tx.origin` context property. */
 function txOrigin() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.TX_ORIGIN]));
 }
-/** Target the `block.basefee` context property. */
 function baseFee() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BASE_FEE]));
 }
-/** Target the `tx.gasprice` context property. */
 function gasPrice() {
 	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.GAS_PRICE]));
 }
 //#endregion
-//#region src/reader.ts
-/** Read 32 bytes at offset, bounds-checked. */
-function load32(callData, offset) {
+//#region src/calldata-reader.ts
+function loadWord(callData, offset) {
 	if (offset < 0 || offset + 32 > callData.length) return { code: "CALLDATA_OUT_OF_BOUNDS" };
 	return callData.subarray(offset, offset + 32);
 }
-/**
-* Read ABI pointer (offset or length) from a 32-byte slot.
-* Validates high 28 bytes are zero (rejects values > 32-bit).
-*/
 function readPointer(callData, head) {
-	const word = load32(callData, head);
+	const word = loadWord(callData, head);
 	if (word instanceof Uint8Array) {
 		for (let i = 0; i < 28; i++) if (word[i] !== 0) return { code: "CALLDATA_OUT_OF_BOUNDS" };
 		return (word[28] << 24 | word[29] << 16 | word[30] << 8 | word[31]) >>> 0;
 	}
 	return word;
 }
-/** Return the number of bytes this node occupies in the head region. */
-function headContribution(node) {
-	return node.isDynamic ? 32 : node.staticSize;
-}
-/** Read a single BE16 path step at the given step index. */
-function readStep(pathBytes, stepIndex) {
-	return readU16(pathBytes, stepIndex * 2);
-}
-/** Navigate one path step through a node (tuple field, array element, or quantifier). */
-function descend(node, callData, head, base, childIndex) {
-	if (node.type === "tuple") return descendTuple(node, callData, head, base, childIndex);
-	if (node.type === "dynamicArray") return descendDynamicArray(node, callData, head, base, childIndex);
-	if (node.type === "staticArray") return descendStaticArray(node, callData, head, base, childIndex);
-	throw new CallciumError("INVALID_PATH", `Cannot descend into elementary type (${node.type}).`);
-}
-/** Descend into a tuple field by index. */
-function descendTuple(node, callData, head, base, childIndex) {
-	if (childIndex >= node.fields.length) throw new CallciumError("INVALID_PATH", `Tuple field index ${childIndex} out of range (${node.fields.length} fields).`);
-	let tupleBase;
-	let cursor;
-	if (node.isDynamic) {
-		const ptrResult = readPointer(callData, head);
-		if (typeof ptrResult !== "number") return {
-			ok: false,
-			code: ptrResult.code
-		};
-		tupleBase = base + ptrResult;
-		cursor = tupleBase;
-	} else {
-		tupleBase = base;
-		cursor = head;
-	}
-	for (let i = 0; i < childIndex; i++) cursor += headContribution(node.fields[i]);
-	return {
-		ok: true,
-		location: {
-			head: cursor,
-			base: tupleBase,
-			node: node.fields[childIndex]
-		}
-	};
-}
-/** Descend into a dynamic array element by index. */
-function descendDynamicArray(node, callData, head, base, childIndex) {
-	const arrayBaseResult = readPointer(callData, head);
-	if (typeof arrayBaseResult !== "number") return {
-		ok: false,
-		code: arrayBaseResult.code
-	};
-	const arrayBase = base + arrayBaseResult;
-	const lengthResult = readPointer(callData, arrayBase);
-	if (typeof lengthResult !== "number") return {
-		ok: false,
-		code: lengthResult.code
-	};
-	if (childIndex >= lengthResult) return {
-		ok: false,
-		code: "ARRAY_INDEX_OUT_OF_BOUNDS"
-	};
-	const headsBase = arrayBase + 32;
-	const elem = node.element;
-	if (elem.isDynamic) return {
-		ok: true,
-		location: {
-			head: headsBase + childIndex * 32,
-			base: headsBase,
-			node: elem
-		}
-	};
-	return {
-		ok: true,
-		location: {
-			head: headsBase + childIndex * elem.staticSize,
-			base: arrayBase,
-			node: elem
-		}
-	};
-}
-/** Descend into a static array element by index. */
-function descendStaticArray(node, callData, head, base, childIndex) {
-	if (childIndex >= node.length) throw new CallciumError("INVALID_PATH", `Static array index ${childIndex} out of range (length ${node.length}).`);
-	const elem = node.element;
-	if (elem.isDynamic) {
-		const ptrResult = readPointer(callData, head);
-		if (typeof ptrResult !== "number") return {
-			ok: false,
-			code: ptrResult.code
-		};
-		const arrayBase = base + ptrResult;
-		return {
-			ok: true,
-			location: {
-				head: arrayBase + childIndex * 32,
-				base: arrayBase,
-				node: elem
-			}
-		};
-	}
-	return {
-		ok: true,
-		location: {
-			head: head + childIndex * elem.staticSize,
-			base,
-			node: elem
-		}
-	};
-}
-/**
-* Resolve a path to a calldata location, stopping at a leaf or quantifier.
