@callcium/sdk 0.9.0 → 0.11.0

package/dist/index.d.ts

@@ -110,7 +110,7 @@ type CalldataNavigationVariant<C extends NavigationViolationCode> = {
  * A union of per-code variants, narrowable with `Extract<Violation, { code: "..." }>`.
  */
 type CalldataNavigationViolation = CalldataNavigationVariant<"CALLDATA_OUT_OF_BOUNDS"> | CalldataNavigationVariant<"ARRAY_INDEX_OUT_OF_BOUNDS">;
-/** A quantified array exceeded `Limits.MAX_QUANTIFIED_ARRAY_LENGTH`. */
+/** A quantified array exceeded `PolicyFormat.MAX_QUANTIFIED_ARRAY_LENGTH`. */
 type QuantifierLimitExceededViolation = {
   code: "QUANTIFIER_LIMIT_EXCEEDED";
   group: number;
@@ -120,7 +120,7 @@ type QuantifierLimitExceededViolation = {
   resolvedValue: Hex;
 };
 /**
- * A resolved word is not the canonical encoding of its declared type (spec §7.4).
+ * A resolved word is not the canonical encoding of its declared type.
  *
  * `resolvedValue` is the raw 32-byte word as it appeared in calldata, before any masking.
  */
@@ -226,109 +226,25 @@ type DecodedPolicy = {
 type IssueSeverity = "info" | "warning" | "error";
 /** Category of a validation issue. */
 type IssueCategory = "typeMismatch" | "contradiction" | "redundancy" | "vacuity" | "compatibility";
+/**
+ * Machine-readable code for a policy validation issue.
+ *
+ * Each code names one finding of the semantic validator and matches the constant of the same
+ * name in the Solidity `IssueCode` library.
+ */
+type IssueCode = "VALUE_OP_ON_DYNAMIC" | "VALUE_OP_ON_COMPOSITE" | "NUMERIC_OP_ON_NON_NUMERIC" | "BITMASK_ON_INVALID" | "IN_ON_BOOL" | "LENGTH_ON_STATIC" | "CONTEXT_TYPE_MISMATCH" | "UNKNOWN_OPERATOR" | "NON_CANONICAL_OPERAND" | "UNNAVIGABLE_PATH" | "NESTED_QUANTIFIER" | "HINT_MISMATCH" | "EQ_NEQ_CONTRADICTION" | "CONFLICTING_EQUALITY" | "OUT_OF_PHYSICAL_BOUNDS" | "IMPOSSIBLE_GT" | "IMPOSSIBLE_LT" | "BOUNDS_EXCLUDE_EQUALITY" | "IMPOSSIBLE_RANGE" | "SET_EXCLUDES_EQUALITY" | "EMPTY_SET_INTERSECTION" | "SET_FULLY_EXCLUDED" | "LENGTH_EQ_NEQ_CONTRADICTION" | "CONFLICTING_LENGTH" | "BOUNDS_EXCLUDE_LENGTH" | "IMPOSSIBLE_LENGTH_RANGE" | "OUT_OF_PHYSICAL_LENGTH_BOUNDS" | "IMPOSSIBLE_LENGTH_GT" | "IMPOSSIBLE_LENGTH_LT" | "BITMASK_CONTRADICTION" | "BITMASK_ANY_IMPOSSIBLE" | "UNSORTED_IN_SET" | "EMPTY_GROUP" | "DOMINATED_BOUND" | "REDUNDANT_BOUND" | "SET_REDUCTION" | "SET_REDUNDANCY" | "SET_PARTIALLY_EXCLUDED" | "DOMINATED_LENGTH_BOUND" | "REDUNDANT_LENGTH_BOUND" | "REDUNDANT_BITMASK" | "DUPLICATE_CONSTRAINT" | "FUSIBLE_RANGE" | "FUSIBLE_LENGTH_RANGE" | "VACUOUS_GTE" | "VACUOUS_LTE" | "VACUOUS_LENGTH_GTE" | "VACUOUS_LENGTH_LTE" | "VACUOUS_NEGATED_RANGE" | "VACUOUS_NEGATED_LENGTH_RANGE" | "PATH_DEPTH_EXCEEDED" | "QUANTIFIER_OVER_STATIC_LIMIT" | "UNKNOWN_CONTEXT_PROPERTY" | "NEGATION_UNDER_ANY";
 /** A single validation issue found during policy analysis. */
 type Issue = {
   severity: IssueSeverity;
   category: IssueCategory;
   groupIndex: number;
   constraintIndex: number;
-  code: string;
+  code: IssueCode;
   value1: Hex;
   value2: Hex;
   message: string;
 };
 //#endregion
-//#region src/constraint.d.ts
-/** Accepted scalar value types for operator arguments. */
-type ScalarValue = bigint | number | boolean | string;
-/**
- * Mutable builder that accumulates operators targeting a single path.
- * Implements the `Constraint` interface so it can be passed directly to policy builders.
- */
-declare class ConstraintBuilder implements Constraint {
-  readonly scope: number;
-  readonly path: Hex;
-  readonly operators: Hex[];
-  /** @internal */
-  constructor(scope: number, path: Hex);
-  /** Push a pre-encoded operator hex string and return this for chaining. */
-  private push;
-  /** Assert the value equals `value`. */
-  eq(value: ScalarValue): this;
-  /** Assert the value does not equal `value`. */
-  neq(value: ScalarValue): this;
-  /** Assert the value equals the context property `contextPropertyId`. */
-  eqCtx(contextPropertyId: number): this;
-  /** Assert the value does not equal the context property `contextPropertyId`. */
-  neqCtx(contextPropertyId: number): this;
-  /** Assert the value is greater than `bound`. */
-  gt(bound: bigint | number): this;
-  /** Assert the value is less than `bound`. */
-  lt(bound: bigint | number): this;
-  /** Assert the value is greater than or equal to `bound`. */
-  gte(bound: bigint | number): this;
-  /** Assert the value is less than or equal to `bound`. */
-  lte(bound: bigint | number): this;
-  /**
-   * Assert the value is within [min, max] inclusive.
-   * @throws {CallciumError} If min > max.
-   */
-  between(min: bigint | number, max: bigint | number): this;
-  /**
-   * Assert the value is a member of the set.
-   * Values are sorted and deduplicated before encoding.
-   * @throws {CallciumError} If the set is empty after deduplication.
-   */
-  isIn(values: readonly ScalarValue[]): this;
-  /**
-   * Assert the value is not a member of the set.
-   * @throws {CallciumError} If the set is empty after deduplication.
-   */
-  notIn(values: readonly ScalarValue[]): this;
-  /** Assert all bits in `mask` are set. */
-  bitmaskAll(mask: bigint): this;
-  /** Assert at least one bit in `mask` is set. */
-  bitmaskAny(mask: bigint): this;
-  /** Assert no bit in `mask` is set. */
-  bitmaskNone(mask: bigint): this;
-  /** Assert the runtime length equals `n`. */
-  lengthEq(n: bigint | number): this;
-  /** Assert the runtime length is greater than `n`. */
-  lengthGt(n: bigint | number): this;
-  /** Assert the runtime length is less than `n`. */
-  lengthLt(n: bigint | number): this;
-  /** Assert the runtime length is greater than or equal to `n`. */
-  lengthGte(n: bigint | number): this;
-  /** Assert the runtime length is less than or equal to `n`. */
-  lengthLte(n: bigint | number): this;
-  /**
-   * Assert the runtime length is within [min, max] inclusive.
-   * @throws {CallciumError} If min > max.
-   */
-  lengthBetween(min: bigint | number, max: bigint | number): this;
-}
-/**
- * Target a calldata argument by path.
- * Each argument is a big-endian uint16 step; multiple steps navigate into nested types.
- */
-declare function arg(p0: number, ...rest: number[]): ConstraintBuilder;
-/** Target the `msg.sender` context property. */
-declare function msgSender(): ConstraintBuilder;
-/** Target the `msg.value` context property. */
-declare function msgValue(): ConstraintBuilder;
-/** Target the `block.timestamp` context property. */
-declare function blockTimestamp(): ConstraintBuilder;
-/** Target the `block.number` context property. */
-declare function blockNumber(): ConstraintBuilder;
-/** Target the `block.chainid` context property. */
-declare function chainId(): ConstraintBuilder;
-/** Target the `tx.origin` context property. */
-declare function txOrigin(): ConstraintBuilder;
-/** Target the `block.basefee` context property. */
-declare function baseFee(): ConstraintBuilder;
-/** Target the `tx.gasprice` context property. */
-declare function gasPrice(): ConstraintBuilder;
-//#endregion
 //#region src/policy-builder.d.ts
 /** Fluent builder for constructing Callcium policies. */
 declare class PolicyBuilder {
@@ -347,8 +263,11 @@ declare class PolicyBuilder {
   /**
    * Add a constraint to the current group.
