@callcium/sdk 0.9.0 → 0.11.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import { keccak_256 } from "@noble/hashes/sha3.js";
+import { utf8ToBytes } from "@noble/hashes/utils.js";
 //#region src/errors.ts
-var CallciumError = class CallciumError extends Error {
+var CallciumError = class extends Error {
 	code;
 	offset;
 	constructor(code, message, offset) {
@@ -8,25 +9,23 @@ var CallciumError = class CallciumError extends Error {
 		super(`${prefix}${message}`);
 		this.name = "CallciumError";
 		this.code = code;
-		Object.setPrototypeOf(this, CallciumError.prototype);
+		if (offset !== void 0) this.offset = offset;
 	}
 };
-var ValidationError = class ValidationError extends CallciumError {
+var ValidationError = class extends CallciumError {
 	issues;
 	constructor(issues) {
 		super("VALIDATION_ERROR", issues[0]?.message ?? "Policy validation failed");
 		this.name = "ValidationError";
 		this.issues = issues;
-		Object.setPrototypeOf(this, ValidationError.prototype);
 	}
 };
-var PolicyViolationError = class PolicyViolationError extends Error {
+var PolicyViolationError = class extends Error {
 	violations;
 	constructor(violations) {
 		super(formatDiagnostic(violations[0]));
 		this.name = "PolicyViolationError";
 		this.violations = violations;
-		Object.setPrototypeOf(this, PolicyViolationError.prototype);
 	}
 };
 function formatDiagnostic(violation) {
@@ -36,29 +35,29 @@ function formatDiagnostic(violation) {
 }
 //#endregion
 //#region src/bytes.ts
-const HEX_BODY_RE = /^[0-9a-fA-F]*$/;
+const hexBodyPattern = /^[0-9a-fA-F]*$/;
 const HEX_DIGITS = "0123456789abcdef";
-const NIBBLE = new Int8Array(128).fill(-1);
+const nibble = new Int8Array(128).fill(-1);
 for (let value = 0; value < 16; value++) {
-	NIBBLE[HEX_DIGITS.charCodeAt(value)] = value;
-	NIBBLE[HEX_DIGITS.toUpperCase().charCodeAt(value)] = value;
+	nibble[HEX_DIGITS.charCodeAt(value)] = value;
+	nibble[HEX_DIGITS.toUpperCase().charCodeAt(value)] = value;
 }
 function hexToBytes(hex) {
 	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
 	if (clean.length % 2 !== 0) throw new CallciumError("INVALID_HEX", "Odd-length hex string");
 	const bytes = new Uint8Array(clean.length / 2);
 	for (let i = 0; i < bytes.length; i++) {
-		const high = NIBBLE[clean.charCodeAt(i * 2)] ?? -1;
-		const low = NIBBLE[clean.charCodeAt(i * 2 + 1)] ?? -1;
+		const high = nibble[clean.charCodeAt(i * 2)] ?? -1;
+		const low = nibble[clean.charCodeAt(i * 2 + 1)] ?? -1;
 		if (high < 0 || low < 0) throw new CallciumError("INVALID_HEX", "Invalid hex characters");
 		bytes[i] = high << 4 | low;
 	}
 	return bytes;
 }
-const HEX_LUT = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+const hexPairs = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 function bytesToHex(bytes) {
 	let body = "";
-	for (let i = 0; i < bytes.length; i++) body += HEX_LUT[bytes[i]];
+	for (let i = 0; i < bytes.length; i++) body += hexPairs[bytes[i]];
 	return `0x${body}`;
 }
 function toHex(data, start, end) {
@@ -94,7 +93,7 @@ function bigintToHex(value) {
 function toAddress(hex) {
 	const body = hex.startsWith("0x") ? hex.slice(2) : hex;
 	if (body.length !== 40) throw new CallciumError("INVALID_HEX", `Invalid address length: expected 40 hex chars, got ${body.length}`);
-	if (!HEX_BODY_RE.test(body)) throw new CallciumError("INVALID_HEX", "Invalid hex characters in address");
+	if (!hexBodyPattern.test(body)) throw new CallciumError("INVALID_HEX", "Invalid hex characters in address");
 	return `0x${body}`;
 }
 //#endregion
@@ -117,6 +116,12 @@ const DescriptorFormat = {
 	MAX_PARAMS: 255,
 	MAX_NESTING_DEPTH: 64
 };
+const RULE_DATALENGTH_SIZE = 2;
+const PATH_STEP_SIZE = 2;
+const RULE_FIXED_OVERHEAD = 7;
+function fieldMax(byteWidth) {
+	return 256 ** byteWidth - 1;
+}
 const PolicyFormat = {
 	VERSION: 2,
 	VERSION_MASK: 15,
@@ -136,11 +141,12 @@ const PolicyFormat = {
 	RULE_SCOPE_OFFSET: 2,
 	RULE_DEPTH_OFFSET: 3,
 	RULE_PATH_OFFSET: 4,
-	PATH_STEP_SIZE: 2,
+	PATH_STEP_SIZE,
+	PATH_STEP_MAX: fieldMax(PATH_STEP_SIZE),
 	RULE_OPCODE_SIZE: 1,
-	RULE_DATALENGTH_SIZE: 2,
-	RULE_FIXED_OVERHEAD: 7,
-	RULE_MIN_SIZE: 9,
+	RULE_DATALENGTH_SIZE,
+	RULE_FIXED_OVERHEAD,
+	RULE_MIN_SIZE: RULE_FIXED_OVERHEAD + PATH_STEP_SIZE,
 	HINT_HEADER_SIZE: 1,
 	HINT_HOP_SIZE: 8,
 	HINT_HOP_INDEX_OFFSET: 4,
@@ -163,10 +169,17 @@ const PolicyFormat = {
 	HINT_META_ELEM_DYNAMIC: 32768,
 	HINT_META_DYNAMIC_ARRAY: 16384,
 	HINT_META_RESERVED_MASK: 12288,
-	HINT_META_STRIDE_MASK: 4095
+	HINT_META_STRIDE_MASK: 4095,
+	MAX_PATH_DEPTH: 32,
+	MAX_QUANTIFIED_ARRAY_LENGTH: 256,
+	MAX_SET_MEMBERS: Math.floor(fieldMax(RULE_DATALENGTH_SIZE) / 32)
 };
+function formatCode(code, byteWidth) {
+	if (!Number.isInteger(code) || code < 0 || code > fieldMax(byteWidth)) return String(code);
+	return `0x${code.toString(16).padStart(byteWidth * 2, "0")}`;
+}
 function buildCodeMap(table) {
-	return Object.fromEntries(table.map((e) => [e.key, e.code]));
+	return Object.fromEntries(table.map((entry) => [entry.key, entry.code]));
 }
 const SCOPE_TABLE = [{
 	key: "CONTEXT",
@@ -178,7 +191,7 @@ const SCOPE_TABLE = [{
 	label: "calldata"
 }];
 const Scope = buildCodeMap(SCOPE_TABLE);
-const scopeByCode = new Map(SCOPE_TABLE.map((e) => [e.code, { label: e.label }]));
+const scopeByCode = new Map(SCOPE_TABLE.map((entry) => [entry.code, { label: entry.label }]));
 function lookupScope(code) {
 	const info = scopeByCode.get(code);
 	if (!info) throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${code}`);
@@ -200,83 +213,79 @@ const TypeCode = {
 	DYNAMIC_ARRAY: 129,
 	TUPLE: 144
 };
-const CTX_PROP_TABLE = [
+const CTX_PROPERTY_TABLE = [
 	{
 		key: "MSG_SENDER",
 		code: 0,
 		label: "msg.sender",
+		contextKey: "msgSender",
 		typeCode: TypeCode.ADDRESS
 	},
 	{
 		key: "MSG_VALUE",
 		code: 1,
 		label: "msg.value",
+		contextKey: "msgValue",
 		typeCode: TypeCode.UINT_MAX
 	},
 	{
 		key: "BLOCK_TIMESTAMP",
 		code: 2,
 		label: "block.timestamp",
+		contextKey: "blockTimestamp",
 		typeCode: TypeCode.UINT_MAX
 	},
 	{
 		key: "BLOCK_NUMBER",
 		code: 3,
 		label: "block.number",
+		contextKey: "blockNumber",
 		typeCode: TypeCode.UINT_MAX
 	},
 	{
 		key: "CHAIN_ID",
 		code: 4,
 		label: "block.chainid",
+		contextKey: "chainId",
 		typeCode: TypeCode.UINT_MAX
 	},
 	{
 		key: "TX_ORIGIN",
 		code: 5,
 		label: "tx.origin",
+		contextKey: "txOrigin",
 		typeCode: TypeCode.ADDRESS
 	},
 	{
 		key: "BASE_FEE",
 		code: 6,
 		label: "block.basefee",
+		contextKey: "baseFee",
 		typeCode: TypeCode.UINT_MAX
 	},
 	{
 		key: "GAS_PRICE",
 		code: 7,
 		label: "tx.gasprice",
+		contextKey: "gasPrice",
 		typeCode: TypeCode.UINT_MAX
 	}
 ];
-const ContextProperty = buildCodeMap(CTX_PROP_TABLE);
-const MAX_CONTEXT_PROPERTY_ID = Math.max(...CTX_PROP_TABLE.map((e) => e.code));
-const CTX_KEY_MAP = {
-	MSG_SENDER: "msgSender",
-	MSG_VALUE: "msgValue",
-	BLOCK_TIMESTAMP: "blockTimestamp",
-	BLOCK_NUMBER: "blockNumber",
-	CHAIN_ID: "chainId",
-	TX_ORIGIN: "txOrigin",
-	BASE_FEE: "baseFee",
-	GAS_PRICE: "gasPrice"
-};
-const ctxPropByCode = new Map(CTX_PROP_TABLE.map((e) => [e.code, {
-	label: e.label,
-	contextKey: CTX_KEY_MAP[e.key],
-	typeCode: e.typeCode
+const ContextProperty = buildCodeMap(CTX_PROPERTY_TABLE);
+const MAX_CONTEXT_PROPERTY_ID = Math.max(...CTX_PROPERTY_TABLE.map((entry) => entry.code));
+const ctxPropertyByCode = new Map(CTX_PROPERTY_TABLE.map((entry) => [entry.code, {
+	label: entry.label,
+	contextKey: entry.contextKey,
+	typeCode: entry.typeCode
 }]));
+function findContextProperty(code) {
+	return ctxPropertyByCode.get(code);
+}
 function lookupContextProperty(code) {
-	const info = ctxPropByCode.get(code);
-	if (!info) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ${code}`);
+	const info = ctxPropertyByCode.get(code);
+	if (!info) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID ${formatCode(code, PATH_STEP_SIZE)}`);
 	return info;
 }
-const Limits = {
-	MAX_PATH_DEPTH: 32,
-	MAX_QUANTIFIED_ARRAY_LENGTH: 256,
-	MAX_SET_MEMBERS: Math.floor((256 ** PolicyFormat.RULE_DATALENGTH_SIZE - 1) / 32)
-};
 const OP_TABLE = [
 	{
 		key: "EQ",
@@ -385,23 +394,21 @@ const Op = {
 	...buildCodeMap(OP_TABLE),
 	NOT: 128
 };
-const opByCode = new Map(OP_TABLE.map((e) => [e.code, {
-	label: e.label,
-	operands: e.operands
+const opByCode = new Map(OP_TABLE.map((entry) => [entry.code, {
+	label: entry.label,
+	operands: entry.operands
 }]));
 function lookupOp(code) {
 	const base = code & ~Op.NOT;
 	const info = opByCode.get(base);
-	if (!info) throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}`);
+	if (!info) throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code ${formatCode(base, PolicyFormat.RULE_OPCODE_SIZE)}`);
 	return info;
 }
-function isValidOperatorData(opBase, dataLength) {
-	const operands = opByCode.get(opBase)?.operands;
-	if (operands === "single") return dataLength === 32;
-	if (operands === "range") return dataLength === 64;
-	if (operands === "variadic") return dataLength > 0 && dataLength % 32 === 0;
-	return false;
+function operandsOf(opBase) {
+	return opByCode.get(opBase)?.operands;
 }
+//#endregion
+//#region src/path.ts
 const QUANTIFIER_TABLE = [{
 	key: "ALL",
 	code: 65535,
@@ -412,23 +419,347 @@ const QUANTIFIER_TABLE = [{
 	label: "any"
 }];
 const Quantifier = buildCodeMap(QUANTIFIER_TABLE);
-const quantifierByCode = new Map(QUANTIFIER_TABLE.map((e) => [e.code, { label: e.label }]));
+const quantifierByCode = new Map(QUANTIFIER_TABLE.map((entry) => [entry.code, { label: entry.label }]));
 function isQuantifier(step) {
 	return step >= Quantifier.ANY;
 }
 function lookupQuantifier(code) {
 	const info = quantifierByCode.get(code);
-	if (!info) throw new CallciumError("UNKNOWN_QUANTIFIER", `Unknown quantifier step 0x${code.toString(16)}`);
+	if (!info) throw new CallciumError("UNKNOWN_QUANTIFIER", `Unknown quantifier step ${formatCode(code, PolicyFormat.PATH_STEP_SIZE)}`);
 	return info;
 }
+function encodePath(steps) {
+	const buffer = new Uint8Array(steps.length * PolicyFormat.PATH_STEP_SIZE);
+	for (let i = 0; i < steps.length; i++) {
+		const step = steps[i];
+		if (!Number.isInteger(step) || step < 0 || step > PolicyFormat.PATH_STEP_MAX) throw new CallciumError("PATH_STEP_OVERFLOW", `Path step ${step} is outside the path step field`);
+		writeBE16(buffer, i * PolicyFormat.PATH_STEP_SIZE, step);
+	}
+	return bytesToHex(buffer);
+}
+function parsePathSteps(path) {
+	const bytes = hexToBytes(path);
+	if (bytes.length % PolicyFormat.PATH_STEP_SIZE !== 0) throw new CallciumError("MALFORMED_PATH", `Path byte length ${bytes.length} is not a whole number of steps`);
+	const steps = [];
+	for (let offset = 0; offset < bytes.length; offset += PolicyFormat.PATH_STEP_SIZE) steps.push(readU16(bytes, offset));
+	return steps;
+}
+//#endregion
+//#region src/constraint.ts
+const OPERAND_MIN = -(2n ** 255n);
+const OPERAND_MAX = 2n ** 256n - 1n;
+function checkOperandRange(value) {
+	if (value < OPERAND_MIN || value > OPERAND_MAX) throw new CallciumError("OPERAND_OVERFLOW", `Operand ${value} is outside the range a 32-byte word represents`);
+	return value;
+}
+function addressBody(value) {
+	return toAddress(value).slice(2);
+}
+function encodeWord(value) {
+	const word = new Uint8Array(32);
+	if (typeof value === "boolean") {
+		word[31] = value ? 1 : 0;
+		return word;
+	}
+	if (typeof value === "string") {
+		word.set(hexToBytes(addressBody(value)), 12);
+		return word;
+	}
+	let bigValue = checkOperandRange(value);
+	for (let i = 31; i >= 0; i--) {
+		word[i] = Number(bigValue & 255n);
+		bigValue >>= 8n;
+	}
+	return word;
+}
+function singleOp(opCode, value) {
+	const buffer = new Uint8Array(33);
+	buffer[0] = opCode;
+	buffer.set(encodeWord(value), 1);
+	return bytesToHex(buffer);
+}
+function rangeOp(opCode, min, max) {
+	const minValue = checkOperandRange(min);
+	const maxValue = checkOperandRange(max);
+	if (minValue > maxValue) throw new CallciumError("INVALID_RANGE", `Range min (${minValue}) must not exceed max (${maxValue})`);
+	const buffer = new Uint8Array(65);
+	buffer[0] = opCode;
+	buffer.set(encodeWord(minValue), 1);
+	buffer.set(encodeWord(maxValue), 33);
+	return bytesToHex(buffer);
+}
+function contextOperand(contextPropertyId) {
+	lookupContextProperty(contextPropertyId);
+	return BigInt(contextPropertyId);
+}
+function setOp(opCode, values) {
+	const words = values.map((value) => {
+		if (typeof value === "bigint") return BigInt.asUintN(256, checkOperandRange(value));
+		if (typeof value === "boolean") return value ? 1n : 0n;
+		return BigInt("0x" + addressBody(value));