-*
-* The path is a sequence of BE16 steps. The first step selects the top-level
-* parameter; subsequent steps descend into tuples and arrays. If a quantifier
-* step is encountered, returns a QuantifierResult with the array location and
-* remaining path suffix.
-*/
-function locate(tree, callData, pathBytes, baseOffset) {
-	const stepCount = pathBytes.length / 2;
-	if (stepCount === 0) throw new CallciumError("INVALID_PATH", "Path is empty.");
-	const paramIndex = readStep(pathBytes, 0);
-	if (paramIndex >= tree.length) throw new CallciumError("INVALID_PATH", `Param index ${paramIndex} out of range (${tree.length} params).`);
-	let head = baseOffset;
-	for (let i = 0; i < paramIndex; i++) head += headContribution(tree[i]);
-	let base = baseOffset;
-	let node = tree[paramIndex];
-	for (let stepIndex = 1; stepIndex < stepCount; stepIndex++) {
-		const step = readStep(pathBytes, stepIndex);
-		if (isQuantifier(step)) {
-			const remaining = pathBytes.subarray((stepIndex + 1) * 2);
-			for (let remainingStepIndex = 0; remainingStepIndex < remaining.length / 2; remainingStepIndex++) if (isQuantifier(readStep(remaining, remainingStepIndex))) throw new CallciumError("INVALID_QUANTIFIER", "Nested quantifiers are not supported.");
-			return {
-				ok: true,
-				type: "quantifier",
-				quantifier: {
-					quantifier: step,
-					location: {
-						head,
-						base,
-						node
-					},
-					remainingPath: remaining
-				}
-			};
-		}
-		const result = descend(node, callData, head, base, step);
-		if (!result.ok) return {
-			ok: false,
-			code: result.code
-		};
-		head = result.location.head;
-		base = result.location.base;
-		node = result.location.node;
-	}
-	return {
-		ok: true,
-		type: "leaf",
-		location: {
-			head,
-			base,
-			node
-		}
-	};
-}
-/**
-* Build the element-shape fields shared by dynamic- and static-array nodes, branching only on
-* whether the element itself is dynamic.
-*/
-function makeArrayShape(length, elem, dynamicHeadsBase, staticDataOffset, staticCompositeBase) {
-	return elem.isDynamic ? {
-		length,
-		elementNode: elem,
-		elementIsDynamic: true,
-		elementStaticSize: 0,
-		headsBase: dynamicHeadsBase,
-		dataOffset: 0,
-		compositeBase: dynamicHeadsBase
-	} : {
-		length,
-		elementNode: elem,
-		elementIsDynamic: false,
-		elementStaticSize: elem.staticSize,
-		headsBase: 0,
-		dataOffset: staticDataOffset,
-		compositeBase: staticCompositeBase
-	};
-}
-/** Extract array shape from a location pointing to an array node. */
-function arrayShape(callData, location) {
-	const { head, base, node } = location;
-	if (node.type === "dynamicArray") {
-		const arrayBaseResult = readPointer(callData, head);
-		if (typeof arrayBaseResult !== "number") return {
-			ok: false,
-			code: arrayBaseResult.code
-		};
-		const arrayBase = base + arrayBaseResult;
-		const lengthResult = readPointer(callData, arrayBase);
-		if (typeof lengthResult !== "number") return {
-			ok: false,
-			code: lengthResult.code
-		};
-		const headsBase = arrayBase + 32;
-		return {
-			ok: true,
-			shape: makeArrayShape(lengthResult, node.element, headsBase, headsBase, arrayBase)
-		};
-	}
-	if (node.type === "staticArray") {
-		const elem = node.element;
-		let dynamicHeadsBase = 0;
-		if (elem.isDynamic) {
-			const arrayBaseResult = readPointer(callData, head);
-			if (typeof arrayBaseResult !== "number") return {
-				ok: false,
-				code: arrayBaseResult.code
-			};
-			dynamicHeadsBase = base + arrayBaseResult;
-		}
-		return {
-			ok: true,
-			shape: makeArrayShape(node.length, elem, dynamicHeadsBase, head, base)
-		};
-	}
-	throw new CallciumError("INVALID_PATH", `Cannot compute array shape for non-array node (${node.type}).`);
-}
-/** Compute the location for element N within a precomputed array shape. */
-function arrayElementAt(shape, index, callData) {