    * @param constraint - A `Constraint` object or a `ConstraintBuilder` instance.
+   * @throws {CallciumError} With code `OUT_OF_PHYSICAL_BOUNDS` when a numeric operand lies outside
+   * the target type's range and encodes as a value inside it. Operands are read as written, so a
+   * `Constraint` carrying encoded operator bytes is left to {@link validate}.
    */
-  add(constraint: Constraint | ConstraintBuilder): this;
+  add(constraint: Constraint): this;
   /** Start a new constraint group (OR branch). */
   or(): this;
   /**
@@ -358,6 +277,8 @@ declare class PolicyBuilder {
    * @returns The policy as a 0x-prefixed hex string.
    * @throws {CallciumError} If any group is empty.
    * @throws {ValidationError} If validation finds any issue.
+   * @throws {CallciumError} With code `RULE_SIZE_OVERFLOW` when a rule's encoded bytes exceed the
+   * width of the rule size field.
    */
   build(): Hex;
   /**
@@ -380,12 +301,6 @@ declare class PolicyBuilder {
 }
 //#endregion
 //#region src/policy-coder.d.ts
-/**
- * Parse a BE16-encoded hex path into an array of step values.
- * @param path - 0x-prefixed hex string containing BE16-encoded path steps.
- * @returns Array of numeric step values.
- */
-declare function parsePathSteps(path: Hex): number[];
 /**
  * Encode a PolicyData structure into the canonical binary format.
  * @param data - The policy data to encode.
@@ -413,6 +328,32 @@ declare const PolicyCoder: {
   inspect: typeof inspect$1;
 };
 //#endregion
+//#region src/path.d.ts
+/** Reserved path step values that trigger quantified evaluation over array elements. */
+declare const Quantifier: {
+  readonly ALL: 65535;
+  readonly ANY: 65534;
+};
+/** Display metadata for a quantifier step. */
+type QuantifierInfo = {
+  label: string;
+};
+/** Check whether a path step is a quantifier (ALL or ANY). */
+declare function isQuantifier(step: number): boolean;
+/**
+ * Map a quantifier path step to its display label.
+ * @param code - Quantifier step value.
+ * @returns Display metadata for the quantifier.
+ * @throws {CallciumError} If the code is not a recognised quantifier.
+ */
+declare function lookupQuantifier(code: number): QuantifierInfo;
+/**
+ * Parse a BE16-encoded hex path into an array of step values.
+ * @param path - 0x-prefixed hex string containing BE16-encoded path steps.
+ * @returns Array of numeric step values.
+ */
+declare function parsePathSteps(path: Hex): number[];
+//#endregion
 //#region src/descriptor.d.ts
 /** Structural type information extracted from a descriptor node. */
 type TypeInfo = {
@@ -422,8 +363,7 @@ type TypeInfo = {
 };
 /**
  * Return the byte length of the node at `offset`.
- * Elementary nodes occupy exactly one byte; composite nodes encode their
- * length in the lower 12 bits of the 24-bit meta field.
+ * @throws {CallciumError} When the descriptor holds no readable node at `offset`.
  */
 declare function nodeLength(desc: Uint8Array, offset: number): number;
 /**
@@ -431,7 +371,10 @@ declare function nodeLength(desc: Uint8Array, offset: number): number;
  * Starts at the first field and skips `fieldIndex` nodes using `nodeLength`.
  */
 declare function tupleFieldOffset(desc: Uint8Array, tupleOffset: number, fieldIndex: number): number;
-/** Return paramCount from header byte 1. */
+/**
+ * Return the declared top-level parameter count.
+ * @throws {CallciumError} When the descriptor is too short to hold a header.
+ */
 declare function paramCount(desc: Uint8Array): number;
 /** Return byte offset of the N-th top-level param (0-indexed). */
 declare function paramOffset(desc: Uint8Array, index: number): number;
@@ -440,6 +383,7 @@ declare function paramOffset(desc: Uint8Array, index: number): number;
  * @param desc - Raw descriptor bytes.
  * @param offset - Byte position of the node.
  * @returns typeCode, isDynamic, and staticSize in bytes.
+ * @throws {CallciumError} When the descriptor holds no readable node at `offset`.
  */
 declare function inspect(desc: Uint8Array, offset: number): TypeInfo;
 /**
@@ -522,6 +466,9 @@ declare function isOpAllowed(opCode: number, typeInfo: TypeInfo): boolean;
  * @returns All validation issues found, ordered by group and constraint index.
  * @throws {CallciumError} If the descriptor is not well-formed; semantic validation is
  * defined only over a well-formed descriptor.
+ * @throws {CallciumError} With code `EMPTY_PATH` when a constraint carries no path step, and
+ * `INVALID_HEX` or `INVALID_OPERATOR_BYTES` when an operator is not a readable encoding. Analysis
+ * is defined over canonical data, so these reject the input rather than report an issue on it.
  */
 declare function validate(data: PolicyData): Issue[];
 /** Semantic validation for policies. */
@@ -529,6 +476,115 @@ declare const PolicyValidator: {
   validate: typeof validate;
 };
 //#endregion
+//#region src/constraint.d.ts
+/** Accepted scalar value types for operator arguments. */
+type ScalarValue = bigint | boolean | string;
+/**
+ * Extremes of the numeric operands a builder's value operators received, as written. Encoding folds
+ * a negative operand onto its unsigned alias, so the sign survives nowhere else.
+ */
+type OperandExtremes = {
+  /** Most negative operand written, or zero when none was negative. */leastNegative: bigint; /** Greatest operand written, or zero when none exceeded it. */
+  greatest: bigint;
+};
+/**
+ * Mutable builder that accumulates operators targeting a single path.
+ * Implements the `Constraint` interface so it can be passed directly to policy builders.
+ */
+declare class ConstraintBuilder<Operand extends ScalarValue = ScalarValue> implements Constraint {
+  readonly scope: number;
+  readonly path: Hex;
+  readonly operators: Hex[];
+  /**
+   * Extremes of the numeric operands the value operators received, as written. Only the extremes
+   * can offend: an operand folds into a target's range from below it or from above it, and
+   * whichever reaches furthest arrives first. Read it through {@link readOperandExtremes}.
+   * @internal
+   */
+  readonly operandExtremes: OperandExtremes;
+  /** @internal */
+  constructor(scope: number, path: Hex);
+  /**
+   * Push a pre-encoded operator hex string and return this for chaining.
+   * `values` are the operands as written; the numeric ones join the record.
+   */
+  private push;
+  /** Assert the value equals `value`. */
+  eq(value: Operand): this;
+  /** Assert the value does not equal `value`. */
+  neq(value: Operand): this;
+  /** Assert the value equals the context property `contextPropertyId`. */
+  eqCtx(contextPropertyId: number): this;
+  /** Assert the value does not equal the context property `contextPropertyId`. */
+  neqCtx(contextPropertyId: number): this;
+  /** Assert the value is greater than `bound`. */
+  gt(bound: bigint): this;
+  /** Assert the value is less than `bound`. */
+  lt(bound: bigint): this;
+  /** Assert the value is greater than or equal to `bound`. */
+  gte(bound: bigint): this;
+  /** Assert the value is less than or equal to `bound`. */
+  lte(bound: bigint): this;
+  /**
+   * Assert the value is within [min, max] inclusive.
+   * @throws {CallciumError} If min > max.
+   */
+  between(min: bigint, max: bigint): this;
+  /**
+   * Assert the value is a member of the set.
+   * Values are sorted and deduplicated before encoding.
+   * @throws {CallciumError} If the set is empty after deduplication.
+   */
+  isIn(values: readonly Operand[]): this;
+  /**
+   * Assert the value is not a member of the set.
+   * @throws {CallciumError} If the set is empty after deduplication.
+   */
+  notIn(values: readonly Operand[]): this;
+  /** Assert all bits in `mask` are set. */
+  bitmaskAll(mask: bigint): this;
+  /** Assert at least one bit in `mask` is set. */
+  bitmaskAny(mask: bigint): this;
+  /** Assert no bit in `mask` is set. */
+  bitmaskNone(mask: bigint): this;
+  /** Assert the runtime length equals `length`. */
+  lengthEq(length: bigint): this;
+  /** Assert the runtime length is greater than `length`. */
+  lengthGt(length: bigint): this;
+  /** Assert the runtime length is less than `length`. */
+  lengthLt(length: bigint): this;
+  /** Assert the runtime length is greater than or equal to `length`. */
+  lengthGte(length: bigint): this;
+  /** Assert the runtime length is less than or equal to `length`. */
+  lengthLte(length: bigint): this;
+  /**
+   * Assert the runtime length is within [min, max] inclusive.