+	});
+	const deduped = [...new Set(words)].toSorted((a, b) => a < b ? -1 : a > b ? 1 : 0);
+	if (deduped.length === 0) throw new CallciumError("EMPTY_SET", "Set must contain at least one value");
+	if (deduped.length > PolicyFormat.MAX_SET_MEMBERS) throw new CallciumError("SET_TOO_LARGE", `Set must contain at most ${PolicyFormat.MAX_SET_MEMBERS} values`);
+	const buffer = new Uint8Array(1 + deduped.length * 32);
+	buffer[0] = opCode;
+	for (let i = 0; i < deduped.length; i++) buffer.set(encodeWord(deduped[i]), 1 + i * 32);
+	return bytesToHex(buffer);
+}
+function readOperandExtremes(constraint) {
+	return "operandExtremes" in constraint ? constraint.operandExtremes : void 0;
+}
+var ConstraintBuilder = class {
+	scope;
+	path;
+	operators;
+	operandExtremes;
+	constructor(scope, path) {
+		this.scope = scope;
+		this.path = path;
+		this.operators = [];
+		this.operandExtremes = {
+			leastNegative: 0n,
+			greatest: 0n
+		};
+	}
+	push(opHex, values = []) {
+		for (const value of values) {
+			if (typeof value !== "bigint") continue;
+			if (value < this.operandExtremes.leastNegative) this.operandExtremes.leastNegative = value;
+			if (value > this.operandExtremes.greatest) this.operandExtremes.greatest = value;
+		}
+		this.operators.push(opHex);
+		return this;
+	}
+	eq(value) {
+		return this.push(singleOp(Op.EQ, value), [value]);
+	}
+	neq(value) {
+		return this.push(singleOp(Op.EQ | Op.NOT, value), [value]);
+	}
+	eqCtx(contextPropertyId) {
+		return this.push(singleOp(Op.EQ_CTX, contextOperand(contextPropertyId)));
+	}
+	neqCtx(contextPropertyId) {
+		return this.push(singleOp(Op.EQ_CTX | Op.NOT, contextOperand(contextPropertyId)));
+	}
+	gt(bound) {
+		return this.push(singleOp(Op.GT, bound), [bound]);
+	}
+	lt(bound) {
+		return this.push(singleOp(Op.LT, bound), [bound]);
+	}
+	gte(bound) {
+		return this.push(singleOp(Op.GTE, bound), [bound]);
+	}
+	lte(bound) {
+		return this.push(singleOp(Op.LTE, bound), [bound]);
+	}
+	between(min, max) {
+		return this.push(rangeOp(Op.BETWEEN, min, max), [min, max]);
+	}
+	isIn(values) {
+		return this.push(setOp(Op.IN, values), values);
+	}
+	notIn(values) {
+		return this.push(setOp(Op.IN | Op.NOT, values), values);
+	}
+	bitmaskAll(mask) {
+		return this.push(singleOp(Op.BITMASK_ALL, mask));
+	}
+	bitmaskAny(mask) {
+		return this.push(singleOp(Op.BITMASK_ANY, mask));
+	}
+	bitmaskNone(mask) {
+		return this.push(singleOp(Op.BITMASK_NONE, mask));
+	}
+	lengthEq(length) {
+		return this.push(singleOp(Op.LENGTH_EQ, length));
+	}
+	lengthGt(length) {
+		return this.push(singleOp(Op.LENGTH_GT, length));
+	}
+	lengthLt(length) {
+		return this.push(singleOp(Op.LENGTH_LT, length));
+	}
+	lengthGte(length) {
+		return this.push(singleOp(Op.LENGTH_GTE, length));
+	}
+	lengthLte(length) {
+		return this.push(singleOp(Op.LENGTH_LTE, length));
+	}
+	lengthBetween(min, max) {
+		return this.push(rangeOp(Op.LENGTH_BETWEEN, min, max));
+	}
+};
+function arg(...steps) {
+	return new ConstraintBuilder(Scope.CALLDATA, encodePath(steps));
+}
+function msgSender() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_SENDER]));
+}
+function msgValue() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_VALUE]));
+}
+function blockTimestamp() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_TIMESTAMP]));
+}
+function blockNumber() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_NUMBER]));
+}
+function chainId() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.CHAIN_ID]));
+}
+function txOrigin() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.TX_ORIGIN]));
+}
+function baseFee() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BASE_FEE]));
+}
+function gasPrice() {
+	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.GAS_PRICE]));
+}
+//#endregion
+//#region src/operators.ts
+function toBigInt(bytes, offset = 0) {
+	const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 32);
+	return view.getBigUint64(0, false) << 192n | view.getBigUint64(8, false) << 128n | view.getBigUint64(16, false) << 64n | view.getBigUint64(24, false);
+}
+function isSigned(typeCode) {
+	return typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
+}
+function isLeftAligned(typeCode) {
+	return typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX || typeCode === TypeCode.FUNCTION;
+}
+function canonicalize(value, typeCode) {
+	if (typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX) {
+		const bits = BigInt(typeCode * 8);
+		return bits === 256n ? value : value & (1n << bits) - 1n;
+	}
+	if (typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX) {
+		const bits = (typeCode - TypeCode.INT_MIN + 1) * 8;
+		return bits === 256 ? value : BigInt.asUintN(256, BigInt.asIntN(bits, value));
+	}
+	if (typeCode === TypeCode.ADDRESS) return value & (1n << 160n) - 1n;
+	if (typeCode === TypeCode.BOOL) return value & 1n;
+	if (typeCode === TypeCode.FUNCTION) return value >> 64n << 64n;
+	if (typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX) {
+		const n = typeCode - TypeCode.FIXED_BYTES_MIN + 1;
+		if (n === 32) return value;
+		const padBits = BigInt((32 - n) * 8);
+		return value >> padBits << padBits;
+	}
+	return value;
+}
+function isLengthOp(opCode) {
+	const base = opCode & ~Op.NOT;
+	return base >= Op.LENGTH_EQ && base <= Op.LENGTH_BETWEEN;
+}
+function lengthToValueOp(base) {
+	if (base === Op.LENGTH_EQ) return Op.EQ;
+	if (base === Op.LENGTH_GT) return Op.GT;
+	if (base === Op.LENGTH_LT) return Op.LT;
+	if (base === Op.LENGTH_GTE) return Op.GTE;
+	if (base === Op.LENGTH_LTE) return Op.LTE;
+	return Op.BETWEEN;
+}
+function isLengthValidType(typeCode) {
+	return typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING || typeCode === TypeCode.DYNAMIC_ARRAY;
+}
+function compareTyped(a, b, typeCode) {
+	if (isSigned(typeCode)) {
+		const sa = BigInt.asIntN(256, a);
+		const sb = BigInt.asIntN(256, b);
+		return sa < sb ? -1 : sa > sb ? 1 : 0;
+	}
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function isIn(value, data) {
+	const count = data.length / 32;
+	let low = 0;
+	let high = count - 1;
+	while (low <= high) {
+		const mid = low + high >>> 1;
+		const elem = toBigInt(data, mid * 32);
+		if (value === elem) return true;
+		if (value < elem) high = mid - 1;
+		else low = mid + 1;
+	}
+	return false;
+}
+function applyOperator(opCode, value, valueLength, operandData, typeCode) {
+	let base = opCode & ~Op.NOT;
+	if (isLengthOp(base)) {
+		value = valueLength;
+		typeCode = TypeCode.UINT_MAX;
+		base = lengthToValueOp(base);
+	}
+	let result;
+	switch (base) {
+		case Op.EQ:
+			result = value === toBigInt(operandData, 0);
+			break;
+		case Op.GT:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) > 0;
+			break;
+		case Op.LT:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) < 0;
+			break;
+		case Op.GTE:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) >= 0;
+			break;
+		case Op.LTE:
+			result = compareTyped(value, toBigInt(operandData, 0), typeCode) <= 0;
+			break;
+		case Op.BETWEEN: {
+			const min = toBigInt(operandData, 0);
+			const max = toBigInt(operandData, 32);
+			result = compareTyped(value, min, typeCode) >= 0 && compareTyped(value, max, typeCode) <= 0;
+			break;
+		}
+		case Op.IN:
+			result = isIn(value, operandData);
+			break;
+		case Op.BITMASK_ALL: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) === mask;
+			break;
+		}
+		case Op.BITMASK_ANY: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) !== 0n;
+			break;
+		}
+		case Op.BITMASK_NONE: {
+			const mask = toBigInt(operandData, 0);
+			result = (value & mask) === 0n;
+			break;
+		}
+		default: throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code ${formatCode(base, PolicyFormat.RULE_OPCODE_SIZE)}`);
+	}
+	return (opCode & Op.NOT) !== 0 ? !result : result;
+}
+function isValidOperatorData(opBase, dataLength) {
+	const operands = operandsOf(opBase);
+	if (operands === "single") return dataLength === 32;
+	if (operands === "range") return dataLength === 64;
+	if (operands === "variadic") return dataLength > 0 && dataLength % 32 === 0;
+	return false;
+}
+function toOperatorBytes(operator) {
+	const bytes = hexToBytes(operator);
+	if (bytes.length < 1) throw new CallciumError("INVALID_OPERATOR_BYTES", "Operator must have at least one byte (opcode)");
+	return bytes;
+}
 function unknownTypeCode(code) {
-	throw new CallciumError("UNKNOWN_TYPE_CODE", `Unknown type code 0x${code.toString(16).padStart(2, "0")}`);
+	throw new CallciumError("UNKNOWN_TYPE_CODE", `Unknown type code ${formatCode(code, DescriptorFormat.TYPECODE_SIZE)}`);
 }
 const ELEMENTARY = {
 	typeClass: "elementary",
 	isDynamic: false
 };
-const ELEMENTARY_DYN = {
+const ELEMENTARY_DYNAMIC = {
 	typeClass: "elementary",
 	isDynamic: true
 };
@@ -450,7 +781,7 @@ function classifyTypeCode(code) {
 	if (code === TypeCode.ADDRESS || code === TypeCode.BOOL || code === TypeCode.FUNCTION) return ELEMENTARY;
 	if (code >= 68 && code <= 79) unknownTypeCode(code);
 	if (code >= TypeCode.FIXED_BYTES_MIN && code <= TypeCode.FIXED_BYTES_MAX) return ELEMENTARY;
-	if (code === TypeCode.BYTES || code === TypeCode.STRING) return ELEMENTARY_DYN;
+	if (code === TypeCode.BYTES || code === TypeCode.STRING) return ELEMENTARY_DYNAMIC;
 	if (code >= 114 && code <= 127) unknownTypeCode(code);
 	if (code === TypeCode.STATIC_ARRAY) return STATIC_ARR;
 	if (code === TypeCode.DYNAMIC_ARRAY) return DYNAMIC_ARR;
@@ -458,6 +789,13 @@ function classifyTypeCode(code) {
 	if (code === TypeCode.TUPLE) return TUPLE;
 	unknownTypeCode(code);
 }
+function isElementary(code) {
+	try {
+		return classifyTypeCode(code).typeClass === "elementary";
+	} catch {
+		return false;
+	}
+}
 function isAddressableTarget(code) {
 	let info;
 	try {
@@ -489,9 +827,29 @@ function lookupTypeCode(code) {
 }
 //#endregion
 //#region src/descriptor.ts
+function readNode(desc, offset) {
+	if (offset >= desc.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end of descriptor", offset);
+	const typeCode = desc[offset];
+	const info = classifyTypeCode(typeCode);
+	if (info.typeClass === "elementary") return {
+		typeCode,
+		staticWords: info.isDynamic ? 0 : 1,
+		nodeLength: DescriptorFormat.TYPECODE_SIZE
+	};
+	if (offset + DescriptorFormat.TYPECODE_SIZE + DescriptorFormat.COMPOSITE_META_SIZE > desc.length) throw new CallciumError("UNEXPECTED_END", "Incomplete composite metadata", offset);
+	const meta = readU24(desc, offset + DescriptorFormat.TYPECODE_SIZE);
+	const length = meta & DescriptorFormat.META_NODE_LENGTH_MASK;
+	const minHeader = info.typeClass === "tuple" ? DescriptorFormat.TUPLE_HEADER_SIZE : DescriptorFormat.ARRAY_HEADER_SIZE;
+	if (length < minHeader) throw new CallciumError("NODE_LENGTH_TOO_SMALL", `Composite node length ${length} is smaller than minimum header ${minHeader}`, offset);
+	if (offset + length > desc.length) throw new CallciumError("NODE_OVERFLOW", "Composite node extends beyond descriptor", offset);
+	return {
+		typeCode,
+		staticWords: meta >> DescriptorFormat.META_STATIC_WORDS_SHIFT,
+		nodeLength: length
+	};
+}
 function nodeLength(desc, offset) {
-	if (desc[offset] < TypeCode.STATIC_ARRAY) return DescriptorFormat.TYPECODE_SIZE;
-	return readU24(desc, offset + 1) & DescriptorFormat.META_NODE_LENGTH_MASK;
+	return readNode(desc, offset).nodeLength;
 }
 function tupleFieldOffset(desc, tupleOffset, fieldIndex) {
 	let cursor = tupleOffset + DescriptorFormat.TUPLE_HEADER_SIZE;
@@ -499,20 +857,18 @@ function tupleFieldOffset(desc, tupleOffset, fieldIndex) {
 	return cursor;
 }
 function paramCount(desc) {
+	if (desc.length < DescriptorFormat.HEADER_SIZE) throw new CallciumError("MALFORMED_HEADER", "Descriptor too short for header");
 	return desc[1];
 }
 function paramOffset(desc, index) {
-	const count = desc[1];
-	if (index >= count) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${index} out of range (paramCount=${count}).`);
+	const count = paramCount(desc);
+	if (index >= count) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${index} out of range (paramCount=${count})`);
 	let cursor = DescriptorFormat.HEADER_SIZE;
 	for (let i = 0; i < index; i++) cursor += nodeLength(desc, cursor);
 	return cursor;
 }
 function inspect$1(desc, offset) {
-	const typeCode = desc[offset];
-	let staticWords;
-	if (typeCode < TypeCode.STATIC_ARRAY) staticWords = typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING ? 0 : 1;
-	else staticWords = readU24(desc, offset + 1) >> DescriptorFormat.META_STATIC_WORDS_SHIFT;
+	const { typeCode, staticWords } = readNode(desc, offset);
 	return {