-	if (index >= shape.length) return {
-		ok: false,
-		code: "ARRAY_INDEX_OUT_OF_BOUNDS"
-	};
-	let head;
-	let base;
-	if (!shape.elementIsDynamic) {
-		head = shape.dataOffset + index * shape.elementStaticSize;
-		base = shape.compositeBase;
-	} else {
-		head = shape.headsBase + index * 32;
-		base = shape.headsBase;
-	}
-	if (head + 32 > callData.length) return {
-		ok: false,
-		code: "CALLDATA_OUT_OF_BOUNDS"
-	};
-	return {
-		ok: true,
-		location: {
-			head,
-			base,
-			node: shape.elementNode
-		}
-	};
-}
-/** Load a 32-byte scalar value from a resolved location. */
-function loadScalar(callData, location) {
-	const result = load32(callData, location.head);
-	if (result instanceof Uint8Array) return {
-		ok: true,
-		value: result
-	};
-	return {
-		ok: false,
-		code: result.code
-	};
-}
-/** Load the data offset and logical length for a dynamic type (bytes, string, or dynamic array). */
-function loadSlice(callData, location) {
-	const ptrResult = readPointer(callData, location.head);
-	if (typeof ptrResult !== "number") return {
-		ok: false,
-		code: ptrResult.code
-	};
-	const dataStart = location.base + ptrResult;
-	const lengthResult = readPointer(callData, dataStart);
-	if (typeof lengthResult !== "number") return {
-		ok: false,
-		code: lengthResult.code
-	};
-	const dataOffset = dataStart + 32;
-	const node = location.node;
-	const stride = node.type === "dynamicArray" ? node.element.isDynamic ? 32 : node.element.staticSize : 1;
-	if (dataOffset > callData.length || lengthResult > Math.floor((callData.length - dataOffset) / stride)) return {
-		ok: false,
-		code: "CALLDATA_OUT_OF_BOUNDS"
-	};
-	return {
-		ok: true,
-		dataOffset,
-		length: lengthResult
-	};
-}
-/** Continue navigating through additional path steps from a resolved location. */
-function descendPath(callData, location, pathBytes) {
-	const stepCount = pathBytes.length / 2;
-	let { head, base, node } = location;
-	for (let stepIndex = 0; stepIndex < stepCount; stepIndex++) {
-		const step = readStep(pathBytes, stepIndex);
-		const result = descend(node, callData, head, base, step);
-		if (!result.ok) return {
-			ok: false,
-			code: result.code
-		};
-		head = result.location.head;
-		base = result.location.base;
-		node = result.location.node;
-	}
-	return {
-		ok: true,
-		location: {
-			head,
-			base,
-			node
-		}
-	};
-}
 //#endregion
 //#region src/policy-enforcer.ts
-/** Violations that abort evaluation instead of failing only their group (spec §10.3). */
 const ABORT_VIOLATION_CODES = new Set([
 	"CALLDATA_OUT_OF_BOUNDS",
 	"ARRAY_INDEX_OUT_OF_BOUNDS",
+	"NON_CANONICAL_VALUE",
 	"QUANTIFIER_LIMIT_EXCEEDED"
 ]);
-/** Convert a hex address to a 256-bit bigint (zero-padded to 32 bytes). */
 function addressToBigInt(hex) {
 	const bytes = hexToBytes(hex);
 	const padded = new Uint8Array(32);
 	padded.set(bytes, 32 - bytes.length);
 	return toBigInt(padded, 0);
 }
-/**
-* Walk a descriptor subtree through path steps and return the terminal leaf type code.
-*
-* Used only for violation metadata. Valid policies have structurally valid
-* quantifier suffixes (enforced by `PolicyValidator`); if a hand-crafted blob
-* violates that invariant, return the last resolvable node's type code as
-* best-effort diagnostic context.
-*/
-function resolveLeafTypeCode(elementNode, remainingPath) {
-	let node = elementNode;
-	const stepCount = remainingPath.length / 2;
-	for (let step = 0; step < stepCount; step++) {
-		const childIndex = readU16(remainingPath, step * 2);
-		if (node.type === "tuple") {
-			const field = node.fields[childIndex];
-			if (!field) break;
-			node = field;
-		} else if (node.type === "staticArray" || node.type === "dynamicArray") node = node.element;
-		else break;
-	}
-	return node.typeCode;
-}
-/**
-* Check a policy against ABI-encoded call data without throwing on violations.