+   * @throws {CallciumError} If min > max.
+   */
+  lengthBetween(min: bigint, max: bigint): this;
+}
+/**
+ * Target a calldata argument by path.
+ * Each argument is a big-endian uint16 step; multiple steps navigate into nested types.
+ */
+declare function arg(p0: number, ...rest: number[]): ConstraintBuilder;
+/** Target the `msg.sender` context property. */
+declare function msgSender(): ConstraintBuilder<Address>;
+/** Target the `msg.value` context property. */
+declare function msgValue(): ConstraintBuilder<bigint>;
+/** Target the `block.timestamp` context property. */
+declare function blockTimestamp(): ConstraintBuilder<bigint>;
+/** Target the `block.number` context property. */
+declare function blockNumber(): ConstraintBuilder<bigint>;
+/** Target the `block.chainid` context property. */
+declare function chainId(): ConstraintBuilder<bigint>;
+/** Target the `tx.origin` context property. */
+declare function txOrigin(): ConstraintBuilder<Address>;
+/** Target the `block.basefee` context property. */
+declare function baseFee(): ConstraintBuilder<bigint>;
+/** Target the `tx.gasprice` context property. */
+declare function gasPrice(): ConstraintBuilder<bigint>;
+//#endregion
 //#region src/policy-enforcer.d.ts
 /**
  * Check a policy against ABI-encoded call data without throwing on violations.
@@ -536,7 +592,8 @@ declare const PolicyValidator: {
  * @param callData - ABI-encoded call data as 0x-prefixed hex string.
  * @param context - Optional execution context for context-scoped rules.
  * @returns Pass with matched group index, or fail with one violation per evaluated failing group.
- * @throws {CallciumError} If the policy blob is structurally malformed.
+ * @throws {CallciumError} If the policy blob is structurally malformed, or a context value a rule
+ * reads is not an address or an integer a 32-byte word represents.
  */
 declare function check(policy: Hex, callData: Hex, context?: Context): EnforceResult;
 /**
@@ -545,7 +602,8 @@ declare function check(policy: Hex, callData: Hex, context?: Context): EnforceRe
  * @param callData - ABI-encoded call data as 0x-prefixed hex string.
  * @param context - Optional execution context for context-scoped rules.
  * @throws {PolicyViolationError} If the policy rejects the call data.
- * @throws {CallciumError} If the policy blob is structurally malformed.
+ * @throws {CallciumError} If the policy blob is structurally malformed, or a context value a rule
+ * reads is not an address or an integer a 32-byte word represents.
  */
 declare function enforce(policy: Hex, callData: Hex, context?: Context): void;
 /** Check and enforce policies against ABI-encoded call data. */
@@ -570,6 +628,7 @@ declare function toAddress(hex: string): Address;
  * @returns Binary descriptor bytes starting with the version+paramCount header.
  * @throws {CallciumError} With code `MALFORMED_TYPE_STRING` for malformed input.
  * @throws {CallciumError} With code `UNKNOWN_TYPE` for unrecognised type names.
+ * @throws {CallciumError} With code `NESTING_TOO_DEEP` when composite nesting exceeds `MAX_NESTING_DEPTH`.
  */
 declare function fromTypes(typesCsv: string): Uint8Array;
 /**
@@ -589,7 +648,7 @@ declare const DescriptorCoder: {
 };
 //#endregion
 //#region src/constants.d.ts
-/** Binary layout constants for the Callcium policy format. */
+/** Binary layout constants and normative limits for the Callcium policy format. */
 declare const PolicyFormat: {
   readonly VERSION: 2;
   readonly VERSION_MASK: 15;
@@ -610,10 +669,11 @@ declare const PolicyFormat: {
   readonly RULE_DEPTH_OFFSET: 3;
   readonly RULE_PATH_OFFSET: 4;
   readonly PATH_STEP_SIZE: 2;
+  readonly PATH_STEP_MAX: number;
   readonly RULE_OPCODE_SIZE: 1;
   readonly RULE_DATALENGTH_SIZE: 2;
   readonly RULE_FIXED_OVERHEAD: 7;
-  readonly RULE_MIN_SIZE: 9;
+  readonly RULE_MIN_SIZE: number;
   readonly HINT_HEADER_SIZE: 1;
   readonly HINT_HOP_SIZE: 8;
   readonly HINT_HOP_INDEX_OFFSET: 4;
@@ -637,6 +697,9 @@ declare const PolicyFormat: {
   readonly HINT_META_DYNAMIC_ARRAY: 16384;
   readonly HINT_META_RESERVED_MASK: 12288;
   readonly HINT_META_STRIDE_MASK: 4095;
+  readonly MAX_PATH_DEPTH: 32;
+  readonly MAX_QUANTIFIED_ARRAY_LENGTH: 256;
+  readonly MAX_SET_MEMBERS: number;
 };
 /**
  * Extract a `{ KEY: code }` map from a table with `key` and `code` fields.
@@ -646,6 +709,12 @@ type CodeMap<T extends readonly {
   readonly key: string;
   readonly code: number;
 }[]> = { readonly [E in T[number] as E["key"]]: E["code"] };
+/**
+ * Render a wire code as fixed-width hex.
+ * @param code - Code value.
+ * @param byteWidth - Byte width of the field the code occupies.
+ * @returns The code as `0x`-prefixed hex, or its decimal form when no such field holds it.
+ */
 /** Rule scope discriminant: context (EVM environment) vs. calldata (ABI payload). */
 declare const Scope: CodeMap<readonly [{
   readonly key: "CONTEXT";
@@ -689,41 +758,49 @@ declare const ContextProperty: CodeMap<readonly [{
   readonly key: "MSG_SENDER";
   readonly code: 0;
   readonly label: "msg.sender";
+  readonly contextKey: "msgSender";
   readonly typeCode: 65;
 }, {
   readonly key: "MSG_VALUE";
   readonly code: 1;
   readonly label: "msg.value";
+  readonly contextKey: "msgValue";
   readonly typeCode: 32;
 }, {
   readonly key: "BLOCK_TIMESTAMP";
   readonly code: 2;
   readonly label: "block.timestamp";
+  readonly contextKey: "blockTimestamp";
   readonly typeCode: 32;
 }, {
   readonly key: "BLOCK_NUMBER";
   readonly code: 3;
   readonly label: "block.number";
+  readonly contextKey: "blockNumber";
   readonly typeCode: 32;
 }, {
   readonly key: "CHAIN_ID";
   readonly code: 4;
   readonly label: "block.chainid";
+  readonly contextKey: "chainId";
   readonly typeCode: 32;
 }, {
   readonly key: "TX_ORIGIN";
   readonly code: 5;
   readonly label: "tx.origin";
+  readonly contextKey: "txOrigin";
   readonly typeCode: 65;
 }, {
   readonly key: "BASE_FEE";
   readonly code: 6;
   readonly label: "block.basefee";
+  readonly contextKey: "baseFee";
   readonly typeCode: 32;
 }, {
   readonly key: "GAS_PRICE";
   readonly code: 7;
   readonly label: "tx.gasprice";
+  readonly contextKey: "gasPrice";
   readonly typeCode: 32;
 }]>;
 /** Maximum valid context property ID. */
@@ -734,6 +811,12 @@ type ContextPropertyInfo = {
   contextKey: keyof Context;
   typeCode: number;
 };
+/**
+ * Look up a context property code in the assigned set.
+ * @param code - Context property ID.
+ * @returns Display metadata, or undefined when the ID names no assigned property.
+ */
+declare function findContextProperty(code: number): ContextPropertyInfo | undefined;
 /**
  * Map a context property code to its display label and ABI type code.
  * @param code - Context property ID.
@@ -741,12 +824,6 @@ type ContextPropertyInfo = {
  * @throws {CallciumError} If the code is not a recognised context property.
  */
 declare function lookupContextProperty(code: number): ContextPropertyInfo;
-/** Protocol-imposed safety limits for path depth and quantifier array size. */
-declare const Limits: {
-  readonly MAX_PATH_DEPTH: 32;
-  readonly MAX_QUANTIFIED_ARRAY_LENGTH: 256;
-  readonly MAX_SET_MEMBERS: number;
-};
 /** Operand count category for operator data validation. */
 type Operands = "single" | "range" | "variadic";
 /** @internal */
@@ -852,29 +929,10 @@ type OpInfo = {
  * @throws {CallciumError} If the base code is not a recognised operator.