 		typeCode,
 		isDynamic: staticWords === 0,
@@ -523,27 +879,24 @@ function typeAt(desc, steps) {
 	return walkPath(desc, steps).typeInfo;
 }
 function walkPath(desc, steps) {
-	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
-	const paramIndex = steps[0];
-	const count = desc[1];
-	if (paramIndex >= count) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${paramIndex} out of range (paramCount=${count}).`);
-	let cursor = paramOffset(desc, paramIndex);
+	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step");
+	let cursor = paramOffset(desc, steps[0]);
 	let quantifiedStaticLength = 0;
 	for (let stepIndex = 1; stepIndex < steps.length; stepIndex++) {
 		const typeCode = desc[cursor];
 		const step = steps[stepIndex];
 		if (typeCode === TypeCode.TUPLE) {
 			const fields = tupleFieldCount(desc, cursor);
-			if (step >= fields) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fields} fields).`);
+			if (step >= fields) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fields} fields)`);
 			cursor = tupleFieldOffset(desc, cursor, step);
 		} else if (typeCode === TypeCode.STATIC_ARRAY || typeCode === TypeCode.DYNAMIC_ARRAY) {
 			if (typeCode === TypeCode.STATIC_ARRAY) if (isQuantifier(step)) quantifiedStaticLength = staticArrayLength(desc, cursor);
 			else {
 				const length = staticArrayLength(desc, cursor);
-				if (step >= length) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (length=${length}).`);
+				if (step >= length) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (length=${length})`);
 			}
 			cursor = arrayElementOffset(cursor);
-		} else throw new CallciumError("NOT_COMPOSITE", `Cannot descend into elementary type at offset ${cursor}.`);
+		} else throw new CallciumError("NOT_COMPOSITE", `Cannot descend into elementary type at offset ${cursor}`);
 	}
 	return {
 		typeInfo: inspect$1(desc, cursor),
@@ -561,7 +914,7 @@ function arrayElementOffset(offset) {
 	return offset + DescriptorFormat.ARRAY_HEADER_SIZE;
 }
 function uncompilablePath(stepIndex) {
-	return new CallciumError("UNCOMPILABLE_PATH", `Path step ${stepIndex} does not resolve to a hop-chain target.`);
+	return new CallciumError("UNCOMPILABLE_PATH", `Path step ${stepIndex} does not resolve to a hop-chain target`);
 }
 function headSpan(desc, offset, count) {
 	let span = 0;
@@ -668,7 +1021,7 @@ function encodeHint(walk, targetMeta, typeCode, depth) {
 	return out;
 }
 function compileHint(desc, steps) {
-	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
+	if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step");
 	const argIndex = steps[0];
 	if (argIndex >= paramCount(desc)) throw uncompilablePath(0);
 	const arg = headSpan(desc, DescriptorFormat.HEADER_SIZE, argIndex);
@@ -720,11 +1073,11 @@ function function_() {
 	return new Uint8Array([TypeCode.FUNCTION]);
 }
 function uintN(bits) {
-	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid uintN bits: ${bits}. Must be 8–256 in steps of 8.`);
+	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid uintN bits: ${bits}. Must be 8–256 in steps of 8`);
 	return new Uint8Array([TypeCode.UINT_MIN + (bits / 8 - 1)]);
 }
 function intN(bits) {
-	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid intN bits: ${bits}. Must be 8–256 in steps of 8.`);
+	if (bits < 8 || bits > 256 || bits % 8 !== 0) throw new CallciumError("UNKNOWN_TYPE", `Invalid intN bits: ${bits}. Must be 8–256 in steps of 8`);
 	return new Uint8Array([TypeCode.INT_MIN + (bits / 8 - 1)]);
 }
 function bytes() {
@@ -733,14 +1086,14 @@ function bytes() {
 function string_() {
 	return new Uint8Array([TypeCode.STRING]);
 }
-function bytesN(n) {
-	if (n < 1 || n > 32) throw new CallciumError("UNKNOWN_TYPE", `Invalid bytesN size: ${n}. Must be 1–32.`);
-	return new Uint8Array([TypeCode.FIXED_BYTES_MIN + (n - 1)]);
+function bytesN(length) {
+	if (length < 1 || length > 32) throw new CallciumError("UNKNOWN_TYPE", `Invalid bytesN size: ${length}. Must be 1–32`);
+	return new Uint8Array([TypeCode.FIXED_BYTES_MIN + (length - 1)]);
 }
 function array(elemDesc, length) {
 	if (length === void 0) {
 		const nodeLength = DescriptorFormat.ARRAY_HEADER_SIZE + elemDesc.length;
-		if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Dynamic array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+		if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Dynamic array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}`);
 		const meta24 = 0 << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 		const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + elemDesc.length);
 		buf[0] = TypeCode.DYNAMIC_ARRAY;
@@ -748,12 +1101,12 @@ function array(elemDesc, length) {
 		buf.set(elemDesc, 4);
 		return buf;
 	}
-	if (length <= 0 || length > DescriptorFormat.MAX_STATIC_ARRAY_LENGTH) throw new CallciumError("INVALID_ARRAY_LENGTH", `Static array length ${length} out of range. Must be 1–${DescriptorFormat.MAX_STATIC_ARRAY_LENGTH}.`);
+	if (length <= 0 || length > DescriptorFormat.MAX_STATIC_ARRAY_LENGTH) throw new CallciumError("INVALID_ARRAY_LENGTH", `Static array length ${length} out of range. Must be 1–${DescriptorFormat.MAX_STATIC_ARRAY_LENGTH}`);
 	const nodeLength = DescriptorFormat.ARRAY_HEADER_SIZE + elemDesc.length + DescriptorFormat.ARRAY_LENGTH_SIZE;
-	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Static array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Static array node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}`);
 	const elemStaticWords = extractStaticWords(elemDesc);
 	const staticWords = elemStaticWords === 0 ? 0 : length * elemStaticWords;
-	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Static array static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}.`);
+	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Static array static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}`);
 	const meta24 = staticWords << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 	const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + elemDesc.length + DescriptorFormat.ARRAY_LENGTH_SIZE);
 	buf[0] = TypeCode.STATIC_ARRAY;
@@ -763,10 +1116,10 @@ function array(elemDesc, length) {
 	return buf;
 }
 function tuple(fieldDescs) {
-	if (fieldDescs.length === 0 || fieldDescs.length > DescriptorFormat.MAX_TUPLE_FIELDS) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", `Tuple field count ${fieldDescs.length} out of range. Must be 1–${DescriptorFormat.MAX_TUPLE_FIELDS}.`);
+	if (fieldDescs.length === 0 || fieldDescs.length > DescriptorFormat.MAX_TUPLE_FIELDS) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", `Tuple field count ${fieldDescs.length} out of range. Must be 1–${DescriptorFormat.MAX_TUPLE_FIELDS}`);
 	const totalFieldBytes = fieldDescs.reduce((sum, f) => sum + f.length, 0);
 	const nodeLength = DescriptorFormat.TUPLE_HEADER_SIZE + totalFieldBytes;
-	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Tuple node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}.`);
+	if (nodeLength > DescriptorFormat.MAX_NODE_LENGTH) throw new CallciumError("NODE_LENGTH_TOO_LARGE", `Tuple node length ${nodeLength} exceeds maximum ${DescriptorFormat.MAX_NODE_LENGTH}`);
 	let anyDynamic = false;
 	let staticWordsSum = 0;
 	for (const field of fieldDescs) {
@@ -775,7 +1128,7 @@ function tuple(fieldDescs) {
 		staticWordsSum += staticWords;
 	}
 	const staticWords = anyDynamic ? 0 : staticWordsSum;
-	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Tuple static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}.`);
+	if (staticWords > DescriptorFormat.MAX_STATIC_WORDS) throw new CallciumError("STATIC_WORDS_TOO_LARGE", `Tuple static words ${staticWords} exceeds maximum ${DescriptorFormat.MAX_STATIC_WORDS}`);
 	const meta24 = staticWords << DescriptorFormat.META_STATIC_WORDS_SHIFT | nodeLength;
 	const buf = new Uint8Array(1 + DescriptorFormat.COMPOSITE_META_SIZE + DescriptorFormat.TUPLE_FIELDCOUNT_SIZE + totalFieldBytes);
 	buf[0] = TypeCode.TUPLE;
@@ -796,9 +1149,12 @@ function commaPositions(input, start, end) {
 	for (let i = start; i < end; i++) {
 		const char = input[i];
 		if (char === "(" || char === "[") depth++;
-		else if (char === ")" || char === "]") depth--;
-		else if (char === "," && depth === 0) positions.push(i);
+		else if (char === ")" || char === "]") {
+			if (depth === 0) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '${char}' at position ${i}`);
+			depth--;
+		} else if (char === "," && depth === 0) positions.push(i);
 	}
+	if (depth !== 0) throw new CallciumError("MALFORMED_TYPE_STRING", `Unclosed '${input.slice(start, end)}'`);
 	return positions;
 }
 const MAX_TYPE_STRING_NUMBER = 256 ** DescriptorFormat.ARRAY_LENGTH_SIZE - 1;
@@ -817,27 +1173,27 @@ function parseUint(input, start, end) {
 function parseTuple(input, start, end) {
 	if (input[start] !== "(") throw new CallciumError("MALFORMED_TYPE_STRING", `Expected '(' at position ${start}`);
 	let depth = 0;
-	let closePos = -1;
+	let closeIndex = -1;
 	for (let i = start; i < end; i++) if (input[i] === "(") depth++;
 	else if (input[i] === ")") {
 		depth--;
 		if (depth === 0) {
-			closePos = i;
+			closeIndex = i;
 			break;
 		}
 	}
-	if (closePos === -1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '(' at position ${start}`);
-	if (closePos !== end - 1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unexpected characters after ')' at position ${closePos + 1}`);
+	if (closeIndex === -1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '(' at position ${start}`);
+	if (closeIndex !== end - 1) throw new CallciumError("MALFORMED_TYPE_STRING", `Unexpected characters after ')' at position ${closeIndex + 1}`);
 	const innerStart = start + 1;
-	const innerEnd = closePos;
+	const innerEnd = closeIndex;
 	const commas = commaPositions(input, innerStart, innerEnd);
 	const segments = [];
-	let segStart = innerStart;
+	let segmentStart = innerStart;
 	for (const comma of commas) {
-		segments.push([segStart, comma]);
-		segStart = comma + 1;
+		segments.push([segmentStart, comma]);
+		segmentStart = comma + 1;
 	}
-	segments.push([segStart, innerEnd]);
+	segments.push([segmentStart, innerEnd]);
 	if (segments.length === 1 && segments[0][0] === segments[0][1]) return tuple([]);
 	return tuple(segments.map(([fieldStart, fieldEnd]) => parseType(input, fieldStart, fieldEnd)));
 }
@@ -849,28 +1205,25 @@ function parseBaseType(input, start, end) {
 	if (segment === "bytes") return bytes();
 	if (segment === "string") return string_();
 	if (segment.startsWith("(")) return parseTuple(input, start, end);
-	if (segment.startsWith("uint")) return uintN(parseUint(input, start + 4, end));
-	if (segment.startsWith("int")) return intN(parseUint(input, start + 3, end));
-	if (segment.startsWith("bytes")) return bytesN(parseUint(input, start + 5, end));
+	if (segment.length > 4 && segment.startsWith("uint")) return uintN(parseUint(input, start + 4, end));
+	if (segment.length > 3 && segment.startsWith("int")) return intN(parseUint(input, start + 3, end));
+	if (segment.length > 5 && segment.startsWith("bytes")) return bytesN(parseUint(input, start + 5, end));
 	throw new CallciumError("UNKNOWN_TYPE", `Unrecognised type '${segment}'`);
 }
 function parseType(input, start, end) {
 	if (start >= end) throw new CallciumError("MALFORMED_TYPE_STRING", "Empty type segment");
-	const suffixes = [];
+	const spans = [];
 	let baseEnd = end;
 	while (baseEnd > start && input[baseEnd - 1] === "]") {
-		const closePos = baseEnd - 1;
-		let openPos = closePos - 1;
-		while (openPos > start && input[openPos] !== "[") openPos--;
-		if (input[openPos] !== "[") throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched ']' at position ${closePos}`);
-		const innerStart = openPos + 1;
-		const innerEnd = closePos;
-		suffixes.unshift(innerStart === innerEnd ? void 0 : parseUint(input, innerStart, innerEnd));
-		baseEnd = openPos;
-	}
-	if (input[start] !== "(" && input.slice(start, baseEnd).includes("[")) throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched '[' in '${input.slice(start, baseEnd)}'`);
+		const closeIndex = baseEnd - 1;
+		let openIndex = closeIndex - 1;
+		while (openIndex > start && input[openIndex] !== "[") openIndex--;
+		if (input[openIndex] !== "[") throw new CallciumError("MALFORMED_TYPE_STRING", `Unmatched ']' at position ${closeIndex}`);
+		spans.unshift([openIndex + 1, closeIndex]);
+		baseEnd = openIndex;
+	}
 	let desc = parseBaseType(input, start, baseEnd);
-	for (const length of suffixes) desc = array(desc, length);