-* @param policy - Binary policy blob as 0x-prefixed hex string.
-* @param callData - ABI-encoded call data as 0x-prefixed hex string.
-* @param context - Optional execution context for context-scoped rules.
-* @returns Pass with matched group index, or fail with one violation per evaluated failing group.
-* @throws {CallciumError} If the policy blob is structurally malformed.
-*/
 function check(policy, callData, context) {
-	const { policy: decoded, tree } = decodePolicy(policy);
+	const { policy: decoded, data: policyBytes } = decodePolicy(policy);
 	const callDataBytes = hexToBytes(callData);
 	if (!decoded.isSelectorless) {
 		if (callDataBytes.length < 4) return {
@@ -3354,7 +2800,7 @@ function check(policy, callData, context) {
 		let groupFailed = false;
 		for (let ruleIndex = 0; ruleIndex < group.rules.length; ruleIndex++) {
 			const rule = group.rules[ruleIndex];
-			const violation = evaluateRule(rule, tree, callDataBytes, baseOffset, groupIndex, ruleIndex, context);
+			const violation = evaluateRule(rule, policyBytes, callDataBytes, baseOffset, groupIndex, ruleIndex, context);
 			if (violation !== null) {
 				allViolations.push(violation);
 				if (ABORT_VIOLATION_CODES.has(violation.code)) return {
@@ -3375,153 +2821,183 @@ function check(policy, callData, context) {
 		violations: allViolations
 	};
 }
-/**
-* Enforce a policy against ABI-encoded call data, throwing on violation.
-* @param policy - Binary policy blob as 0x-prefixed hex string.
-* @param callData - ABI-encoded call data as 0x-prefixed hex string.
-* @param context - Optional execution context for context-scoped rules.
-* @throws {PolicyViolationError} If the policy rejects the call data.
-* @throws {CallciumError} If the policy blob is structurally malformed.
-*/
 function enforce(policy, callData, context) {
 	const result = check(policy, callData, context);
 	if (!result.ok) throw new PolicyViolationError(result.violations);
 }
-/** Evaluate a single rule against calldata or context, returning a violation or null on pass. */
-function evaluateRule(rule, tree, callDataBytes, baseOffset, groupIndex, ruleIndex, context) {
-	const scope = rule.scope.value;
-	const pathBytes = hexToBytes(rule.path.value);
+function fieldBytes(policyBytes, field) {
+	return policyBytes.subarray(field.span.start, field.span.end);
+}
+function evaluateRule(rule, policyBytes, callDataBytes, baseOffset, groupIndex, ruleIndex, context) {
 	const opCode = rule.opCode.value;
-	const operandData = hexToBytes(rule.data.value);
-	if (scope === Scope.CONTEXT) return evaluateContextRule(pathBytes, opCode, operandData, groupIndex, ruleIndex, rule.path.value, context);
-	const locResult = locate(tree, callDataBytes, pathBytes, baseOffset);
-	if (!locResult.ok) return {
-		group: groupIndex,
-		rule: ruleIndex,
-		code: locResult.code,
-		scope: Scope.CALLDATA,
-		path: rule.path.value,
-		opCode,
-		operandData: rule.data.value
-	};
-	if (locResult.type === "quantifier") return evaluateQuantifier(locResult.quantifier, callDataBytes, opCode, operandData, groupIndex, ruleIndex, rule.path.value);
-	return evaluateLeaf(locResult.location, callDataBytes, opCode, operandData, groupIndex, ruleIndex, rule.path.value);
+	const operandData = fieldBytes(policyBytes, rule.data);
+	if (rule.scope.value === Scope.CONTEXT) return evaluateContextRule(fieldBytes(policyBytes, rule.path), opCode, operandData, groupIndex, ruleIndex, rule.path.value, context);
+	if (rule.hint === void 0) throw new CallciumError("MALFORMED_HINT", "Calldata rule carries no hint block");
+	return evaluateCalldataRule(fieldBytes(policyBytes, rule.hint), callDataBytes, baseOffset, opCode, operandData, groupIndex, ruleIndex, rule.path.value);
 }
-/** Evaluate a context-scoped rule by resolving the property from the execution context. */
-function evaluateContextRule(pathBytes, opCode, operandData, groupIndex, ruleIndex, pathHex, context) {