  */
 declare function lookupOp(code: number): OpInfo;
-/** Reserved path step values that trigger quantified evaluation over array elements. */
-declare const Quantifier: CodeMap<readonly [{
-  readonly key: "ALL";
-  readonly code: 65535;
-  readonly label: "all";
-}, {
-  readonly key: "ANY";
-  readonly code: 65534;
-  readonly label: "any";
-}]>;
-/** Display metadata for a quantifier step. */
-type QuantifierInfo = {
-  label: string;
-};
-/** Check whether a path step is a quantifier (ALL or ANY). */
-declare function isQuantifier(step: number): boolean;
-/**
- * Map a quantifier path step to its display label.
- * @param code - Quantifier step value.
- * @returns Display metadata for the quantifier.
- * @throws {CallciumError} If the code is not a recognised quantifier.
- */
-declare function lookupQuantifier(code: number): QuantifierInfo;
+//#endregion
+//#region src/operators.d.ts
+/** Return true when the operator code (with or without NOT flag) is a LENGTH_* variant. */
+declare function isLengthOp(opCode: number): boolean;
 /** Structural category for a descriptor type code. */
 type TypeClass = "elementary" | "tuple" | "staticArray" | "dynamicArray";
 /** Structural classification without label. */
@@ -894,18 +952,17 @@ type TypeCodeInfo = TypeClassInfo & {
  */
 declare function lookupTypeCode(code: number): TypeCodeInfo;
 //#endregion
-//#region src/operators.d.ts
-/** Return true when the operator code (with or without NOT flag) is a LENGTH_* variant. */
-declare function isLengthOp(opCode: number): boolean;
-//#endregion
 //#region src/errors.d.ts
 /**
  * Machine-readable error code for structural decoding and validation failures.
  *
- * Each code names one invariant and matches the Solidity error raised for the same
- * invariant, transliterated from `PascalCase` to `SCREAMING_SNAKE_CASE`.
+ * Each code names one invariant. Where Solidity detects the same invariant, the code is its error
+ * name transliterated from `PascalCase` to `SCREAMING_SNAKE_CASE`. The codes under "Inputs and
+ * validation" have no counterpart: they name input a Solidity signature cannot express.
+ * `OUT_OF_PHYSICAL_BOUNDS` names an invariant Solidity carries twice, as the error
+ * `PolicyBuilder.OutOfPhysicalBounds` and as an issue code, so the name is shared with `IssueCode`.
  */
-type CallciumErrorCode = "UNSUPPORTED_VERSION" | "MALFORMED_HEADER" | "UNEXPECTED_END" | "TRAILING_BYTES" | "EMPTY_POLICY" | "EMPTY_GROUP" | "GROUP_TOO_SMALL" | "GROUP_SIZE_MISMATCH" | "GROUP_OVERFLOW" | "RULE_TOO_SMALL" | "RULE_SIZE_MISMATCH" | "RULE_FIELD_OUT_OF_BOUNDS" | "RULE_OVERFLOW" | "EMPTY_PATH" | "MALFORMED_PATH" | "PATH_TOO_DEEP" | "PARAM_INDEX_OUT_OF_BOUNDS" | "TUPLE_FIELD_OUT_OF_BOUNDS" | "STATIC_ARRAY_INDEX_OUT_OF_BOUNDS" | "NOT_COMPOSITE" | "UNCOMPILABLE_PATH" | "QUANTIFIER_ON_NON_ARRAY" | "NESTED_QUANTIFIER" | "INVALID_SCOPE" | "INVALID_CONTEXT_PATH" | "UNKNOWN_CONTEXT_PROPERTY" | "UNKNOWN_OPERATOR" | "INVALID_OPERATOR_BYTES" | "OPERATOR_TARGET_MISMATCH" | "UNSORTED_IN_SET" | "MALFORMED_HINT" | "NO_CONSTRAINT_OPERATORS" | "DUPLICATE_PATH_IN_GROUP" | "EMPTY_SET" | "SET_TOO_LARGE" | "INVALID_RANGE" | "UNKNOWN_TYPE_CODE" | "NODE_LENGTH_TOO_SMALL" | "NODE_LENGTH_TOO_LARGE" | "NODE_OVERFLOW" | "NESTING_TOO_DEEP" | "INVALID_ARRAY_LENGTH" | "INVALID_TUPLE_FIELD_COUNT" | "STATIC_WORDS_TOO_LARGE" | "PARAM_COUNT_MISMATCH" | "TOO_MANY_PARAMS" | "MALFORMED_TYPE_STRING" | "UNKNOWN_TYPE" | "MALFORMED_SIGNATURE" | "SIGNATURE_CONTAINS_WHITESPACE" | "INVALID_FUNCTION_NAME" | "GROUP_COUNT_OVERFLOW" | "RULE_COUNT_OVERFLOW" | "RULE_SIZE_OVERFLOW" | "DESC_LENGTH_OVERFLOW" | "UNKNOWN_QUANTIFIER" | "INVALID_HEX" | "VALIDATION_ERROR";
+type CallciumErrorCode = "UNSUPPORTED_VERSION" | "MALFORMED_HEADER" | "UNEXPECTED_END" | "TRAILING_BYTES" | "EMPTY_POLICY" | "EMPTY_GROUP" | "GROUP_TOO_SMALL" | "GROUP_SIZE_MISMATCH" | "GROUP_OVERFLOW" | "RULE_TOO_SMALL" | "RULE_SIZE_MISMATCH" | "RULE_FIELD_OUT_OF_BOUNDS" | "RULE_OVERFLOW" | "EMPTY_PATH" | "MALFORMED_PATH" | "PATH_TOO_DEEP" | "PARAM_INDEX_OUT_OF_BOUNDS" | "TUPLE_FIELD_OUT_OF_BOUNDS" | "STATIC_ARRAY_INDEX_OUT_OF_BOUNDS" | "NOT_COMPOSITE" | "UNCOMPILABLE_PATH" | "QUANTIFIER_ON_NON_ARRAY" | "NESTED_QUANTIFIER" | "INVALID_SCOPE" | "INVALID_CONTEXT_PATH" | "UNKNOWN_CONTEXT_PROPERTY" | "UNKNOWN_OPERATOR" | "INVALID_OPERATOR_BYTES" | "OPERATOR_TARGET_MISMATCH" | "UNSORTED_IN_SET" | "MALFORMED_HINT" | "NO_CONSTRAINT_OPERATORS" | "DUPLICATE_PATH_IN_GROUP" | "EMPTY_SET" | "SET_TOO_LARGE" | "INVALID_RANGE" | "OUT_OF_PHYSICAL_BOUNDS" | "UNKNOWN_TYPE_CODE" | "NODE_LENGTH_TOO_SMALL" | "NODE_LENGTH_TOO_LARGE" | "NODE_OVERFLOW" | "NESTING_TOO_DEEP" | "INVALID_ARRAY_LENGTH" | "INVALID_TUPLE_FIELD_COUNT" | "STATIC_WORDS_TOO_LARGE" | "PARAM_COUNT_MISMATCH" | "TOO_MANY_PARAMS" | "MALFORMED_TYPE_STRING" | "UNKNOWN_TYPE" | "MALFORMED_SIGNATURE" | "SIGNATURE_CONTAINS_WHITESPACE" | "INVALID_FUNCTION_NAME" | "GROUP_COUNT_OVERFLOW" | "RULE_COUNT_OVERFLOW" | "RULE_SIZE_OVERFLOW" | "DESC_LENGTH_OVERFLOW" | "UNKNOWN_QUANTIFIER" | "INVALID_HEX" | "MALFORMED_SELECTOR" | "PATH_STEP_OVERFLOW" | "OPERAND_OVERFLOW" | "CONTEXT_VALUE_OVERFLOW" | "VALIDATION_ERROR";
 /**
  * Thrown when a policy or descriptor blob is structurally malformed.
  * The optional `offset` indicates the byte position in the source blob where the error was detected.