+	for (const [innerStart, innerEnd] of spans) desc = array(desc, innerStart === innerEnd ? void 0 : parseUint(input, innerStart, innerEnd));
 	return desc;
 }
 function fromTypes(typesCsv) {
@@ -884,7 +1237,7 @@ function fromTypes(typesCsv) {
 	}
 	segments.push([segStart, typesCsv.length]);
 	const paramDescs = segments.map(([start, end]) => parseType(typesCsv, start, end));
-	if (paramDescs.length > DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Parameter count ${paramDescs.length} exceeds maximum ${DescriptorFormat.MAX_PARAMS}.`);
+	if (paramDescs.length > DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Parameter count ${paramDescs.length} exceeds maximum ${DescriptorFormat.MAX_PARAMS}`);
 	const totalBytes = paramDescs.reduce((sum, d) => sum + d.length, 0);
 	const result = new Uint8Array(DescriptorFormat.HEADER_SIZE + totalBytes);
 	result[0] = DescriptorFormat.VERSION;
@@ -894,10 +1247,11 @@ function fromTypes(typesCsv) {
 		result.set(desc, offset);
 		offset += desc.length;
 	}
+	decodeDescriptor(result);
 	return result;
 }
 function nodeToTypeString(desc, offset) {
-	const typeCode = desc[offset];
+	const { typeCode } = Descriptor.inspect(desc, offset);
 	if (typeCode === TypeCode.TUPLE) {
 		const fieldCount = Descriptor.tupleFieldCount(desc, offset);
 		const fieldTypes = [];
@@ -926,30 +1280,20 @@ function toTypes(desc) {
 	return types.join(",");
 }
 function parseNode(data, offset, depth) {
-	if (offset >= data.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end of descriptor", offset);
-	const code = data[offset];
+	const { typeCode: code, staticWords, nodeLength } = readNode(data, offset);
 	const info = classifyTypeCode(code);
-	const metaOffset = offset + DescriptorFormat.TYPECODE_SIZE;
+	const isDynamic = staticWords === 0;
+	const staticSize = isDynamic ? 0 : staticWords * 32;
+	const nodeEnd = offset + nodeLength;
 	if (info.typeClass === "elementary") return {
 		typeCode: code,
-		isDynamic: info.isDynamic,
-		staticSize: info.isDynamic ? 0 : 32,
-		next: metaOffset
+		isDynamic,
+		staticSize,
+		next: nodeEnd
 	};
 	if (depth > DescriptorFormat.MAX_NESTING_DEPTH) throw new CallciumError("NESTING_TOO_DEEP", `Composite nesting exceeds maximum depth ${DescriptorFormat.MAX_NESTING_DEPTH}`, offset);
-	const metaEnd = metaOffset + DescriptorFormat.COMPOSITE_META_SIZE;
-	if (metaEnd > data.length) throw new CallciumError("UNEXPECTED_END", "Incomplete composite metadata", offset);
-	const meta = readU24(data, metaOffset);
-	const staticWords = meta >> DescriptorFormat.META_STATIC_WORDS_SHIFT;
-	const nodeLength = meta & DescriptorFormat.META_NODE_LENGTH_MASK;
-	const minHeader = info.typeClass === "tuple" ? DescriptorFormat.TUPLE_HEADER_SIZE : DescriptorFormat.ARRAY_HEADER_SIZE;
-	if (nodeLength < minHeader) throw new CallciumError("NODE_LENGTH_TOO_SMALL", `Composite node length ${nodeLength} is smaller than minimum header ${minHeader}`, offset);
-	if (offset + nodeLength > data.length) throw new CallciumError("NODE_OVERFLOW", "Composite node extends beyond descriptor", offset);
-	const isDynamic = staticWords === 0;
-	const staticSize = isDynamic ? 0 : staticWords * 32;
-	const nodeEnd = offset + nodeLength;
 	if (info.typeClass === "tuple") {
-		const fieldCountOffset = metaEnd;
+		const fieldCountOffset = offset + DescriptorFormat.TYPECODE_SIZE + DescriptorFormat.COMPOSITE_META_SIZE;
 		if (fieldCountOffset + 2 > data.length) throw new CallciumError("UNEXPECTED_END", "Incomplete tuple header", offset);
 		const fieldCount = readU16(data, fieldCountOffset);
 		if (fieldCount === 0) throw new CallciumError("INVALID_TUPLE_FIELD_COUNT", "Tuple must have at least one field", offset);
@@ -973,183 +1317,56 @@ function parseNode(data, offset, depth) {
 			typeCode: code,
 			isDynamic,
 			staticSize,
-			next: nodeEnd
-		};
-	}
-	parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1);
-	return {
-		typeCode: code,
-		isDynamic: true,
-		staticSize: 0,
-		next: nodeEnd
-	};
-}
-function indexToPath(index) {
-	return `0x${index.toString(16).padStart(4, "0")}`;
-}
-function decodeDescriptor(data) {
-	if (data.length < 1) throw new CallciumError("MALFORMED_HEADER", "Descriptor is empty");
-	const version = data[0];
-	if (version !== DescriptorFormat.VERSION) throw new CallciumError("UNSUPPORTED_VERSION", `Version ${version} is not supported (expected ${DescriptorFormat.VERSION})`);
-	if (data.length < DescriptorFormat.HEADER_SIZE) throw new CallciumError("MALFORMED_HEADER", "Descriptor too short for header");
-	const params = [];
-	let cursor = DescriptorFormat.HEADER_SIZE;
-	while (cursor < data.length) {
-		if (params.length >= DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Descriptor exceeds the maximum of ${DescriptorFormat.MAX_PARAMS} top-level params`);
-		const { typeCode, isDynamic, staticSize, next } = parseNode(data, cursor, 1);
-		params.push({
-			index: params.length,
-			typeCode,
-			isDynamic,
-			staticSize,
-			path: indexToPath(params.length),
-			span: {
-				start: cursor,
-				end: next
-			}
-		});
-		cursor = next;
-	}
-	const declaredCount = data[1];
-	if (params.length !== declaredCount) throw new CallciumError("PARAM_COUNT_MISMATCH", `Header declares ${declaredCount} params but ${params.length} were parsed`);
-	return { descriptor: {
-		version,
-		params
-	} };
-}
-const DescriptorCoder = {
-	fromTypes,
-	toTypes
-};
-//#endregion
-//#region src/operators.ts
-function toBigInt(bytes, offset = 0) {
-	const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 32);
-	return view.getBigUint64(0, false) << 192n | view.getBigUint64(8, false) << 128n | view.getBigUint64(16, false) << 64n | view.getBigUint64(24, false);
-}
-function isSigned(typeCode) {
-	return typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
-}
-function isLeftAligned(typeCode) {
-	return typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX || typeCode === TypeCode.FUNCTION;
-}
-function canonicalize(value, typeCode) {
-	if (typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX) {
-		const bits = BigInt(typeCode * 8);
-		return bits === 256n ? value : value & (1n << bits) - 1n;
-	}
-	if (typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX) {
-		const bits = (typeCode - TypeCode.INT_MIN + 1) * 8;
-		return bits === 256 ? value : BigInt.asUintN(256, BigInt.asIntN(bits, value));
-	}
-	if (typeCode === TypeCode.ADDRESS) return value & (1n << 160n) - 1n;
-	if (typeCode === TypeCode.BOOL) return value & 1n;
-	if (typeCode === TypeCode.FUNCTION) return value >> 64n << 64n;
-	if (typeCode >= TypeCode.FIXED_BYTES_MIN && typeCode <= TypeCode.FIXED_BYTES_MAX) {
-		const n = typeCode - TypeCode.FIXED_BYTES_MIN + 1;
-		if (n === 32) return value;
-		const padBits = BigInt((32 - n) * 8);
-		return value >> padBits << padBits;
-	}
-	return value;
-}
-function isLengthOp(opCode) {
-	const base = opCode & ~Op.NOT;
-	return base >= Op.LENGTH_EQ && base <= Op.LENGTH_BETWEEN;
-}
-function lengthToValueOp(base) {
-	if (base === Op.LENGTH_EQ) return Op.EQ;
-	if (base === Op.LENGTH_GT) return Op.GT;
-	if (base === Op.LENGTH_LT) return Op.LT;
-	if (base === Op.LENGTH_GTE) return Op.GTE;
-	if (base === Op.LENGTH_LTE) return Op.LTE;
-	return Op.BETWEEN;
-}
-function isLengthValidType(typeCode) {
-	return typeCode === TypeCode.BYTES || typeCode === TypeCode.STRING || typeCode === TypeCode.DYNAMIC_ARRAY;
-}
-function compareTyped(a, b, typeCode) {
-	if (isSigned(typeCode)) {
-		const sa = BigInt.asIntN(256, a);
-		const sb = BigInt.asIntN(256, b);
-		return sa < sb ? -1 : sa > sb ? 1 : 0;
-	}
-	return a < b ? -1 : a > b ? 1 : 0;
-}
-function isIn(value, data) {
-	const count = data.length / 32;
-	let lo = 0;
-	let hi = count - 1;
-	while (lo <= hi) {
-		const mid = lo + hi >>> 1;
-		const elem = toBigInt(data, mid * 32);
-		if (value === elem) return true;
-		if (value < elem) hi = mid - 1;
-		else lo = mid + 1;
-	}
-	return false;
-}
-function applyOperator(opCode, value, valueLength, operandData, typeCode) {
-	let base = opCode & ~Op.NOT;
-	if (isLengthOp(base)) {
-		value = BigInt(valueLength);
-		typeCode = TypeCode.UINT_MAX;
-		base = lengthToValueOp(base);
-	}
-	let result;
-	switch (base) {
-		case Op.EQ:
-			result = value === toBigInt(operandData, 0);
-			break;
-		case Op.GT:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) > 0;
-			break;
-		case Op.LT:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) < 0;
-			break;
-		case Op.GTE:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) >= 0;
-			break;
-		case Op.LTE:
-			result = compareTyped(value, toBigInt(operandData, 0), typeCode) <= 0;
-			break;
-		case Op.BETWEEN: {
-			const min = toBigInt(operandData, 0);
-			const max = toBigInt(operandData, 32);
-			result = compareTyped(value, min, typeCode) >= 0 && compareTyped(value, max, typeCode) <= 0;
-			break;
-		}
-		case Op.IN:
-			result = isIn(value, operandData);
-			break;
-		case Op.BITMASK_ALL: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) === mask;
-			break;
-		}
-		case Op.BITMASK_ANY: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) !== 0n;
-			break;
-		}
-		case Op.BITMASK_NONE: {
-			const mask = toBigInt(operandData, 0);
-			result = (value & mask) === 0n;
-			break;
-		}
-		default: throw new CallciumError("UNKNOWN_OPERATOR", `Unknown operator code 0x${base.toString(16).padStart(2, "0")}.`);
+			next: nodeEnd
+		};
 	}
-	return (opCode & Op.NOT) !== 0 ? !result : result;
+	parseNode(data, Descriptor.arrayElementOffset(offset), depth + 1);
+	return {
+		typeCode: code,
+		isDynamic: true,
+		staticSize: 0,
+		next: nodeEnd
+	};
+}
+function indexToPath(index) {
+	return `0x${index.toString(16).padStart(4, "0")}`;
+}
+function decodeDescriptor(data) {
+	if (data.length < 1) throw new CallciumError("MALFORMED_HEADER", "Descriptor is empty");
+	const version = data[0];
+	if (version !== DescriptorFormat.VERSION) throw new CallciumError("UNSUPPORTED_VERSION", `Version ${version} is not supported (expected ${DescriptorFormat.VERSION})`);
+	if (data.length < DescriptorFormat.HEADER_SIZE) throw new CallciumError("MALFORMED_HEADER", "Descriptor too short for header");
+	const params = [];
+	let cursor = DescriptorFormat.HEADER_SIZE;
+	while (cursor < data.length) {
+		const { typeCode, isDynamic, staticSize, next } = parseNode(data, cursor, 1);
+		if (params.length === DescriptorFormat.MAX_PARAMS) throw new CallciumError("TOO_MANY_PARAMS", `Descriptor exceeds the maximum of ${DescriptorFormat.MAX_PARAMS} top-level params`);
+		params.push({
+			index: params.length,
+			typeCode,
+			isDynamic,
+			staticSize,
+			path: indexToPath(params.length),
+			span: {
+				start: cursor,
+				end: next
+			}
+		});
+		cursor = next;
+	}
+	const declaredCount = data[1];
+	if (params.length !== declaredCount) throw new CallciumError("PARAM_COUNT_MISMATCH", `Header declares ${declaredCount} params but ${params.length} were parsed`);
+	return { descriptor: {
+		version,
+		params
+	} };
 }
+const DescriptorCoder = {
+	fromTypes,
+	toTypes
+};
 //#endregion
 //#region src/policy-coder.ts
-function parsePathSteps(path) {
-	const bytes = hexToBytes(path);
-	if (bytes.length % PolicyFormat.PATH_STEP_SIZE !== 0) throw new CallciumError("MALFORMED_PATH", `Path byte length ${bytes.length} is not a whole number of steps`);
-	const steps = [];
-	for (let offset = 0; offset < bytes.length; offset += PolicyFormat.PATH_STEP_SIZE) steps.push(readU16(bytes, offset));
-	return steps;
-}
 function field(value, start, end) {
 	return {
 		value,
@@ -1159,6 +1376,21 @@ function field(value, start, end) {
 		}
 	};
 }
+function hexField(data, start, end) {
+	let hex;
+	return {
+		get value() {
+			return hex ??= toHex(data, start, end);
+		},
+		set value(replacement) {
+			hex = replacement;
+		},
+		span: {
+			start,
+			end
+		}
+	};
+}
 function resolveHintSize(data, hintStart, ruleEnd, ruleOffset) {
 	const overrun = () => {
 		throw new CallciumError("RULE_FIELD_OUT_OF_BOUNDS", "Rule is too small to hold a hint block", ruleOffset);
@@ -1215,7 +1447,7 @@ function hintTargetTypeCode(data, hintStart, hintSize) {
 }
 function decodePolicy(blob) {
 	const data = hexToBytes(blob);
-	if (data.length < PolicyFormat.DESC_OFFSET + 1) throw new CallciumError("MALFORMED_HEADER", "Policy blob is too short");
+	if (data.length < PolicyFormat.DESC_OFFSET) throw new CallciumError("MALFORMED_HEADER", "Policy blob is too short");
 	const headerByte = data[0];
 	const version = headerByte & PolicyFormat.VERSION_MASK;
 	if (version !== PolicyFormat.VERSION) throw new CallciumError("UNSUPPORTED_VERSION", `Version ${version} is not supported (expected ${PolicyFormat.VERSION})`);