-	const propertyId = readU16(pathBytes, 0);
-	if (propertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("INVALID_CONTEXT_PATH", `Unknown context property ID 0x${propertyId.toString(16).padStart(4, "0")}`);
-	const propInfo = lookupContextProperty(propertyId);
-	const contextValue = context?.[propInfo.contextKey];
-	if (contextValue === void 0) return {
-		group: groupIndex,
-		rule: ruleIndex,
-		code: "MISSING_CONTEXT",
-		scope: Scope.CONTEXT,
-		path: pathHex,
-		typeCode: propInfo.typeCode
-	};
-	let value;
-	if (typeof contextValue === "string") value = addressToBigInt(contextValue);
-	else value = contextValue;
-	if (!applyOperator(opCode, value, 32, operandData, propInfo.typeCode)) return {
-		group: groupIndex,
-		rule: ruleIndex,
-		code: "VALUE_MISMATCH",
-		scope: Scope.CONTEXT,
-		path: pathHex,
-		opCode,
-		operandData: bytesToHex(operandData),
-		typeCode: propInfo.typeCode,
-		resolvedValue: bigintToHex(value)
-	};
-	return null;
+function readTargetBlock(hint, targetOffset) {
+	return {
+		targetDelta: readU32(hint, targetOffset),
+		targetMeta: readU16(hint, targetOffset + PolicyFormat.HINT_TARGET_META_OFFSET),
+		typeCode: hint[targetOffset + PolicyFormat.HINT_TARGET_TYPECODE_OFFSET]
+	};
+}
+function follow(callData, from, at) {
+	const word = readPointer(callData, at);
+	if (typeof word !== "number") return word;
+	return from + word;
+}
+function chainResolve(hint, callData, base, hopsOffset, hopCount) {
+	for (let i = 0; i < hopCount; i++) {
+		const hop = hopsOffset + i * PolicyFormat.HINT_HOP_SIZE;
+		const index = readU16(hint, hop + PolicyFormat.HINT_HOP_INDEX_OFFSET);
+		if (index === PolicyFormat.HINT_NO_INDEX) {
+			const next = follow(callData, base, base + readU32(hint, hop));
+			if (typeof next !== "number") return next;
+			base = next;
+			continue;
+		}
+		const meta = readU16(hint, hop + PolicyFormat.HINT_HOP_META_OFFSET);
+		let elems = base;
+		if ((meta & PolicyFormat.HINT_META_DYNAMIC_ARRAY) !== 0) {
+			const length = readPointer(callData, elems);
+			if (typeof length !== "number") return length;
+			if (index >= length) return { code: "ARRAY_INDEX_OUT_OF_BOUNDS" };
+			elems += 32;
+		}
+		const slot = elems + index * (meta & PolicyFormat.HINT_META_STRIDE_MASK) * 32;
+		if ((meta & PolicyFormat.HINT_META_ELEM_DYNAMIC) !== 0) {
+			const next = follow(callData, elems, slot);
+			if (typeof next !== "number") return next;
+			base = next;
+		} else base = slot;
+	}
+	return base;
 }
-/**
-* Load a value from calldata at the given location and apply the operator.
-*
-* `resolvedValue` is normalised at the decision point: length operators encode
-* the byte/element count as a hex bigint; scalar operators preserve the full
-* 32-byte ABI word so downstream rendering can decode left-aligned `bytesN` faithfully.
-*/
-function applyLeafOperator(callDataBytes, location, opCode, operandData) {
-	const { node } = location;
-	if (isLengthOp(opCode)) {
-		let valueLength;
-		if (node.isDynamic) {
-			const lengthResult = loadSlice(callDataBytes, location);
-			if (!lengthResult.ok) return { error: lengthResult.code };
-			valueLength = lengthResult.length;
-		} else valueLength = node.staticSize;
+function evalTarget(callData, target, block, opCode, operandData) {
+	const typeCode = block.typeCode;
+	if (isLengthValidType(typeCode)) {
+		if (!isLengthOp(opCode)) throw new CallciumError("OPERATOR_TARGET_MISMATCH", "Value operator on a target without a scalar word.");
+		const length = readPointer(callData, target);
+		if (typeof length !== "number") return { error: length.code };
+		const stride = typeCode === TypeCode.DYNAMIC_ARRAY ? (block.targetMeta & PolicyFormat.HINT_META_STRIDE_MASK) * 32 : 1;
+		const room = callData.length - (target + 32);
+		if (stride !== 0 && length > Math.floor(room / stride)) return { error: "CALLDATA_OUT_OF_BOUNDS" };
 		return {
-			passed: applyOperator(opCode, 0n, valueLength, operandData, node.typeCode),