@@ -941,5 +998,5 @@ declare class PolicyViolationError extends Error {
   constructor(violations: Violation[]);
 }
 //#endregion
-export { type Address, CallciumError, type CallciumErrorCode, type CalldataNavigationViolation, type Constraint, type ConstraintBuilder, type Context, ContextProperty, type ContextPropertyInfo, type DecodedGroup, type DecodedParam, type DecodedPolicy, type DecodedRule, Descriptor, DescriptorCoder, type EnforceResult, type Field, type Hex, type Issue, type IssueCategory, type IssueSeverity, Limits, MAX_CONTEXT_PROPERTY_ID, type MissingContextViolation, type MissingSelectorViolation, type NavigationViolationCode, type NonCanonicalValueViolation, Op, type OpInfo, type Operands, PolicyBuilder, PolicyCoder, type PolicyData, PolicyEnforcer, PolicyFormat, PolicyValidator, PolicyViolationError, Quantifier, type QuantifierEmptyArrayViolation, type QuantifierInfo, type QuantifierLimitExceededViolation, type ScalarValue, Scope, type ScopeInfo, type SelectorMismatchViolation, type Span, type TypeClass, type TypeClassInfo, TypeCode, type TypeCodeInfo, type TypeInfo, ValidationError, type ValueMismatchViolation, type Violation, type ViolationCode, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
+export { type Address, CallciumError, type CallciumErrorCode, type CalldataNavigationViolation, type Constraint, type ConstraintBuilder, type Context, ContextProperty, type ContextPropertyInfo, type DecodedGroup, type DecodedParam, type DecodedPolicy, type DecodedRule, Descriptor, DescriptorCoder, type EnforceResult, type Field, type Hex, type Issue, type IssueCategory, type IssueCode, type IssueSeverity, MAX_CONTEXT_PROPERTY_ID, type MissingContextViolation, type MissingSelectorViolation, type NavigationViolationCode, type NonCanonicalValueViolation, Op, type OpInfo, type Operands, PolicyBuilder, PolicyCoder, type PolicyData, PolicyEnforcer, PolicyFormat, PolicyValidator, PolicyViolationError, Quantifier, type QuantifierEmptyArrayViolation, type QuantifierInfo, type QuantifierLimitExceededViolation, type ScalarValue, Scope, type ScopeInfo, type SelectorMismatchViolation, type Span, type TypeClass, type TypeClassInfo, TypeCode, type TypeCodeInfo, type TypeInfo, ValidationError, type ValueMismatchViolation, type Violation, type ViolationCode, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, findContextProperty, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/constraint.ts","../src/policy-builder.ts","../src/policy-coder.ts","../src/descriptor.ts","../src/policy-validator.ts","../src/policy-enforcer.ts","../src/bytes.ts","../src/descriptor-coder.ts","../src/constants.ts","../src/operators.ts","../src/errors.ts"],"mappings":";;KAKY,GAAA;;KAGA,OAAA;;KAGA,IAAA;EAAS,KAAA;EAAe,GAAA;AAAA;;;AAApC;;;KAWY,OAAA;EACV,SAAA,GAAY,OAAA;EACZ,QAAA;EACA,cAAA;EACA,WAAA;EACA,OAAA;EACA,QAAA,GAAW,OAAA;EACX,OAAA;EACA,QAAA;AAAA;;KAIU,aAAA;EAAkB,EAAA;EAAU,YAAA;AAAA;EAA2B,EAAA;EAAW,UAAA,EAAY,SAAA;AAAA;AAA1F;AAAA,KAGY,uBAAA;;KAGA,wBAAA;EACV,IAAA;AAAA;;KAIU,yBAAA;EACV,IAAA,uBAZiG;EAcjG,aAAA,EAAe,GAAA,EAXL;EAaV,aAAA,EAAe,GAAA;AAAA;;;AAVjB;;KAiBY,uBAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAZY;EAclB,QAAA,UAhBA;EAkBA,MAAA,WAhBA;EAkBA,WAAA,GAAc,GAAA;AAAA;;AAXhB;;;;;;;;;;;KA0BY,sBAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAL0B;EAOhC,MAAA,UAFM;EAIN,WAAA,EAAa,GAAA,EAGG;EADhB,QAAA;EACA,aAAA,GAAgB,GAAA;EAKK;;;;EAArB,eAAA,GAAkB,GAAA;EAClB,YAAA;AAAA;;;;;KAOG,yBAAA,WAAoC,uBAAA;EACvC,IAAA,EAAM,CAAA;EACN,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA;EACN,MAAA;EACA,WAAA,GAAc,GAAA;EACd,QAAA;EACA,YAAA;AAAA;;;;;;;;;KAWU,2BAAA,GACR,yBAAA,6BACA,yBAAA;;KAGQ,gCAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAvBQ;EAyBd,aAAA,EAAe,GAAA;AAAA;;;AAZjB;;;KAoBY,0BAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAnBN;EAqBA,QAAA,UAnBA;EAqBA,aAAA,EAAe,GAAA;EACf,MAAA;EACA,WAAA,GAAc,GAAA;EACd,YAAA;AAAA;;KAIU,6BAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA;AAAA;;;;;;;KASI,SAAA,GACR,wBAAA,GACA,yBAAA,GACA,uBAAA,GACA,sBAAA,GACA,2BAAA,GACA,0BAAA,GACA,gCAAA,GACA,6BAAA;;KAGQ,aAAA,GAAgB,SAAA;;KAOhB,UAAA;EACV,cAAA;EACA,QAAA,EAAU,GAAA;EACV,UAAA,EAAY,GAAA;EACZ,MAAA,EAAQ,UAAA;EACR,IAAA,GAAO,IAAA;AAAA;AArCT;AAAA,KAyCY,UAAA;EACV,KAAA;EACA,IAAA,EAAM,GAAA;EACN,SAAA,EAAW,GAAA,IA1CX;EA4CA,IAAA,GAAO,GAAA;EACP,IAAA,GAAO,IAAA;AAAA;;KAQG,KAAA;EAAa,KAAA,EAAO,CAAA;EAAG,IAAA