@@ -1240,7 +1472,7 @@ function decodePolicy(blob) {
 			end: descStart + param.span.end
 		}
 	}));
-	const descriptorRaw = toHex(data, descStart, descEnd);
+	const descriptorRaw = hexField(data, descStart, descEnd);
 	const groupCountStart = groupCountOffset;
 	const groupCountEnd = groupCountStart + PolicyFormat.GROUP_COUNT_SIZE;
 	const groupCountValue = data[groupCountOffset];
@@ -1253,18 +1485,18 @@ function decodePolicy(blob) {
 		const groupSizeValue = readU32(data, groupSizeStart);
 		const groupBodyStart = offset + PolicyFormat.GROUP_HEADER_SIZE;
 		const groupEnd = groupBodyStart + groupSizeValue;
+		if (groupEnd > data.length) throw new CallciumError("GROUP_OVERFLOW", "Group extends beyond policy blob", offset);
 		const ruleCountStart = offset;
 		const ruleCountValue = readU16(data, ruleCountStart);
 		if (ruleCountValue === 0) throw new CallciumError("EMPTY_GROUP", "Group must contain at least one rule", offset);
 		if (groupSizeValue < ruleCountValue * PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("GROUP_TOO_SMALL", "Declared group size is too small for its rule count", offset);
-		if (groupEnd > data.length) throw new CallciumError("GROUP_OVERFLOW", "Group extends beyond policy blob", offset);
 		const rules = [];
 		let ruleOffset = groupBodyStart;
 		for (let ruleIndex = 0; ruleIndex < ruleCountValue; ruleIndex++) {
 			if (ruleOffset + PolicyFormat.RULE_SIZE_SIZE > data.length) throw new CallciumError("UNEXPECTED_END", "Unexpected end while reading rule size", ruleOffset);
 			const ruleSizeValue = readU16(data, ruleOffset);
 			if (ruleSizeValue < PolicyFormat.RULE_MIN_SIZE) throw new CallciumError("RULE_TOO_SMALL", `Rule size ${ruleSizeValue} is below minimum ${PolicyFormat.RULE_MIN_SIZE}`, ruleOffset);
-			if (ruleOffset + ruleSizeValue > groupEnd) throw new CallciumError("RULE_OVERFLOW", "Rule extends beyond group boundary", ruleOffset);
+			if (ruleOffset + ruleSizeValue > data.length) throw new CallciumError("RULE_OVERFLOW", "Rule extends beyond policy blob", ruleOffset);
 			const scopeOffset = ruleOffset + PolicyFormat.RULE_SCOPE_OFFSET;
 			const scopeValue = data[scopeOffset];
 			if (scopeValue !== Scope.CONTEXT && scopeValue !== Scope.CALLDATA) throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${scopeValue}`, ruleOffset);
@@ -1293,17 +1525,22 @@ function decodePolicy(blob) {
 			const dataStart = dataLengthOffset + PolicyFormat.RULE_DATALENGTH_SIZE;
 			if (opBase === Op.IN) {
 				const wordCount = dataLengthValue / 32;
-				for (let word = 1; word < wordCount; word++) if (compareBytes(data.subarray(dataStart + (word - 1) * 32, dataStart + word * 32), data.subarray(dataStart + word * 32, dataStart + (word + 1) * 32)) >= 0) throw new CallciumError("UNSORTED_IN_SET", "IN operands must be strictly ascending", ruleOffset);
+				let prev = toBigInt(data, dataStart);
+				for (let word = 1; word < wordCount; word++) {
+					const cur = toBigInt(data, dataStart + word * 32);
+					if (cur <= prev) throw new CallciumError("UNSORTED_IN_SET", "IN operands must be strictly ascending", ruleOffset);
+					prev = cur;
+				}
 			}
 			if (opBase === Op.EQ_CTX) {
 				if (toBigInt(data, dataStart) > BigInt(MAX_CONTEXT_PROPERTY_ID)) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", "EQ_CTX operand references an undefined context property", ruleOffset);
 			}
 			if (depthValue === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step", ruleOffset);
-			if (depthValue > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depthValue} exceeds maximum ${Limits.MAX_PATH_DEPTH}`, ruleOffset);
+			if (depthValue > PolicyFormat.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depthValue} exceeds maximum ${PolicyFormat.MAX_PATH_DEPTH}`, ruleOffset);
 			if (scopeValue === Scope.CONTEXT) {
 				if (depthValue !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step", ruleOffset);
 				const contextPropertyId = readU16(data, pathStart);
-				if (contextPropertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Context rule references undefined context property 0x${contextPropertyId.toString(16).padStart(4, "0")}`, ruleOffset);
+				if (contextPropertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Context rule references undefined context property ${formatCode(contextPropertyId, PolicyFormat.PATH_STEP_SIZE)}`, ruleOffset);
 			}
 			const pathHex = toHex(data, pathStart, pathStart + pathLength);
 			rules.push({
@@ -1311,15 +1548,16 @@ function decodePolicy(blob) {
 				scope: field(scopeValue, scopeOffset, scopeOffset + 1),
 				pathDepth: field(depthValue, depthOffset, depthOffset + 1),
 				path: field(pathHex, pathStart, pathStart + pathLength),
-				...hintSize > 0 && { hint: field(toHex(data, hintStart, hintStart + hintSize), hintStart, hintStart + hintSize) },
+				...hintSize > 0 && { hint: hexField(data, hintStart, hintStart + hintSize) },
 				opCode: field(opCodeValue, opCodeOffset, opCodeOffset + PolicyFormat.RULE_OPCODE_SIZE),
 				dataLength: field(dataLengthValue, dataLengthOffset, dataLengthOffset + PolicyFormat.RULE_DATALENGTH_SIZE),
-				data: field(toHex(data, dataStart, dataStart + dataLengthValue), dataStart, dataStart + dataLengthValue),
+				data: hexField(data, dataStart, dataStart + dataLengthValue),
 				span: {
 					start: ruleOffset,
 					end: ruleOffset + ruleSizeValue
 				}
 			});
+			if (ruleOffset + ruleSizeValue > groupEnd) throw new CallciumError("RULE_OVERFLOW", "Rule extends beyond group boundary", ruleOffset);
 			ruleOffset += ruleSizeValue;
 		}
 		if (ruleOffset !== groupEnd) throw new CallciumError("GROUP_SIZE_MISMATCH", "Rules do not exactly fill the declared group size", offset);
@@ -1341,7 +1579,12 @@ function decodePolicy(blob) {
 			selector: field(selectorHex, selectorStart, selectorEnd),
 			descLength: field(descLengthValue, descLengthStart, descLengthStart + PolicyFormat.DESC_LENGTH_SIZE),
 			descriptor: {
-				raw: descriptorRaw,
+				get raw() {
+					return descriptorRaw.value;
+				},
+				set raw(replacement) {
+					descriptorRaw.value = replacement;
+				},
 				header: field({
 					version: desc.version,
 					paramCount: desc.params.length
@@ -1364,21 +1607,28 @@ function decodePolicy(blob) {
 		data
 	};
 }
-function flattenConstraint(constraint, desc) {
-	const operators = constraint.operators.map(hexToBytes);
-	for (const operator of operators) if (operator.length < 1) throw new CallciumError("INVALID_OPERATOR_BYTES", "Operator must have at least one byte (opcode).");
+function readConstraintTarget(constraint, desc) {
 	const path = hexToBytes(constraint.path);
-	if (path.length === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step.");
-	if ((path.length & 1) !== 0) throw new CallciumError("MALFORMED_PATH", "Path byte length must be even.");
+	if (path.length === 0) throw new CallciumError("EMPTY_PATH", "Rule path must have at least one step");
+	if ((path.length & 1) !== 0) throw new CallciumError("MALFORMED_PATH", "Path byte length must be even");
 	const depth = path.length / 2;
-	if (depth > Limits.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depth} exceeds maximum ${Limits.MAX_PATH_DEPTH}.`);
-	const hint = constraint.scope === Scope.CALLDATA ? Descriptor.compileHint(desc, parsePathSteps(constraint.path)) : new Uint8Array(0);
-	return operators.map((operator) => ({
-		scope: constraint.scope,
+	if (depth > PolicyFormat.MAX_PATH_DEPTH) throw new CallciumError("PATH_TOO_DEEP", `Path depth ${depth} exceeds maximum ${PolicyFormat.MAX_PATH_DEPTH}`);
+	return {
 		path,
-		operator,
-		hint
-	}));
+		hint: constraint.scope === Scope.CALLDATA ? Descriptor.compileHint(desc, parsePathSteps(constraint.path)) : new Uint8Array(0)
+	};
+}
+function flattenConstraint(constraint, desc) {
+	let target;
+	return constraint.operators.map((operatorHex) => {
+		const operator = toOperatorBytes(operatorHex);
+		target ??= readConstraintTarget(constraint, desc);
+		return {
+			scope: constraint.scope,
+			operator,
+			...target
+		};
+	});
 }
 function compareBytes(a, b) {
 	const length = Math.min(a.length, b.length);
@@ -1396,12 +1646,16 @@ function sortRules(rules) {
 		return compareBytes(a.operator, b.operator);
 	});
 }
+function requireFieldFits(value, byteWidth, code, subject) {
+	const max = fieldMax(byteWidth);
+	if (value > max) throw new CallciumError(code, `${subject} ${value} exceeds maximum ${max}`);
+}
 function encodeRule(rule) {
 	const depth = rule.path.length / 2;
-	if (rule.scope === Scope.CONTEXT && depth !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step.");
+	if (rule.scope === Scope.CONTEXT && depth !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope rules must have exactly one path step");
 	const data = rule.operator.subarray(1);
 	const ruleSize = PolicyFormat.RULE_FIXED_OVERHEAD + rule.path.length + rule.hint.length + data.length;
-	if (ruleSize > 65535) throw new CallciumError("RULE_SIZE_OVERFLOW", `Rule size ${ruleSize} exceeds maximum 65535`);
+	requireFieldFits(ruleSize, PolicyFormat.RULE_SIZE_SIZE, "RULE_SIZE_OVERFLOW", "Rule size");
 	const buf = new Uint8Array(ruleSize);
 	writeBE16(buf, 0, ruleSize);
 	buf[2] = rule.scope;
@@ -1431,16 +1685,16 @@ function buildOperatorHex(rule) {
 function encode(data) {
 	const descBytes = hexToBytes(data.descriptor);
 	if (data.groups.length === 0) throw new CallciumError("EMPTY_POLICY", "Policy must contain at least one group");
-	if (data.groups.length > 255) throw new CallciumError("GROUP_COUNT_OVERFLOW", `Group count ${data.groups.length} exceeds maximum 255`);
+	requireFieldFits(data.groups.length, PolicyFormat.GROUP_COUNT_SIZE, "GROUP_COUNT_OVERFLOW", "Group count");
 	const sortedGroups = data.groups.map((group) => {
 		const rules = group.flatMap((constraint) => flattenConstraint(constraint, descBytes));
 		sortRules(rules);
 		return rules;
 	});
-	if (descBytes.length > 65535) throw new CallciumError("DESC_LENGTH_OVERFLOW", `Descriptor length ${descBytes.length} exceeds maximum 65535`);
+	requireFieldFits(descBytes.length, PolicyFormat.DESC_LENGTH_SIZE, "DESC_LENGTH_OVERFLOW", "Descriptor length");
 	const encodedGroups = sortedGroups.map((rules, groupIndex) => {
 		if (rules.length === 0) throw new CallciumError("EMPTY_GROUP", `Group ${groupIndex} is empty`);
-		if (rules.length > 65535) throw new CallciumError("RULE_COUNT_OVERFLOW", `Group ${groupIndex} rule count ${rules.length} exceeds maximum 65535`);
+		requireFieldFits(rules.length, PolicyFormat.GROUP_RULECOUNT_SIZE, "RULE_COUNT_OVERFLOW", `Group ${groupIndex} rule count`);
 		return {
 			wireBytes: encodeGroupRules(rules),
 			ruleCount: rules.length
@@ -1450,7 +1704,8 @@ function encode(data) {
 		const hashes = new Map(encodedGroups.map((group) => [group, keccak_256(group.wireBytes)]));
 		encodedGroups.sort((a, b) => compareBytes(hashes.get(a), hashes.get(b)));
 	}
-	const selectorBytes = data.isSelectorless ? new Uint8Array(4) : hexToBytes(data.selector);
+	const selectorBytes = data.isSelectorless ? new Uint8Array(PolicyFormat.SELECTOR_SIZE) : hexToBytes(data.selector);
+	if (selectorBytes.length !== PolicyFormat.SELECTOR_SIZE) throw new CallciumError("MALFORMED_SELECTOR", `Selector must be ${PolicyFormat.SELECTOR_SIZE} bytes, got ${selectorBytes.length}`);
 	const headerByte = PolicyFormat.VERSION | (data.isSelectorless ? PolicyFormat.FLAG_NO_SELECTOR : 0);
 	let totalSize = PolicyFormat.HEADER_SIZE + PolicyFormat.SELECTOR_SIZE + PolicyFormat.DESC_LENGTH_SIZE + descBytes.length + PolicyFormat.GROUP_COUNT_SIZE;
 	for (const g of encodedGroups) totalSize += PolicyFormat.GROUP_HEADER_SIZE + g.wireBytes.length;
@@ -1478,7 +1733,6 @@ function decode(blob) {
 	const { policy } = decodePolicy(blob);
 	const groups = policy.groups.map((group) => {
 		const constraintMap = /* @__PURE__ */ new Map();
-		const constraintOrder = [];
 		for (const rule of group.rules) {
 			const hintHex = rule.hint?.value;
 			const key = `${rule.scope.value}:${rule.path.value}:${hintHex ?? ""}`;
@@ -1494,10 +1748,9 @@ function decode(blob) {
 					span: rule.span
 				};
 				constraintMap.set(key, constraint);
-				constraintOrder.push(key);
 			}
 		}
-		return constraintOrder.map((k) => constraintMap.get(k));
+		return [...constraintMap.values()];
 	});
 	return {
 		isSelectorless: policy.isSelectorless,
@@ -1743,7 +1996,7 @@ function unsortedInSet(groupIndex, constraintIndex) {
 		code: "UNSORTED_IN_SET",
 		value1: ZERO,
 		value2: ZERO,
-		message: "isIn/notIn set is not strictly sorted and deduplicated."