-			resolvedValue: bigintToHex(BigInt(valueLength))
+			passed: applyOperator(opCode, 0n, length, operandData, typeCode),
+			value: BigInt(length)
 		};
 	}
-	if (node.isDynamic || node.type !== "elementary") throw new CallciumError("NOT_SCALAR", "Value operator on a target without a scalar word.");
-	const result = loadScalar(callDataBytes, location);
-	if (!result.ok) return { error: result.code };
-	const value = canonicalize(toBigInt(result.value, 0), node.typeCode);
+	if (classifyTypeCode(typeCode).typeClass !== "elementary") throw new CallciumError("OPERATOR_TARGET_MISMATCH", "Operator target does not carry a scalar word.");
+	const word = loadWord(callData, target);
+	if (!(word instanceof Uint8Array)) return { error: word.code };
+	const value = toBigInt(word, 0);
+	if (canonicalize(value, typeCode) !== value) return {
+		error: "NON_CANONICAL_VALUE",
+		value
+	};
 	return {
-		passed: applyOperator(opCode, value, 32, operandData, node.typeCode),
-		resolvedValue: bigintToHex(value)
+		passed: applyOperator(opCode, value, 32, operandData, typeCode),
+		value
 	};
 }
-/** Evaluate a leaf rule, producing a violation on failure or null on pass. */
-function evaluateLeaf(location, callDataBytes, opCode, operandData, groupIndex, ruleIndex, pathHex) {
-	const result = applyLeafOperator(callDataBytes, location, opCode, operandData);
-	const typeCode = location.node.typeCode;
-	if ("error" in result) return {
-		group: groupIndex,
-		rule: ruleIndex,
-		code: result.error,
+function navigationViolation(frame, code, elementIndex) {
+	return {
+		group: frame.group,
+		rule: frame.rule,
+		code,
 		scope: Scope.CALLDATA,
-		path: pathHex,
-		opCode,
-		operandData: bytesToHex(operandData),
-		typeCode
-	};
-	if (!result.passed) return {
-		group: groupIndex,
-		rule: ruleIndex,
+		path: frame.path,
+		opCode: frame.opCode,
+		operandData: bytesToHex(frame.operandData),
+		typeCode: frame.typeCode,
+		...elementIndex !== void 0 && { elementIndex }
+	};
+}
+function targetViolation(frame, result, elementIndex) {
+	if ("error" in result) {
+		if (result.error === "NON_CANONICAL_VALUE") return {
+			group: frame.group,
+			rule: frame.rule,
+			code: result.error,
+			scope: Scope.CALLDATA,
+			path: frame.path,
+			opCode: frame.opCode,
+			operandData: bytesToHex(frame.operandData),
+			typeCode: frame.typeCode,
+			resolvedValue: bigintToHex(result.value),
+			...elementIndex !== void 0 && { elementIndex }
+		};
+		return navigationViolation(frame, result.error, elementIndex);
+	}
+	if (result.passed) return null;
+	return {
+		group: frame.group,
+		rule: frame.rule,
 		code: "VALUE_MISMATCH",
 		scope: Scope.CALLDATA,
+		path: frame.path,
+		opCode: frame.opCode,
+		operandData: bytesToHex(frame.operandData),
+		typeCode: frame.typeCode,
+		resolvedValue: bigintToHex(result.value),
+		...elementIndex !== void 0 && { elementIndex }
+	};
+}
+function evaluateCalldataRule(hint, callDataBytes, baseOffset, opCode, operandData, groupIndex, ruleIndex, pathHex) {
+	const header = hint[0];
+	const hopCount = header & PolicyFormat.HINT_HOP_COUNT_MASK;
+	const kind = header >> PolicyFormat.HINT_KIND_SHIFT;
+	const hopsOffset = PolicyFormat.HINT_HEADER_SIZE;
+	if (kind !== PolicyFormat.HINT_KIND_NONE) return evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, hopCount, opCode, operandData, groupIndex, ruleIndex, pathHex);
+	const block = readTargetBlock(hint, hopsOffset + hopCount * PolicyFormat.HINT_HOP_SIZE);
+	const frame = {
+		group: groupIndex,
+		rule: ruleIndex,
 		path: pathHex,
 		opCode,
-		operandData: bytesToHex(operandData),
-		typeCode,
-		resolvedValue: result.resolvedValue
-	};
-	return null;
-}
-/** Evaluate a quantified rule by iterating over array elements with ALL/ANY semantics. */
-function evaluateQuantifier(qResult, callDataBytes, opCode, operandData, groupIndex, ruleIndex, pathHex) {
-	const { quantifier, location: arrayLocation, remainingPath } = qResult;