,EAAM,IAAA;AAAA;;KAG7B,YAAA;EACV,KAAA;EACA,QAAA;EACA,SAAA;EACA,UAAA;EACA,IAAA,EAAM,GAAA;EACN,IAAA,EAAM,IAAA;AAAA;;KAII,WAAA;EACV,QAAA,EAAU,KAAA;EACV,KAAA,EAAO,KAAA;EACP,SAAA,EAAW,KAAA;EACX,IAAA,EAAM,KAAA,CAAM,GAAA,GArDV;EAuDF,IAAA,GAAO,KAAA,CAAM,GAAA;EACb,MAAA,EAAQ,KAAA;EACR,UAAA,EAAY,KAAA;EACZ,IAAA,EAAM,KAAA,CAAM,GAAA;EACZ,IAAA,EAAM,IAAA;AAAA;;KAII,YAAA;EACV,SAAA,EAAW,KAAA;EACX,SAAA,EAAW,KAAA;EACX,KAAA,EAAO,WAAA;EACP,IAAA,EAAM,IAAA;AAAA;;KAII,aAAA;EACV,MAAA,EAAQ,KAAA;EACR,QAAA,EAAU,KAAA,CAAM,GAAA;EAChB,UAAA,EAAY,KAAA;EACZ,UAAA;IAAc,GAAA,EAAK,GAAA;IAAK,MAAA,EAAQ,KAAA;MAAQ,OAAA;MAAiB,UAAA;IAAA;IAAuB,MAAA,EAAQ,YAAA;IAAgB,IAAA,EAAM,IAAA;EAAA;EAC9G,UAAA,EAAY,KAAA;EACZ,MAAA,EAAQ,YAAA;EACR,IAAA,EAAM,IAAA;EACN,OAAA;EACA,cAAA;AAAA;;KAQU,aAAA;;KAGA,aAAA;;KAGA,KAAA;EACV,QAAA,EAAU,aAAA;EACV,QAAA,EAAU,aAAA;EACV,UAAA;EACA,eAAA;EACA,IAAA;EACA,MAAA,EAAQ,GAAA;EACR,MAAA,EAAQ,GAAA;EACR,OAAA;AAAA;;;AAxRF;AAAA,KCMY,WAAA;;ADHZ;;;cC2Ha,iBAAA,YAA6B,UAAA;EAAA,SAC/B,KAAA;EAAA,SACA,IAAA,EAAM,GAAA;EAAA,SACN,SAAA,EAAW,GAAA;;cAGR,KAAA,UAAe,IAAA,EAAM,GAAA;ED9HI;EAAA,QCqI7B,IAAA;ED1HS;ECoIjB,EAAA,CAAG,KAAA,EAAO,WAAA;ED9HQ;ECmIlB,GAAA,CAAI,KAAA,EAAO,WAAA;EDxIC;EC6IZ,KAAA,CAAM,iBAAA;ED3IN;ECgJA,MAAA,CAAO,iBAAA;ED9IP;ECmJA,EAAA,CAAG,KAAA;EDlJQ;ECuJX,EAAA,CAAG,KAAA;EDrJH;EC0JA,GAAA,CAAI,KAAA;ED1JI;EC+JR,GAAA,CAAI,KAAA;ED3JmB;;;;ECmKvB,OAAA,CAAQ,GAAA,mBAAsB,GAAA;EDnKmC;;;;;ECgLjE,IAAA,CAAK,MAAA,WAAiB,WAAA;ED7KW;;;;ECqLjC,KAAA,CAAM,MAAA,WAAiB,WAAA;EDlLW;EC2LlC,UAAA,CAAW,IAAA;ED1LX;EC+LA,UAAA,CAAW,IAAA;ED3LD;ECgMV,WAAA,CAAY,IAAA;;EASZ,QAAA,CAAS,CAAA;EDxMT;EC6MA,QAAA,CAAS,CAAA;ED3MM;ECgNf,QAAA,CAAS,CAAA;ED9MM;ECmNf,SAAA,CAAU,CAAA;EDnNQ;ECwNlB,SAAA,CAAU,CAAA;EDjNuB;;;;ECyNjC,aAAA,CAAc,GAAA,mBAAsB,GAAA;AAAA;;;;;iBAatB,GAAA,CAAI,EAAA,aAAe,IAAA,aAAiB,iBAAA;;iBAMpC,SAAA,CAAA,GAAa,iBAAA;;iBAKb,QAAA,CAAA,GAAY,iBAAA;ADvN5B;AAAA,iBC4NgB,cAAA,CAAA,GAAkB,iBAAA;;iBAKlB,WAAA,CAAA,GAAe,iBAAA;;iBAKf,OAAA,CAAA,GAAW,iBAAA;;iBAKX,QAAA,CAAA,GAAY,iBAAA;;iBAKZ,OAAA,CAAA,GAAW,iBAAA;;iBAKX,QAAA,CAAA,GAAY,iBAAA;;;;cClOf,aAAA;EAAA,QACH,KAAA;EAAA,QAED,WAAA,CAAA;EFjGG;;;;EAAA,OEyGH,MAAA,CAAO,SAAA,WAAoB,aAAA;EFtGxB;;;;EAAA,OEsHH,SAAA,CAAU,QAAA,WAAmB,aAAA;EF3G1B;;;;EE0HV,GAAA,CAAI,UAAA,EAAY,UAAA,GAAa,iBAAA;EFzHjB;EE8JZ,EAAA,CAAA;EF5JA;;;;;;;;EE8KA,KAAA,CAAA,GAAS,GAAA;EFrKC;;;;;;;EEsLV,WAAA,CAAA,GAAe,GAAA;EFtLyE;;;AAG1F;EE4LE,QAAA,CAAA,GAAY,KAAA;;UAOJ,WAAA;EFnMyB;EAAA,QE4MzB,YAAA;AAAA;;;AF5OV;;;;;AAAA,iBGkCgB,cAAA,CAAe,IAAA,EAAM,GAAA;;;;;AHjBrC;iBGmgBS,MAAA,CAAO,IAAA,EAAM,UAAA,GAAa,GAAA;;;;;;;iBA0F1B,MAAA,CAAO,IAAA,EAAM,GAAA,GAAM,UAAA;;;;;;;iBA8CnB,SAAA,CAAQ,IAAA,EAAM,GAAA,GAAM,aAAA;AH/nB7B;AAAA,cGooBa,WAAA;;;;;;;;KC7pBD,QAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA;AAAA;AJJF;;;;;AAAA,iBIuCS,UAAA,CAAW,IAAA,EAAM,UAAA,EAAY,MAAA;;;;;iBAU7B,gBAAA,CAAiB,IAAA,EAAM,UAAA,EAAY,WAAA,UAAqB,UAAA;;iBAaxD,UAAA,CAAW,IAAA,EAAM,UAAA;;iBAKjB,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,KAAA;;;;;;;iBAkB9B,OAAA,CAAQ,IAAA,EAAM,UAAA,EAAY,MAAA,WAAiB,QAAA;;;;;AJ3DpD;;;;;;;;iBImFS,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,KAAA,aAAkB,QAAA;;;AJhFpD;;;;;AAGA;;iBI0FS,QAAA,CAAS,IAAA,EAAM,UAAA,EAAY,KAAA;EAAoB,QAAA,EAAU,QAAA;EAAU,sBAAA;AAAA;;;;;;iBA4DnE,eAAA,CAAgB,IAAA,EAAM,UAAA,EAAY,MAAA;;;;;AJrI3C;iBI8IS,iBAAA,CAAkB,IAAA,EAAM,UAAA,EAAY,MAAA;;;;;iBAWpC,kBAAA,CAAmB,MAAA;;;;;;;;;;iBA+InB,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,KAAA,aAAkB,UAAA;;cAiC5C,UAAA;;;;;;;;;;;;;;;;;;;iBCvLG,WAAA,CAAY,MAAA,UAAgB,QAAA,EAAU,QAAA;;;;;ALhMtD;;;iBK+lCS,QAAA,CAAS,IAAA,EAAM,UAAA,GAAa,KAAA;;cAiBxB,eAAA;mBAA8B,QAAA;AAAA;;;ALtnC3C;;;;;AAGA;;;AAHA,iBMuDS,KAAA,CAAM,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,GAAA,EAAK,OAAA,GAAU,OAAA,GAAU,aAAA;;ANjD/D;;;;;AAWA;;iBMyGS,OAAA,CAAQ,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,GAAA,EAAK,OAAA,GAAU,OAAA;;cA2hB1C,cAAA;gBAAmC,KAAA;kBAAA,OAAA;AAAA;;;ANrpBhD;AAAA,iBOWgB,UAAA,CAAW,GAAA,WAAc,UAAA;;iBAqBzB,UAAA,CAAW,KAAA,EAAO,UAAA,GAAa,GAAA;;iBAqD/B,SAAA,CAAU,GAAA,WAAc,OAAA;;;APrFxC;;;;;AAGA;;;AAHA,iBQuMS,SAAA,CAAU,QAAA,WAAmB,UAAA;;ARjMtC;;;;;AAWA;;;iBQkQS,OAAA,CAAQ,IAAA,EAAM,UAAA;;cAoLV,eAAA;oBAAwC,SAAA;kBAAA,OAAA;AAAA;;;;cC7axC,YAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyDR,OAAA;EAAA,SAAsC,GAAA;EAAA,SAAsB,IAAA;AAAA,wBAChD,CAAA,YAAa,CAAA,UAAW,CAAA;;cAmB5B,KAAA,EAAK,OAAA;EAAA;;;;;;;;;KAGN,SAAA;EAAc,KAAA;AAAA;;;;;;;iBAUV,WAAA,CAAY,IAAA,WAAe,SAAA;;cAW9B,QAAA;EAAA;;;;;;;;;;