+		message: "isIn/notIn set is not strictly sorted and deduplicated"
 	};
 }
 function emptyGroup(groupIndex) {
@@ -1755,7 +2008,7 @@ function emptyGroup(groupIndex) {
 		code: "EMPTY_GROUP",
 		value1: ZERO,
 		value2: ZERO,
-		message: "Group contains zero constraints."
+		message: "Group contains zero constraints"
 	};
 }
 function dominatedBound(isLength, groupIndex, constraintIndex, value) {
@@ -1940,8 +2193,7 @@ function negationUnderAny(groupIndex, constraintIndex, opCode) {
 }
 //#endregion
 //#region src/policy-validator.ts
-const NAVIGABILITY_CODES = new Set([
-	"EMPTY_PATH",
+const navigabilityCodes = new Set([
 	"PARAM_INDEX_OUT_OF_BOUNDS",
 	"TUPLE_FIELD_OUT_OF_BOUNDS",
 	"STATIC_ARRAY_INDEX_OUT_OF_BOUNDS",
@@ -1952,8 +2204,11 @@ const UINT256_MAX = (1n << 256n) - 1n;
 const INT256_SIGN_BIT = 1n << 255n;
 function signedCompare(a, b, signed) {
 	if (!signed) return a - b;
-	const toS = (v) => v >= INT256_SIGN_BIT ? v - (1n << 256n) : v;
-	return toS(a) - toS(b);
+	const toSigned = (word) => word >= INT256_SIGN_BIT ? word - (1n << 256n) : word;
+	return toSigned(a) - toSigned(b);
+}
+function isOutsideDomain(domain, value) {
+	return signedCompare(value, domain.min, domain.isSigned) < 0n || signedCompare(value, domain.max, domain.isSigned) > 0n;
 }
 function isNumericType(typeCode) {
 	return typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX || typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX;
@@ -2011,7 +2266,7 @@ function getIncompat(opBase, typeInfo) {
 			code: "VALUE_OP_ON_DYNAMIC",
 			message: "Value operator used on dynamic type"
 		};
-		if (classifyTypeCode(typeCode).typeClass !== "elementary") return {
+		if (!isElementary(typeCode)) return {
 			code: "VALUE_OP_ON_COMPOSITE",
 			message: "Value operator used on composite type"
 		};
@@ -2122,7 +2377,7 @@ function initContext(scope, path, steps, typeInfo) {
 		numeric: emptyBoundDomain(isSigned(typeInfo.typeCode), min, max),
 		bitmask: {
 			mustBeOne: 0n,
-			mustBeZero: 0n
+			mustBeZero: isBitmaskCompatible(typeInfo.typeCode) ? UINT256_MAX ^ max : 0n
 		},
 		length: emptyBoundDomain(false, 0n, LENGTH_MAX),
 		set: {
@@ -2135,6 +2390,7 @@ function initContext(scope, path, steps, typeInfo) {
 function updateBound(domain, base, isNegated, value, isLength, groupIndex, constraintIndex, issues) {
 	if (isNegated) {
 		if (base === Op.EQ) {
+			if (isOutsideDomain(domain, value)) issues.push(outOfPhysicalBounds(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 			if (domain.hasEq && domain.eq === value) issues.push(eqNeqContradiction(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 			let alreadyHole = false;
 			for (let j = 0; j < domain.holes.length; j++) if (domain.holes[j] === value) {
@@ -2147,7 +2403,7 @@ function updateBound(domain, base, isNegated, value, isLength, groupIndex, const
 	}
 	if (base === Op.GTE && value === domain.min) issues.push(vacuousGte(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	else if (base === Op.LTE && value === domain.max) issues.push(vacuousLte(isLength, groupIndex, constraintIndex, bigintToHex(value)));
-	if (signedCompare(value, domain.min, domain.isSigned) < 0n || signedCompare(value, domain.max, domain.isSigned) > 0n) issues.push(outOfPhysicalBounds(isLength, groupIndex, constraintIndex, bigintToHex(value)));
+	if (isOutsideDomain(domain, value)) issues.push(outOfPhysicalBounds(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	else if (base === Op.GT && value === domain.max) issues.push(impossibleGt(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	else if (base === Op.LT && value === domain.min) issues.push(impossibleLt(isLength, groupIndex, constraintIndex, bigintToHex(value)));
 	let changedEq = false;
@@ -2262,6 +2518,7 @@ function checkSetEmpty(ctx, groupIndex, constraintIndex, issues) {
 	else if (possibleCount < inCount) issues.push(setPartiallyExcluded(groupIndex, constraintIndex, bigintToHex(BigInt(inCount - possibleCount))));
 }
 function updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues) {
+	for (const value of values) if (isOutsideDomain(ctx.numeric, value)) issues.push(outOfPhysicalBounds(false, groupIndex, constraintIndex, bigintToHex(value)));
 	if (isNegated) {
 		for (const value of values) {
 			if (ctx.numeric.hasEq && ctx.numeric.eq === value) issues.push(setExcludesEquality(groupIndex, constraintIndex, bigintToHex(value)));
@@ -2277,7 +2534,6 @@ function updateSet(ctx, isNegated, values, groupIndex, constraintIndex, issues)
 		}
 		checkSetEmpty(ctx, groupIndex, constraintIndex, issues);
 	} else {
-		for (const value of values) if (signedCompare(value, ctx.numeric.min, ctx.numeric.isSigned) < 0n || signedCompare(value, ctx.numeric.max, ctx.numeric.isSigned) > 0n) issues.push(outOfPhysicalBounds(false, groupIndex, constraintIndex, bigintToHex(value)));
 		if (ctx.numeric.hasEq) {
 			let found = false;
 			for (const candidate of values) if (candidate === ctx.numeric.eq) {
@@ -2319,6 +2575,9 @@ function checkFusibleRange(ctx, operators, groupIndex, constraintIndex, issues)
 	const lengthPair = findLonePair(operators, Op.LENGTH_GTE, Op.LENGTH_LTE);
 	if (lengthPair && getIncompat(Op.LENGTH_GTE, ctx.typeInfo) === null && lengthPair.low <= lengthPair.high) issues.push(fusibleRange(true, groupIndex, constraintIndex, bigintToHex(lengthPair.low), bigintToHex(lengthPair.high)));
 }
+function hasValidPayload(opBase, dataLength) {
+	return dataLength <= fieldMax(PolicyFormat.RULE_DATALENGTH_SIZE) && isValidOperatorData(opBase, dataLength);
+}
 function findLonePair(operators, lowerOp, upperOp) {
 	let lowerCount = 0;
 	let upperCount = 0;
@@ -2327,7 +2586,7 @@ function findLonePair(operators, lowerOp, upperOp) {
 	for (const opHex of operators) {
 		const opCode = parseInt(opHex.slice(2, 4), 16);
 		const dataLength = (opHex.length - 4) / 2;
-		if (dataLength > 65535 || !isValidOperatorData(opCode & ~Op.NOT, dataLength)) continue;
+		if (!hasValidPayload(opCode & ~Op.NOT, dataLength)) continue;
 		if (opCode === lowerOp) {
 			lowerCount++;
 			low = readValue(opHex);
@@ -2345,10 +2604,10 @@ function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues
 	const operators = constraint.operators;
 	const underAny = constraint.scope === Scope.CALLDATA && ctx.steps.includes(Quantifier.ANY);
 	for (const opHex of operators) {
-		const opCode = parseInt(opHex.slice(2, 4), 16);
+		const opBytes = toOperatorBytes(opHex);
+		const opCode = opBytes[0];
 		const base = opCode & ~Op.NOT;
-		const dataLength = (opHex.length - 4) / 2;
-		if (dataLength > 65535 || !isValidOperatorData(base, dataLength)) {
+		if (!hasValidPayload(base, opBytes.length - 1)) {
 			issues.push(fromOpRule("UNKNOWN_OPERATOR", "Unknown operator code", groupIndex, constraintIndex, bigintToHex(BigInt(opCode))));
 			continue;
 		}
@@ -2361,8 +2620,9 @@ function validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues
 		}
 		if (base === Op.EQ_CTX) {
 			const ctxOperand = readValue(opHex);
-			if (ctxOperand > BigInt(MAX_CONTEXT_PROPERTY_ID)) issues.push(unknownContextProperty(groupIndex, constraintIndex, bigintToHex(ctxOperand), bigintToHex(BigInt(MAX_CONTEXT_PROPERTY_ID))));
-			else if (lookupContextProperty(Number(ctxOperand)).typeCode === TypeCode.ADDRESS !== (ctx.typeInfo.typeCode === TypeCode.ADDRESS)) issues.push(contextTypeMismatch(groupIndex, constraintIndex, bigintToHex(ctxOperand), bigintToHex(BigInt(ctx.typeInfo.typeCode))));
+			const property = findContextProperty(Number(ctxOperand));
+			if (!property) issues.push(unknownContextProperty(groupIndex, constraintIndex, bigintToHex(ctxOperand), bigintToHex(BigInt(MAX_CONTEXT_PROPERTY_ID))));
+			else if (property.typeCode === TypeCode.ADDRESS !== (ctx.typeInfo.typeCode === TypeCode.ADDRESS)) issues.push(contextTypeMismatch(groupIndex, constraintIndex, bigintToHex(ctxOperand), bigintToHex(BigInt(ctx.typeInfo.typeCode))));
 		} else if (isValueOp(base)) {
 			const typeCode = ctx.typeInfo.typeCode;
 			if (isLeftAligned(typeCode)) {
@@ -2416,14 +2676,15 @@ function validateGroup(data, descBytes, groupIndex, issues) {
 		}
 		if (!ctx) {
 			const steps = parsePathSteps(constraint.path);
+			if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step");
 			let typeInfo;
 			if (constraint.scope === Scope.CALLDATA) {
-				if (steps.length > Limits.MAX_PATH_DEPTH) issues.push(pathDepthExceeded(groupIndex, constraintIndex, bigintToHex(BigInt(steps.length)), bigintToHex(BigInt(Limits.MAX_PATH_DEPTH))));
+				if (steps.length > PolicyFormat.MAX_PATH_DEPTH) issues.push(pathDepthExceeded(groupIndex, constraintIndex, bigintToHex(BigInt(steps.length)), bigintToHex(BigInt(PolicyFormat.MAX_PATH_DEPTH))));
 				let walk;
 				try {
 					walk = Descriptor.walkPath(descBytes, steps);
 				} catch (error) {
-					if (error instanceof CallciumError && NAVIGABILITY_CODES.has(error.code)) {
+					if (error instanceof CallciumError && navigabilityCodes.has(error.code)) {
 						issues.push(unnavigablePath(groupIndex, constraintIndex));
 						continue;
 					}
@@ -2433,19 +2694,14 @@ function validateGroup(data, descBytes, groupIndex, issues) {
 					issues.push(nestedQuantifier(groupIndex, constraintIndex));
 					continue;
 				}
-				if (walk.quantifiedStaticLength > Limits.MAX_QUANTIFIED_ARRAY_LENGTH) issues.push(quantifierOverStaticLimit(groupIndex, constraintIndex, bigintToHex(BigInt(walk.quantifiedStaticLength)), bigintToHex(BigInt(Limits.MAX_QUANTIFIED_ARRAY_LENGTH))));
+				if (walk.quantifiedStaticLength > PolicyFormat.MAX_QUANTIFIED_ARRAY_LENGTH) issues.push(quantifierOverStaticLimit(groupIndex, constraintIndex, bigintToHex(BigInt(walk.quantifiedStaticLength)), bigintToHex(BigInt(PolicyFormat.MAX_QUANTIFIED_ARRAY_LENGTH))));
 				typeInfo = walk.typeInfo;
 			} else {
 				const ctxId = steps[0];
-				if (ctxId > MAX_CONTEXT_PROPERTY_ID) {
-					issues.push(unknownContextProperty(groupIndex, constraintIndex, bigintToHex(BigInt(ctxId)), bigintToHex(BigInt(MAX_CONTEXT_PROPERTY_ID))));
-					typeInfo = {
-						typeCode: TypeCode.UINT_MAX,
-						isDynamic: false,
-						staticSize: 32
-					};
-				} else typeInfo = {
-					typeCode: lookupContextProperty(ctxId).typeCode,
+				const property = findContextProperty(ctxId);
+				if (!property) issues.push(unknownContextProperty(groupIndex, constraintIndex, bigintToHex(BigInt(ctxId)), bigintToHex(BigInt(MAX_CONTEXT_PROPERTY_ID))));
+				typeInfo = {
+					typeCode: property?.typeCode ?? TypeCode.UINT_MAX,
 					isDynamic: false,
 					staticSize: 32
 				};
@@ -2453,7 +2709,7 @@ function validateGroup(data, descBytes, groupIndex, issues) {
 			ctx = initContext(constraint.scope, normalizedPath, steps, typeInfo);
 			contexts.push(ctx);
 		}
-		if (constraint.scope === Scope.CALLDATA && constraint.hint !== void 0 && ctx.steps.length <= Limits.MAX_PATH_DEPTH) {
+		if (constraint.scope === Scope.CALLDATA && constraint.hint !== void 0 && constraint.hint !== "0x" && ctx.steps.length <= PolicyFormat.MAX_PATH_DEPTH) {
 			if (bytesToHex(Descriptor.compileHint(descBytes, ctx.steps)) !== constraint.hint.toLowerCase()) issues.push(hintMismatch(groupIndex, constraintIndex));
 		}
 		validateConstraint(ctx, constraint, groupIndex, constraintIndex, issues);
@@ -2476,33 +2732,31 @@ function validate(data) {
 const PolicyValidator = { validate };
 //#endregion
 //#region src/signature.ts
-function isAlpha(c) {
-	return c >= 65 && c <= 90 || c >= 97 && c <= 122;
+function isAlpha(char) {
+	return char >= 65 && char <= 90 || char >= 97 && char <= 122;
 }
-function isAlphanum(c) {
-	return isAlpha(c) || c >= 48 && c <= 57;
+function isAlphanum(char) {