-	const operandHex = bytesToHex(operandData);
-	const arrayNode = arrayLocation.node;
-	const leafTypeCode = resolveLeafTypeCode(arrayNode.type === "staticArray" || arrayNode.type === "dynamicArray" ? arrayNode.element : arrayNode, remainingPath);
-	const shapeResult = arrayShape(callDataBytes, arrayLocation);
-	if (!shapeResult.ok) return {
+		operandData,
+		typeCode: block.typeCode
+	};
+	const base = chainResolve(hint, callDataBytes, baseOffset, hopsOffset, hopCount);
+	if (typeof base !== "number") return navigationViolation(frame, base.code);
+	return targetViolation(frame, evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData));
+}
+function evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, hopCount, opCode, operandData, groupIndex, ruleIndex, pathHex) {
+	const frameOffset = hopsOffset + hopCount * PolicyFormat.HINT_HOP_SIZE;
+	const suffixHeaderOffset = frameOffset + PolicyFormat.HINT_FRAME_PREFIX_SIZE;
+	const suffixHopCount = hint[suffixHeaderOffset] & PolicyFormat.HINT_HOP_COUNT_MASK;
+	const suffixHopsOffset = suffixHeaderOffset + PolicyFormat.HINT_HEADER_SIZE;
+	const block = readTargetBlock(hint, suffixHopsOffset + suffixHopCount * PolicyFormat.HINT_HOP_SIZE);
+	const frame = {
 		group: groupIndex,
 		rule: ruleIndex,
-		code: shapeResult.code,
-		scope: Scope.CALLDATA,
 		path: pathHex,
 		opCode,
-		operandData: operandHex,
-		typeCode: leafTypeCode
-	};
-	const shape = shapeResult.shape;
-	if (shape.length > Limits.MAX_QUANTIFIED_ARRAY_LENGTH) return {
+		operandData,
+		typeCode: block.typeCode
+	};
+	const chained = chainResolve(hint, callDataBytes, baseOffset, hopsOffset, hopCount);
+	if (typeof chained !== "number") return navigationViolation(frame, chained.code);
+	let elems = chained + readU32(hint, frameOffset);
+	let count = readU16(hint, frameOffset + PolicyFormat.HINT_FRAME_COUNT_OFFSET);
+	if (count === 0) {
+		const length = readPointer(callDataBytes, elems);
+		if (typeof length !== "number") return navigationViolation(frame, length.code);
+		count = length;
+		elems += 32;
+	}
+	if (count > Limits.MAX_QUANTIFIED_ARRAY_LENGTH) return {
 		group: groupIndex,
 		rule: ruleIndex,
 		code: "QUANTIFIER_LIMIT_EXCEEDED",
 		scope: Scope.CALLDATA,
 		path: pathHex,
-		resolvedValue: bigintToHex(BigInt(shape.length))
+		resolvedValue: bigintToHex(BigInt(count))
 	};
-	if (shape.length === 0) {
-		if (quantifier === Quantifier.ALL_OR_EMPTY) return null;
+	const isUniversal = kind === PolicyFormat.HINT_KIND_ALL;
+	if (count === 0) {
+		if (isUniversal) return null;
 		return {
 			group: groupIndex,
 			rule: ruleIndex,
@@ -3530,72 +3006,28 @@ function evaluateQuantifier(qResult, callDataBytes, opCode, operandData, groupIn
 			path: pathHex
 		};
 	}
-	const isUniversal = quantifier === Quantifier.ALL_OR_EMPTY || quantifier === Quantifier.ALL;
-	const hasSuffix = remainingPath.length > 0;
-	for (let elemIndex = 0; elemIndex < shape.length; elemIndex++) {
-		const elemResult = arrayElementAt(shape, elemIndex, callDataBytes);
-		if (!elemResult.ok) {
-			if (isUniversal) return {
-				group: groupIndex,
-				rule: ruleIndex,
-				code: elemResult.code,
-				scope: Scope.CALLDATA,
-				path: pathHex,
-				opCode,
-				operandData: operandHex,
-				typeCode: leafTypeCode,
-				elementIndex: elemIndex
-			};
-			continue;
+	const meta = readU16(hint, frameOffset + PolicyFormat.HINT_FRAME_META_OFFSET);
+	const elemStride = (meta & PolicyFormat.HINT_META_STRIDE_MASK) * 32;
+	const elemIsDynamic = (meta & PolicyFormat.HINT_META_ELEM_DYNAMIC) !== 0;
+	for (let elemIndex = 0; elemIndex < count; elemIndex++) {
+		const slot = elems + elemIndex * elemStride;
+		let elem = slot;
+		if (elemIsDynamic) {
+			const followed = follow(callDataBytes, elems, slot);
+			if (typeof followed !== "number") return navigationViolation(frame, followed.code, elemIndex);
+			elem = followed;
 		}