;;;;;;cAiCA,eAAA,EAAe,OAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGf,uBAAA;;KAGD,mBAAA;EAAwB,KAAA;EAAe,UAAA,QAApB,OAAA;EAAiE,QAAA;AAAA;;;;;;;iBAwBhF,qBAAA,CAAsB,IAAA,WAAe,mBAAA;AT/BrD;AAAA,cS0Ca,MAAA;EAAA;;;;;KAWD,QAAA;;cAGN,QAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqBO,EAAA,EAAI,OAAA,QAAe,QAAA;EAAA,SAAuB,GAAA;AAAA;;KAG3C,MAAA;EAAW,KAAA;EAAe,QAAA,EAAU,QAAA;AAAA;;ATZhD;;;;;iBSsBgB,QAAA,CAAS,IAAA,WAAe,MAAA;;cAgC3B,UAAA,EAAU,OAAA;EAAA;;;;;;;;;KAGX,cAAA;EAAmB,KAAA;AAAA;;iBAKf,YAAA,CAAa,IAAA;;;;;;;iBAUb,gBAAA,CAAiB,IAAA,WAAe,cAAA;;KAOpC,SAAA;;KAGA,aAAA;EAAkB,SAAA,EAAW,SAAA;EAAW,SAAA;AAAA;;KAGxC,YAAA,GAAe,aAAA;EAAkB,KAAA;AAAA;;;;;;;iBA4E7B,cAAA,CAAe,IAAA,WAAe,YAAA;;;;iBCjU9B,UAAA,CAAW,MAAA;;;;AVnE3B;;;;;KWCY,iBAAA;;;;;cA0EC,aAAA,SAAsB,KAAA;EAAA,SACjB,IAAA,EAAM,iBAAA;;WAEN,MAAA;cAEJ,IAAA,EAAM,iBAAA,EAAmB,OAAA,UAAiB,MAAA;AAAA;;;;;;;;cAgB3C,eAAA,SAAwB,aAAA;EAAA,SACnB,MAAA,EADW,KAAA;cAGf,MAAA,EAFmC,KAAA;AAAA;;;;;AXpEjD;;;;;cWuFa,oBAAA,SAA6B,KAAA;EAAA,SACxB,UAAA,EADgB,SAAA;cAGpB,UAAA,EAF2C,SAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/policy-builder.ts","../src/policy-coder.ts","../src/path.ts","../src/descriptor.ts","../src/policy-validator.ts","../src/constraint.ts","../src/policy-enforcer.ts","../src/bytes.ts","../src/descriptor-coder.ts","../src/constants.ts","../src/operators.ts","../src/errors.ts"],"mappings":";;KAKY,GAAA;;KAGA,OAAA;;KAGA,IAAA;EAAS,KAAA;EAAe,GAAA;AAAA;;;AAApC;;;KAWY,OAAA;EACV,SAAA,GAAY,OAAA;EACZ,QAAA;EACA,cAAA;EACA,WAAA;EACA,OAAA;EACA,QAAA,GAAW,OAAA;EACX,OAAA;EACA,QAAA;AAAA;;KAIU,aAAA;EAAkB,EAAA;EAAU,YAAA;AAAA;EAA2B,EAAA;EAAW,UAAA,EAAY,SAAA;AAAA;AAA1F;AAAA,KAGY,uBAAA;;KAGA,wBAAA;EACV,IAAA;AAAA;;KAIU,yBAAA;EACV,IAAA,uBAZiG;EAcjG,aAAA,EAAe,GAAA,EAXL;EAaV,aAAA,EAAe,GAAA;AAAA;;;AAVjB;;KAiBY,uBAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAZY;EAclB,QAAA,UAhBA;EAkBA,MAAA,WAhBA;EAkBA,WAAA,GAAc,GAAA;AAAA;;AAXhB;;;;;;;;;;;KA0BY,sBAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAL0B;EAOhC,MAAA,UAFM;EAIN,WAAA,EAAa,GAAA,EAGG;EADhB,QAAA;EACA,aAAA,GAAgB,GAAA;EAKK;;;;EAArB,eAAA,GAAkB,GAAA;EAClB,YAAA;AAAA;;;;;KAOG,yBAAA,WAAoC,uBAAA;EACvC,IAAA,EAAM,CAAA;EACN,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA;EACN,MAAA;EACA,WAAA,GAAc,GAAA;EACd,QAAA;EACA,YAAA;AAAA;;;;;;;;;KAWU,2BAAA,GACR,yBAAA,6BACA,yBAAA;;KAGQ,gCAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAvBQ;EAyBd,aAAA,EAAe,GAAA;AAAA;;;AAZjB;;;KAoBY,0BAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA,EAnBN;EAqBA,QAAA,UAnBA;EAqBA,aAAA,EAAe,GAAA;EACf,MAAA;EACA,WAAA,GAAc,GAAA;EACd,YAAA;AAAA;;KAIU,6BAAA;EACV,IAAA;EACA,KAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA,EAAM,GAAA;AAAA;;;;;;;KASI,SAAA,GACR,wBAAA,GACA,yBAAA,GACA,uBAAA,GACA,sBAAA,GACA,2BAAA,GACA,0BAAA,GACA,gCAAA,GACA,6BAAA;;KAGQ,aAAA,GAAgB,SAAA;;KAOhB,UAAA;EACV,cAAA;EACA,QAAA,EAAU,GAAA;EACV,UAAA,EAAY,GAAA;EACZ,MAAA,EAAQ,UAAA;EACR,IAAA,GAAO,IAAA;AAAA;AArCT;AAAA,KAyCY,UAAA;EACV,KAAA;EACA,IAAA,EAAM,GAAA;EACN,SAAA,EAAW,GAAA,IA1CX;EA4CA,IAAA,GAAO,GAAA;EACP,IAAA,GAAO,IAAA;AAAA;;KAQG,KAAA;EAAa,KAAA,EAAO,CAAA;EAAG,IAAA,EAAM,IAAA;AAAA;;KAG7B,YAAA;EACV,KAAA;EACA,QAAA;EACA,SAAA;EACA,UAAA;EACA,IAAA,EAAM,GAAA;EACN,IAAA,EAAM,IAAA;AAAA;;KAII,WAAA;EACV,QAAA,EAAU,KAAA;EACV,KAAA,EAAO,KAAA;EACP,SAAA,EAAW,KAAA;EACX,IAAA,EAAM,KAAA,CAAM,GAAA,GArDV;EAuDF,IAAA,GAAO,KAAA,CAAM,GAAA;EACb,MAAA,EAAQ,KAAA;EACR,UAAA,EAAY,KAAA;EACZ,IAAA,EAAM,KAAA,CAAM,GAAA;EACZ,IAAA,EAAM,IAAA;AAAA;;KAII,YAAA;EACV,SAAA,EAAW,KAAA;EACX,SAAA,EAAW,KAAA;EACX,KAAA,EAAO,WAAA;EACP,IAAA,EAAM,IAAA;AAAA;;KAII,aAAA;EACV,MAAA,EAAQ,KAAA;EACR,QAAA,EAAU,KAAA,CAAM,GAAA;EAChB,UAAA,EAAY,KAAA;EACZ,UAAA;IAAc,GAAA,EAAK,GAAA;IAAK,MAAA,EAAQ,KAAA;MAAQ,OAAA;MAAiB,UAAA;IAAA;IAAuB,MAAA,EAAQ,YAAA;IAAgB,IAAA,EAAM,IAAA;EAAA;EAC9G,UAAA,EAAY,KAAA;EACZ,MAAA,EAAQ,YAAA;EACR,IAAA,EAAM,IAAA;EACN,OAAA;EACA,cAAA;AAAA;;KAQU,aAAA;;KAGA,aAAA;;;;;;;KAQA,SAAA;;KA8DA,KAAA;EACV,QAAA,EAAU,aAAA;EACV,QAAA,EAAU,aAAA;EACV,UAAA;EACA,eAAA;EACA,IAAA,EAAM,SAAA;EACN,MAAA,EAAQ,GAAA;EACR,MAAA,EAAQ,GAAA;EACR,OAAA;AAAA;;;AA3VF;AAAA,cCuJa,aAAA;EAAA,QACH,KAAA;EAAA,QAED,WAAA,CAAA;ED1JM;AAGf;;;EAHe,OCkKN,MAAA,CAAO,SAAA,WAAoB,aAAA;ED/JjB;AAGnB;;;EAHmB,OC+KV,SAAA,CAAU,QAAA,WAAmB,aAAA;ED5KC;AAWvC;;;;;;ECmLE,GAAA,CAAI,UAAA,EAAY,UAAA;EDhLhB;ECyNA,EAAA,CAAA;EDvNA;;;;;;;AAOF;;;ECoOE,KAAA,CAAA,GAAS,GAAA;EDpOmB;;;;;;;ECqP5B,WAAA,CAAA,GAAe,GAAA;EDlPkB;;;;EC2PjC,QAAA,CAAA,GAAY,KAAA;EDxPsB;EAAA,QC+P1B,WAAA