+	return isAlpha(char) || char >= 48 && char <= 57;
 }
 function parse(signature) {
 	if (signature.length < 3) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: too short, got "${signature}"`);
 	let openParen = -1;
 	for (let i = 0; i < signature.length; i++) {
-		const c = signature.charCodeAt(i);
-		if (c === 32 || c === 9 || c === 10 || c === 13) throw new CallciumError("SIGNATURE_CONTAINS_WHITESPACE", "Signature must not contain whitespace");
-		if (c > 126) throw new CallciumError("MALFORMED_SIGNATURE", "Signature must contain only ASCII characters");
-		if (openParen === -1 && c === 40) openParen = i;
+		const char = signature.charCodeAt(i);
+		if (char === 32 || char === 9 || char === 10 || char === 13) throw new CallciumError("SIGNATURE_CONTAINS_WHITESPACE", "Signature must not contain whitespace");
+		if (openParen === -1 && char === 40) openParen = i;
 	}
-	if (openParen < 1) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: must have a function name followed by parentheses, got "${signature}"`);
+	if (openParen === -1) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: must have a function name followed by parentheses, got "${signature}"`);
 	if (!signature.endsWith(")")) throw new CallciumError("MALFORMED_SIGNATURE", `Invalid signature: must end with ")", got "${signature}"`);
+	if (openParen === 0) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must not be empty");
 	const firstChar = signature.charCodeAt(0);
 	if (!isAlpha(firstChar) && firstChar !== 95) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must start with a letter or underscore");
 	for (let i = 1; i < openParen; i++) {
-		const c = signature.charCodeAt(i);
-		if (!isAlphanum(c) && c !== 95) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must contain only alphanumeric characters or underscores");
+		const char = signature.charCodeAt(i);
+		if (!isAlphanum(char) && char !== 95) throw new CallciumError("INVALID_FUNCTION_NAME", "Function name must contain only alphanumeric characters or underscores");
 	}
-	const encoded = new Uint8Array(signature.length);
-	for (let i = 0; i < signature.length; i++) encoded[i] = signature.charCodeAt(i);
 	return {
-		selector: bytesToHex(keccak_256(encoded).subarray(0, 4)),
+		selector: bytesToHex(keccak_256(utf8ToBytes(signature)).subarray(0, 4)),
 		types: signature.slice(openParen + 1, signature.length - 1)
 	};
 }
@@ -2510,14 +2764,13 @@ const SignatureParser = { parse };
 //#endregion
 //#region src/policy-builder.ts
 function validateContextPath(steps) {
-	if (steps.length !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope path must be exactly one step.");
-	const step = steps[0];
-	if (step > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID 0x${step.toString(16).padStart(4, "0")}.`);
+	if (steps.length !== 1) throw new CallciumError("INVALID_CONTEXT_PATH", "Context-scope path must be exactly one step");
+	return lookupContextProperty(steps[0]).typeCode;
 }
 function validateCalldataPath(steps, desc) {
 	const argIndex = steps[0];
 	const paramCount = Descriptor.paramCount(desc);
-	if (argIndex >= paramCount) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${argIndex} out of range (descriptor has ${paramCount} params).`);
+	if (argIndex >= paramCount) throw new CallciumError("PARAM_INDEX_OUT_OF_BOUNDS", `Param index ${argIndex} out of range (descriptor has ${paramCount} params)`);
 	let offset = Descriptor.paramOffset(desc, argIndex);
 	let hasQuantifier = false;
 	for (let i = 1; i < steps.length; i++) {
@@ -2525,22 +2778,49 @@ function validateCalldataPath(steps, desc) {
 		const info = Descriptor.inspect(desc, offset);
 		const isArray = info.typeCode === TypeCode.STATIC_ARRAY || info.typeCode === TypeCode.DYNAMIC_ARRAY;
 		if (isQuantifier(step)) {
-			if (!isArray) throw new CallciumError("QUANTIFIER_ON_NON_ARRAY", "Quantifier step is only valid on an array node.");
-			if (hasQuantifier) throw new CallciumError("NESTED_QUANTIFIER", "Nested quantifiers are not allowed.");
+			if (!isArray) throw new CallciumError("QUANTIFIER_ON_NON_ARRAY", "Quantifier step is only valid on an array node");
+			if (hasQuantifier) throw new CallciumError("NESTED_QUANTIFIER", "Nested quantifiers are not allowed");
 			hasQuantifier = true;
 		}
 		if (info.typeCode === TypeCode.TUPLE) {
 			const fieldCount = Descriptor.tupleFieldCount(desc, offset);
-			if (step >= fieldCount) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fieldCount} fields).`);
+			if (step >= fieldCount) throw new CallciumError("TUPLE_FIELD_OUT_OF_BOUNDS", `Tuple field index ${step} out of range (tuple has ${fieldCount} fields)`);
 			offset = Descriptor.tupleFieldOffset(desc, offset, step);
 		} else if (isArray) {
 			if (!isQuantifier(step) && info.typeCode === TypeCode.STATIC_ARRAY) {
 				const arrayLength = Descriptor.staticArrayLength(desc, offset);
-				if (step >= arrayLength) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (static array has ${arrayLength} elements).`);
+				if (step >= arrayLength) throw new CallciumError("STATIC_ARRAY_INDEX_OUT_OF_BOUNDS", `Array index ${step} out of range (static array has ${arrayLength} elements)`);
 			}
 			offset = Descriptor.arrayElementOffset(offset);
-		} else throw new CallciumError("NOT_COMPOSITE", "Cannot descend into an elementary type.");
+		} else throw new CallciumError("NOT_COMPOSITE", "Cannot descend into an elementary type");
+	}
+	return Descriptor.inspect(desc, offset).typeCode;
+}
+const WORD_VALUES = 1n << 256n;
+function targetBounds(typeCode) {
+	if (typeCode >= TypeCode.UINT_MIN && typeCode <= TypeCode.UINT_MAX) return {
+		min: 0n,
+		max: (1n << BigInt(typeCode - TypeCode.UINT_MIN + 1) * 8n) - 1n
+	};
+	if (typeCode >= TypeCode.INT_MIN && typeCode <= TypeCode.INT_MAX) {
+		const half = 1n << BigInt(typeCode - TypeCode.INT_MIN + 1) * 8n - 1n;
+		return {
+			min: -half,
+			max: half - 1n
+		};
 	}
+	return null;
+}
+function reject(written, folded) {
+	throw new CallciumError("OUT_OF_PHYSICAL_BOUNDS", `Operand ${written} is outside the physical range of the type and encodes as ${folded}`);
+}
+function checkOperandDomain(constraint, typeCode) {
+	const bounds = targetBounds(typeCode);
+	const extremes = readOperandExtremes(constraint);
+	if (bounds === null || extremes === void 0) return;
+	if (extremes.leastNegative < 0n && typeCode === TypeCode.UINT_MAX) reject(extremes.leastNegative, extremes.leastNegative + WORD_VALUES);
+	if (!isSigned(typeCode)) return;
+	if (extremes.greatest >= WORD_VALUES + bounds.min) reject(extremes.greatest, extremes.greatest - WORD_VALUES);
 }
 var PolicyBuilder = class PolicyBuilder {
 	draft;
@@ -2555,7 +2835,7 @@ var PolicyBuilder = class PolicyBuilder {
 			selector: parsed.selector,
 			descriptor,
 			groups: [[]],
-			pathHashes: [/* @__PURE__ */ new Set()]
+			groupPathKeys: /* @__PURE__ */ new Set()
 		});
 	}
 	static createRaw(typesCsv) {
@@ -2564,32 +2844,34 @@ var PolicyBuilder = class PolicyBuilder {
 			selector: "0x00000000",
 			descriptor: DescriptorCoder.fromTypes(typesCsv),
 			groups: [[]],
-			pathHashes: [/* @__PURE__ */ new Set()]
+			groupPathKeys: /* @__PURE__ */ new Set()
 		});
 	}
 	add(constraint) {
-		const c = {
+		const added = {
 			scope: constraint.scope,
 			path: constraint.path,
-			operators: [...constraint.operators]
+			operators: [...constraint.operators],
+			..."hint" in constraint && constraint.hint !== void 0 && { hint: constraint.hint }
 		};
-		if (c.operators.length === 0) throw new CallciumError("NO_CONSTRAINT_OPERATORS", "Constraint must have at least one operator.");
-		const steps = parsePathSteps(c.path);
-		if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step.");
-		if (c.scope === Scope.CONTEXT) validateContextPath(steps);
-		else if (c.scope === Scope.CALLDATA) validateCalldataPath(steps, this.draft.descriptor);
-		else throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${c.scope}.`);
-		const key = `${c.scope}:${c.path.toLowerCase()}`;
-		const currentHashes = this.draft.pathHashes[this.draft.pathHashes.length - 1];
-		if (currentHashes.has(key)) throw new CallciumError("DUPLICATE_PATH_IN_GROUP", `Duplicate path ${c.path} in the same group.`);
-		currentHashes.add(key);
-		this.draft.groups[this.draft.groups.length - 1].push(c);
+		if (added.operators.length === 0) throw new CallciumError("NO_CONSTRAINT_OPERATORS", "Constraint must have at least one operator");
+		const steps = parsePathSteps(added.path);
+		if (steps.length === 0) throw new CallciumError("EMPTY_PATH", "Path must have at least one step");
+		let targetTypeCode;
+		if (added.scope === Scope.CONTEXT) targetTypeCode = validateContextPath(steps);
+		else if (added.scope === Scope.CALLDATA) targetTypeCode = validateCalldataPath(steps, this.draft.descriptor);
+		else throw new CallciumError("INVALID_SCOPE", `Unknown scope value ${added.scope}`);
+		checkOperandDomain(constraint, targetTypeCode);
+		const key = `${added.scope}:${added.path.toLowerCase()}`;
+		if (this.draft.groupPathKeys.has(key)) throw new CallciumError("DUPLICATE_PATH_IN_GROUP", `Duplicate path ${added.path} in the same group`);
+		this.draft.groupPathKeys.add(key);
+		this.draft.groups[this.draft.groups.length - 1].push(added);
 		return this;
 	}
 	or() {
-		if (this.draft.groups[this.draft.groups.length - 1].length === 0) throw new CallciumError("EMPTY_GROUP", "Cannot start a new group when the current group is empty.");
+		if (this.draft.groups[this.draft.groups.length - 1].length === 0) throw new CallciumError("EMPTY_GROUP", "Cannot start a new group when the current group is empty");
 		this.draft.groups.push([]);
-		this.draft.pathHashes.push(/* @__PURE__ */ new Set());
+		this.draft.groupPathKeys.clear();
 		return this;
 	}
 	build() {
@@ -2609,7 +2891,7 @@ var PolicyBuilder = class PolicyBuilder {
 		return PolicyValidator.validate(policyData);
 	}
 	checkGroups() {
-		for (let i = 0; i < this.draft.groups.length; i++) if (this.draft.groups[i].length === 0) throw new CallciumError("EMPTY_GROUP", `Group ${i} is empty.`);
+		for (let i = 0; i < this.draft.groups.length; i++) if (this.draft.groups[i].length === 0) throw new CallciumError("EMPTY_GROUP", `Group ${i} is empty`);
 	}
 	toPolicyData() {
 		return {
@@ -2621,176 +2903,16 @@ var PolicyBuilder = class PolicyBuilder {
 	}
 };
 //#endregion
-//#region src/constraint.ts
-function addressBody(value) {
-	return toAddress(value).slice(2);
-}
-function encodeWord(value) {
-	const word = new Uint8Array(32);
-	if (typeof value === "boolean") {
-		word[31] = value ? 1 : 0;
-		return word;
-	}
-	if (typeof value === "string") {
-		const body = addressBody(value);
-		for (let i = 0; i < 20; i++) word[12 + i] = parseInt(body.substring(i * 2, i * 2 + 2), 16);
-		return word;
-	}
-	let bigValue = typeof value === "number" ? BigInt(value) : value;
-	for (let i = 31; i >= 0; i--) {
-		word[i] = Number(bigValue & 255n);
-		bigValue >>= 8n;
-	}
-	return word;
-}
-function singleOp(opCode, value) {
-	const buffer = new Uint8Array(33);
-	buffer[0] = opCode;
-	buffer.set(encodeWord(value), 1);
-	return bytesToHex(buffer);
-}
-function rangeOp(opCode, min, max) {
-	if (min > max) throw new CallciumError("INVALID_RANGE", `Range min (${min}) must not exceed max (${max})`);
-	const buffer = new Uint8Array(65);
-	buffer[0] = opCode;
-	buffer.set(encodeWord(min), 1);
-	buffer.set(encodeWord(max), 33);
-	return bytesToHex(buffer);
-}
-function checkContextPropertyId(contextPropertyId) {
-	if (!Number.isInteger(contextPropertyId) || contextPropertyId < 0 || contextPropertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID ${contextPropertyId}`);