-		const elemLocation = elemResult.location;
-		let leafLocation;
-		if (hasSuffix) {
-			const navResult = descendPath(callDataBytes, elemLocation, remainingPath);
-			if (!navResult.ok) {
-				if (isUniversal) return {
-					group: groupIndex,
-					rule: ruleIndex,
-					code: navResult.code,
-					scope: Scope.CALLDATA,
-					path: pathHex,
-					opCode,
-					operandData: operandHex,
-					typeCode: leafTypeCode,
-					elementIndex: elemIndex
-				};
-				continue;
-			}
-			leafLocation = navResult.location;
-		} else leafLocation = elemLocation;
-		const applied = applyLeafOperator(callDataBytes, leafLocation, opCode, operandData);
-		if ("error" in applied) {
-			if (isUniversal) return {
-				group: groupIndex,
-				rule: ruleIndex,
-				code: applied.error,
-				scope: Scope.CALLDATA,
-				path: pathHex,
-				opCode,
-				operandData: operandHex,
-				typeCode: leafTypeCode,
-				elementIndex: elemIndex
-			};
-			continue;
+		let base = elem;
+		if (suffixHopCount > 0) {
+			const chainedElem = chainResolve(hint, callDataBytes, elem, suffixHopsOffset, suffixHopCount);
+			if (typeof chainedElem !== "number") return navigationViolation(frame, chainedElem.code, elemIndex);
+			base = chainedElem;
 		}
-		if (isUniversal && !applied.passed) return {
-			group: groupIndex,
-			rule: ruleIndex,
-			code: "VALUE_MISMATCH",
-			scope: Scope.CALLDATA,
-			path: pathHex,
-			opCode,
-			operandData: operandHex,
-			typeCode: leafTypeCode,
-			resolvedValue: applied.resolvedValue,
-			elementIndex: elemIndex
-		};
-		if (!isUniversal && applied.passed) return null;
+		const applied = evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData);
+		if ("error" in applied) return targetViolation(frame, applied, elemIndex);
+		if (applied.passed) {
+			if (!isUniversal) return null;
+		} else if (isUniversal) return targetViolation(frame, applied, elemIndex);
 	}
 	if (isUniversal) return null;
 	return {
@@ -3605,16 +3037,44 @@ function evaluateQuantifier(qResult, callDataBytes, opCode, operandData, groupIn
 		scope: Scope.CALLDATA,
 		path: pathHex,
 		opCode,
-		operandData: operandHex,
-		typeCode: leafTypeCode
+		operandData: bytesToHex(operandData),
+		typeCode: block.typeCode
+	};
+}
+function evaluateContextRule(pathBytes, opCode, operandData, groupIndex, ruleIndex, pathHex, context) {
+	const propertyId = readU16(pathBytes, 0);
+	if (propertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID 0x${propertyId.toString(16).padStart(4, "0")}`);
+	const propInfo = lookupContextProperty(propertyId);
+	const contextValue = context?.[propInfo.contextKey];
+	if (contextValue === void 0) return {
+		group: groupIndex,
+		rule: ruleIndex,
+		code: "MISSING_CONTEXT",
+		scope: Scope.CONTEXT,
+		path: pathHex,
+		typeCode: propInfo.typeCode
+	};
+	let value;
+	if (typeof contextValue === "string") value = addressToBigInt(contextValue);
+	else value = contextValue;
+	if (!applyOperator(opCode, value, 32, operandData, propInfo.typeCode)) return {
+		group: groupIndex,
+		rule: ruleIndex,
+		code: "VALUE_MISMATCH",
+		scope: Scope.CONTEXT,
+		path: pathHex,
+		opCode,
+		operandData: bytesToHex(operandData),
+		typeCode: propInfo.typeCode,
+		resolvedValue: bigintToHex(value)
 	};
+	return null;
 }
-/** Check and enforce policies against ABI-encoded call data. */
 const PolicyEnforcer = {
 	check,
 	enforce
 };
 //#endregion
-export { CallciumError, ContextProperty, Descriptor, DescriptorCoder, Limits, Op, PolicyBuilder, PolicyCoder, PolicyEnforcer, PolicyValidator, PolicyViolationError, Quantifier, Scope, TypeCode, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
+export { CallciumError, ContextProperty, Descriptor, DescriptorCoder, Limits, Op, PolicyBuilder, PolicyCoder, PolicyEnforcer, PolicyFormat, PolicyValidator, PolicyViolationError, Quantifier, Scope, TypeCode, ValidationError, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
 
 //# sourceMappingURL=index.js.map