;ED9PR;EAAA,QCuQQ,YAAA;AAAA;;;ADxSV;;;;;AAAA,iBE8iBS,MAAA,CAAO,IAAA,EAAM,UAAA,GAAa,GAAA;;;;;AFhiBnC;;iBEunBS,MAAA,CAAO,IAAA,EAAM,GAAA,GAAM,UAAA;;;;;;;iBA6CnB,SAAA,CAAQ,IAAA,EAAM,GAAA,GAAM,aAAA;;cAKhB,WAAA;;;;;;;AF1rBb;AAAA,cGWa,UAAA;EAAA,SAA2C,GAAA;EAAA,SAAA,GAAA;AAAA;AHRxD;AAAA,KGWY,cAAA;EAAmB,KAAA;AAAA;;iBAOf,YAAA,CAAa,IAAA;;;;;AHJ7B;;iBGcgB,gBAAA,CAAiB,IAAA,WAAe,cAAA;;;;;;iBAiChC,cAAA,CAAe,IAAA,EAAM,GAAA;;;;KC1DzB,QAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA;AAAA;;;;;iBAyEO,UAAA,CAAW,IAAA,EAAM,UAAA,EAAY,MAAA;;;;;iBAQ7B,gBAAA,CAAiB,IAAA,EAAM,UAAA,EAAY,WAAA,UAAqB,UAAA;;;AJ7DjE;;iBI6ES,UAAA,CAAW,IAAA,EAAM,UAAA;;iBAQjB,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,KAAA;;;;;;;AJlFvC;iBIqGS,OAAA,CAAQ,IAAA,EAAM,UAAA,EAAY,MAAA,WAAiB,QAAA;;;;AJlGpD;;;;;AAKA;;;;iBI8GS,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,KAAA,aAAkB,QAAA;;;;;;;AJlGpD;;;iBI+GS,QAAA,CAAS,IAAA,EAAM,UAAA,EAAY,KAAA;EAAoB,QAAA,EAAU,QAAA;EAAU,sBAAA;AAAA;;;;;;iBAmDnE,eAAA,CAAgB,IAAA,EAAM,UAAA,EAAY,MAAA;;;;AJxI3C;;iBIiJS,iBAAA,CAAkB,IAAA,EAAM,UAAA,EAAY,MAAA;;;;;iBAWpC,kBAAA,CAAmB,MAAA;;;;;;;;;;iBA+InB,WAAA,CAAY,IAAA,EAAM,UAAA,EAAY,KAAA,aAAkB,UAAA;;cAiC5C,UAAA;;;;;;;;;;;;;;;;;;;iBChNG,WAAA,CAAY,MAAA,UAAgB,QAAA,EAAU,QAAA;;;;;ALpMtD;;;;;AAWA;iBKkmCS,QAAA,CAAS,IAAA,EAAM,UAAA,GAAa,KAAA;;cAiBxB,eAAA;mBAA8B,QAAA;AAAA;;;ALpoC3C;AAAA,KMOY,WAAA;;;;ANJZ;KMuHY,eAAA;uEAEV,aAAA,UNzHiB;EM2HjB,QAAA;AAAA;;;;;cAqBW,iBAAA,iBAAkC,WAAA,GAAc,WAAA,aAAwB,UAAA;EAAA,SAC1E,KAAA;EAAA,SACA,IAAA,EAAM,GAAA;EAAA,SACN,SAAA,EAAW,GAAA;EN9HpB;;;;AAKF;;EALE,SMqIS,eAAA,EAAiB,eAAA;ENhIuE;cMmIrF,KAAA,UAAe,IAAA,EAAM,GAAA;ENnIK;;;;EAAA,QM8I9B,IAAA;EN9IyF;EM6JjG,EAAA,CAAG,KAAA,EAAO,OAAA;EN1JuB;EM+JjC,GAAA,CAAI,KAAA,EAAO,OAAA;EN/JsB;EMoKjC,KAAA,CAAM,iBAAA;ENjKI;EMsKV,MAAA,CAAO,iBAAA;;EAKP,EAAA,CAAG,KAAA;EN1KC;EM+KJ,EAAA,CAAG,KAAA;EN3KgC;EMgLnC,GAAA,CAAI,KAAA;EN3Kc;EMgLlB,GAAA,CAAI,KAAA;ENlLJ;;;;EM0LA,OAAA,CAAQ,GAAA,UAAa,GAAA;ENxLH;AAOpB;;;;EM8LE,IAAA,CAAK,MAAA,WAAiB,OAAA;EN5LtB;;;;EMoMA,KAAA,CAAM,MAAA,WAAiB,OAAA;EN/LvB;EMwMA,UAAA,CAAW,IAAA;ENpMX;EMyMA,UAAA,CAAW,IAAA;ENzMM;EM8MjB,WAAA,CAAY,IAAA;EN/LF;EMwMV,QAAA,CAAS,MAAA;;EAKT,QAAA,CAAS,MAAA;ENpMI;EMyMb,QAAA,CAAS,MAAA;ENjMS;EMsMlB,SAAA,CAAU,MAAA;ENtMW;EM2MrB,SAAA,CAAU,MAAA;EN1NV;;;;EMkOA,aAAA,CAAc,GAAA,UAAa,GAAA;AAAA;;;;;iBAab,GAAA,CAAI,EAAA,aAAe,IAAA,aAAiB,iBAAA;;iBAMpC,SAAA,CAAA,GAAa,iBAAA,CAAkB,OAAA;;iBAK/B,QAAA,CAAA,GAAY,iBAAA;;iBAKZ,cAAA,CAAA,GAAkB,iBAAA;;iBAKlB,WAAA,CAAA,GAAe,iBAAA;;iBAKf,OAAA,CAAA,GAAW,iBAAA;;iBAKX,QAAA,CAAA,GAAY,iBAAA,CAAkB,OAAA;;iBAK9B,OAAA,CAAA,GAAW,iBAAA;;iBAKX,QAAA,CAAA,GAAY,iBAAA;;;ANxW5B;;;;;AAGA;;;;AAHA,iBOuDS,KAAA,CAAM,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,GAAA,EAAK,OAAA,GAAU,OAAA,GAAU,aAAA;APjD/D;;;;;AAWA;;;;AAXA,iBOqHS,OAAA,CAAQ,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,GAAA,EAAK,OAAA,GAAU,OAAA;;cA4f1C,cAAA;gBAAmC,KAAA;kBAAA,OAAA;AAAA;;;APvnBhD;AAAA,iBQWgB,UAAA,CAAW,GAAA,WAAc,UAAA;;iBAqBzB,UAAA,CAAW,KAAA,EAAO,UAAA,GAAa,GAAA;;iBAqD/B,SAAA,CAAU,GAAA,WAAc,OAAA;;;ARrFxC;;;;;AAGA;;;;AAHA,iBSyMS,SAAA,CAAU,QAAA,WAAmB,UAAA;ATnMtC;;;;;AAWA;;;;AAXA,iBS8QS,OAAA,CAAQ,IAAA,EAAM,UAAA;;cAoJV,eAAA;oBAAwC,SAAA;kBAAA,OAAA;AAAA;;;;cChYxC,YAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA8DR,OAAA;EAAA,SAAsC,GAAA;EAAA,SAAsB,IAAA;AAAA,wBAChD,CAAA,YAAa,CAAA,UAAW,CAAA;;;;;;;;cAgC5B,KAAA,EAAK,OAAA;EAAA;;;;;;;;AVtChB;AAAA,KUyCU,SAAA;EAAc,KAAA;AAAA;;;;;;;iBAYV,WAAA,CAAY,IAAA,WAAe,SAAA;;cAW9B,QAAA;EAAA;;;;;;;;;;;;;;;;cAkCA,eAAA,EAAe,OAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGf,uBAAA;;KAGD,mBAAA;EAAwB,KAAA;EAAe,UAAA,QAApB,OAAA;EAAiE,QAAA;AAAA;;;;;;iBAchF,mBAAA,CAAoB,IAAA,WAAe,mBAAA;;;;;;;iBAUnC,qBAAA,CAAsB,IAAA,WAAe,mBAAA;;KAgBzC,QAAA;;cAGN,QAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqBO,EAAA,EAAI,OAAA,QAAe,QAAA;EAAA,SAAuB,GAAA;AAAA;;KAG3C,MAAA;EAAW,KAAA;EAAe,QAAA,EAAU,QAAA;AAAA;;;;;;;iBAYhC,QAAA,CAAS,IAAA,WAAe,MAAA;;;;iBClNxB,UAAA,CAAW,MAAA;;KAsKf,SAAA;;KAGA,aAAA;EAAkB,SAAA,EAAW,SAAA;EAAW,SAAA;AAAA;;KAGxC,YAAA,GAAe,aAAA;EAAkB,KAAA;AAAA;;;;;;;iBA0F7B,cAAA,CAAe,IAAA,WAAe,YAAA;;;;AX5U9C;;;;;AAGA;;;KYCY,iBAAA;;AZEZ;;;cY6Ea,aAAA,SAAsB,KAAA;EAAA,SACjB,IAAA,EAAM,iBAAA;EZnEZ;EAAA,SYqEM,MAAA;cAEJ,IAAA,EAAM,iBAAA,EAAmB,OAAA,UAAiB,MAAA;AAAA;;;;;;;;cAiB3C,eAAA,SAAwB,aAAA;EAAA,SACnB,MAAA,EADW,KAAA;cAGf,MAAA,EAFmC,KAAA;AAAA;;AZ7EjD;;;;;;;;cY+Fa,oBAAA,SAA6B,KAAA;EAAA,SACxB,UAAA,EADgB,SAAA;cAGpB,UAAA,EAF2C,SAAA;AAAA"}