-	return contextPropertyId;
-}
-const MAX_SET_MEMBERS = Limits.MAX_SET_MEMBERS;
-function setOp(opCode, values) {
-	const bigs = values.map((v) => {
-		if (typeof v === "bigint") return v;
-		if (typeof v === "number") return BigInt(v);
-		if (typeof v === "boolean") return v ? 1n : 0n;
-		return BigInt("0x" + addressBody(v));
-	});
-	bigs.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-	const deduped = [];
-	for (const value of bigs) if (deduped.length === 0 || deduped[deduped.length - 1] !== value) deduped.push(value);
-	if (deduped.length === 0) throw new CallciumError("EMPTY_SET", "Set must contain at least one value");
-	if (deduped.length > MAX_SET_MEMBERS) throw new CallciumError("SET_TOO_LARGE", `Set must contain at most ${MAX_SET_MEMBERS} values`);
-	const buffer = new Uint8Array(1 + deduped.length * 32);
-	buffer[0] = opCode;
-	for (let i = 0; i < deduped.length; i++) buffer.set(encodeWord(deduped[i]), 1 + i * 32);
-	return bytesToHex(buffer);
-}
-function encodePath(steps) {
-	const buffer = new Uint8Array(steps.length * 2);
-	for (let i = 0; i < steps.length; i++) writeBE16(buffer, i * 2, steps[i]);
-	return bytesToHex(buffer);
-}
-var ConstraintBuilder = class {
-	scope;
-	path;
-	operators;
-	constructor(scope, path) {
-		this.scope = scope;
-		this.path = path;
-		this.operators = [];
-	}
-	push(opHex) {
-		this.operators.push(opHex);
-		return this;
-	}
-	eq(value) {
-		return this.push(singleOp(Op.EQ, value));
-	}
-	neq(value) {
-		return this.push(singleOp(Op.EQ | Op.NOT, value));
-	}
-	eqCtx(contextPropertyId) {
-		return this.push(singleOp(Op.EQ_CTX, checkContextPropertyId(contextPropertyId)));
-	}
-	neqCtx(contextPropertyId) {
-		return this.push(singleOp(Op.EQ_CTX | Op.NOT, checkContextPropertyId(contextPropertyId)));
-	}
-	gt(bound) {
-		return this.push(singleOp(Op.GT, bound));
-	}
-	lt(bound) {
-		return this.push(singleOp(Op.LT, bound));
-	}
-	gte(bound) {
-		return this.push(singleOp(Op.GTE, bound));
-	}
-	lte(bound) {
-		return this.push(singleOp(Op.LTE, bound));
-	}
-	between(min, max) {
-		return this.push(rangeOp(Op.BETWEEN, BigInt(min), BigInt(max)));
-	}
-	isIn(values) {
-		return this.push(setOp(Op.IN, values));
-	}
-	notIn(values) {
-		return this.push(setOp(Op.IN | Op.NOT, values));
-	}
-	bitmaskAll(mask) {
-		return this.push(singleOp(Op.BITMASK_ALL, mask));
-	}
-	bitmaskAny(mask) {
-		return this.push(singleOp(Op.BITMASK_ANY, mask));
-	}
-	bitmaskNone(mask) {
-		return this.push(singleOp(Op.BITMASK_NONE, mask));
-	}
-	lengthEq(n) {
-		return this.push(singleOp(Op.LENGTH_EQ, n));
-	}
-	lengthGt(n) {
-		return this.push(singleOp(Op.LENGTH_GT, n));
-	}
-	lengthLt(n) {
-		return this.push(singleOp(Op.LENGTH_LT, n));
-	}
-	lengthGte(n) {
-		return this.push(singleOp(Op.LENGTH_GTE, n));
-	}
-	lengthLte(n) {
-		return this.push(singleOp(Op.LENGTH_LTE, n));
-	}
-	lengthBetween(min, max) {
-		return this.push(rangeOp(Op.LENGTH_BETWEEN, BigInt(min), BigInt(max)));
-	}
-};
-function arg(...steps) {
-	return new ConstraintBuilder(Scope.CALLDATA, encodePath(steps));
-}
-function msgSender() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_SENDER]));
-}
-function msgValue() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.MSG_VALUE]));
-}
-function blockTimestamp() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_TIMESTAMP]));
-}
-function blockNumber() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BLOCK_NUMBER]));
-}
-function chainId() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.CHAIN_ID]));
-}
-function txOrigin() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.TX_ORIGIN]));
-}
-function baseFee() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.BASE_FEE]));
-}
-function gasPrice() {
-	return new ConstraintBuilder(Scope.CONTEXT, encodePath([ContextProperty.GAS_PRICE]));
-}
-//#endregion
 //#region src/calldata-reader.ts
 function loadWord(callData, offset) {
 	if (offset < 0 || offset + 32 > callData.length) return { code: "CALLDATA_OUT_OF_BOUNDS" };
 	return callData.subarray(offset, offset + 32);
 }
+function readLength(callData, head) {
+	const word = loadWord(callData, head);
+	if (word instanceof Uint8Array) return toBigInt(word, 0);
+	return word;
+}
 function readPointer(callData, head) {
 	const word = loadWord(callData, head);
 	if (word instanceof Uint8Array) {
@@ -2801,17 +2923,16 @@ function readPointer(callData, head) {
 }
 //#endregion
 //#region src/policy-enforcer.ts
-const ABORT_VIOLATION_CODES = new Set([
+const abortViolationCodes = new Set([
 	"CALLDATA_OUT_OF_BOUNDS",
 	"ARRAY_INDEX_OUT_OF_BOUNDS",
 	"NON_CANONICAL_VALUE",
 	"QUANTIFIER_LIMIT_EXCEEDED"
 ]);
-function addressToBigInt(hex) {
-	const bytes = hexToBytes(hex);
-	const padded = new Uint8Array(32);
-	padded.set(bytes, 32 - bytes.length);
-	return toBigInt(padded, 0);
+function contextValueToWord(value) {
+	if (typeof value === "string") return BigInt(toAddress(value));
+	if (BigInt.asUintN(256, value) !== value) throw new CallciumError("CONTEXT_VALUE_OVERFLOW", `Context value ${value} is outside the range a 32-byte word represents`);
+	return value;
 }
 function check(policy, callData, context) {
 	const { policy: decoded, data: policyBytes } = decodePolicy(policy);
@@ -2842,7 +2963,7 @@ function check(policy, callData, context) {
 			const violation = evaluateRule(rule, policyBytes, callDataBytes, baseOffset, groupIndex, ruleIndex, context);
 			if (violation !== null) {
 				allViolations.push(violation);
-				if (ABORT_VIOLATION_CODES.has(violation.code)) return {
+				if (abortViolationCodes.has(violation.code)) return {
 					ok: false,
 					violations: allViolations
 				};
@@ -2875,10 +2996,14 @@ function evaluateRule(rule, policyBytes, callDataBytes, baseOffset, groupIndex,
 	return evaluateCalldataRule(fieldBytes(policyBytes, rule.hint), callDataBytes, baseOffset, opCode, operandData, groupIndex, ruleIndex, rule.path.value, context);
 }
 function resolveContextOperand(operandData, context) {
-	const propInfo = lookupContextProperty(Number(toBigInt(operandData, 0)));
-	const value = context?.[propInfo.contextKey];
-	if (value === void 0) return { ctxTypeCode: propInfo.typeCode };
-	return typeof value === "string" ? addressToBigInt(value) : value;
+	const propertyInfo = lookupContextProperty(Number(toBigInt(operandData, 0)));
+	const value = context?.[propertyInfo.contextKey];
+	if (value === void 0) return { ctxTypeCode: propertyInfo.typeCode };
+	return contextValueToWord(value);
+}
+function referenceOperand(opCode, operandData, context) {
+	if ((opCode & ~Op.NOT) !== Op.EQ_CTX) return void 0;
+	return resolveContextOperand(operandData, context);
 }
 function readTargetBlock(hint, targetOffset) {
 	return {
@@ -2905,8 +3030,8 @@ function chainResolve(hint, callData, base, hopsOffset, hopCount) {
 		const meta = readU16(hint, hop + PolicyFormat.HINT_HOP_META_OFFSET);
 		let elems = base;
 		if ((meta & PolicyFormat.HINT_META_DYNAMIC_ARRAY) !== 0) {
-			const length = readPointer(callData, elems);
-			if (typeof length !== "number") return length;
+			const length = readLength(callData, elems);
+			if (typeof length !== "bigint") return length;
 			if (index >= length) return { code: "ARRAY_INDEX_OUT_OF_BOUNDS" };
 			elems += 32;
 		}
@@ -2919,21 +3044,19 @@ function chainResolve(hint, callData, base, hopsOffset, hopCount) {
 	}
 	return base;
 }
-function evalTarget(callData, target, block, opCode, operandData, context) {
+function evalTarget(callData, target, block, opCode, operandData, ctxOperand) {
 	const typeCode = block.typeCode;
 	if (isLengthValidType(typeCode)) {
-		if (!isLengthOp(opCode)) throw new CallciumError("OPERATOR_TARGET_MISMATCH", "Value operator on a target without a scalar word.");
-		const length = readPointer(callData, target);
-		if (typeof length !== "number") return { error: length.code };
+		const length = readLength(callData, target);
+		if (typeof length !== "bigint") return { error: length.code };
 		const stride = typeCode === TypeCode.DYNAMIC_ARRAY ? (block.targetMeta & PolicyFormat.HINT_META_STRIDE_MASK) * 32 : 1;
 		const room = callData.length - (target + 32);
-		if (stride !== 0 && length > Math.floor(room / stride)) return { error: "CALLDATA_OUT_OF_BOUNDS" };
+		if (stride !== 0 && length > BigInt(Math.floor(room / stride))) return { error: "CALLDATA_OUT_OF_BOUNDS" };
 		return {
 			passed: applyOperator(opCode, 0n, length, operandData, typeCode),
-			value: BigInt(length)
+			value: length
 		};
 	}
-	if (classifyTypeCode(typeCode).typeClass !== "elementary") throw new CallciumError("OPERATOR_TARGET_MISMATCH", "Operator target does not carry a scalar word.");
 	const word = loadWord(callData, target);
 	if (!(word instanceof Uint8Array)) return { error: word.code };
 	const value = toBigInt(word, 0);
@@ -2941,57 +3064,50 @@ function evalTarget(callData, target, block, opCode, operandData, context) {
 		error: "NON_CANONICAL_VALUE",
 		value
 	};
-	if ((opCode & ~Op.NOT) === Op.EQ_CTX) {
-		const operand = resolveContextOperand(operandData, context);
-		if (typeof operand !== "bigint") return {
+	if (ctxOperand !== void 0) {
+		if (typeof ctxOperand !== "bigint") return {
 			error: "MISSING_CONTEXT",
-			ctxTypeCode: operand.ctxTypeCode
+			ctxTypeCode: ctxOperand.ctxTypeCode
 		};
 		return {
-			passed: value === operand !== ((opCode & Op.NOT) !== 0),
+			passed: value === ctxOperand !== ((opCode & Op.NOT) !== 0),
 			value,
-			ctxOperand: operand
+			ctxOperand
 		};
 	}
 	return {
-		passed: applyOperator(opCode, value, 32, operandData, typeCode),
+		passed: applyOperator(opCode, value, 32n, operandData, typeCode),
 		value
 	};
 }
-function navigationViolation(frame, code, elementIndex) {
+function ruleFields(frame) {
 	return {
 		group: frame.group,
 		rule: frame.rule,
-		code,
 		scope: Scope.CALLDATA,
 		path: frame.path,
 		opCode: frame.opCode,
 		operandData: bytesToHex(frame.operandData),
-		typeCode: frame.typeCode,
+		typeCode: frame.typeCode
+	};
+}
+function navigationViolation(frame, code, elementIndex) {
+	return {
+		code,
+		...ruleFields(frame),
 		...elementIndex !== void 0 && { elementIndex }
 	};
 }
 function targetViolation(frame, result, elementIndex) {
 	if ("error" in result) {
 		if (result.error === "MISSING_CONTEXT") return {
-			group: frame.group,
-			rule: frame.rule,
 			code: result.error,
-			scope: Scope.CALLDATA,
-			path: frame.path,
-			opCode: frame.opCode,
-			operandData: bytesToHex(frame.operandData),
+			...ruleFields(frame),
 			typeCode: result.ctxTypeCode
 		};
 		if (result.error === "NON_CANONICAL_VALUE") return {
-			group: frame.group,
-			rule: frame.rule,
 			code: result.error,
-			scope: Scope.CALLDATA,
-			path: frame.path,
-			opCode: frame.opCode,
-			operandData: bytesToHex(frame.operandData),
-			typeCode: frame.typeCode,
+			...ruleFields(frame),
 			resolvedValue: bigintToHex(result.value),
 			...elementIndex !== void 0 && { elementIndex }
 		};
@@ -2999,14 +3115,8 @@ function targetViolation(frame, result, elementIndex) {
 	}
 	if (result.passed) return null;
 	return {
-		group: frame.group,
-		rule: frame.rule,
 		code: "VALUE_MISMATCH",
-		scope: Scope.CALLDATA,
-		path: frame.path,
-		opCode: frame.opCode,
-		operandData: bytesToHex(frame.operandData),
-		typeCode: frame.typeCode,
+		...ruleFields(frame),
 		resolvedValue: bigintToHex(result.value),
 		...result.ctxOperand !== void 0 && { resolvedOperand: bigintToHex(result.ctxOperand) },
 		...elementIndex !== void 0 && { elementIndex }
@@ -3029,7 +3139,7 @@ function evaluateCalldataRule(hint, callDataBytes, baseOffset, opCode, operandDa
 	};
 	const base = chainResolve(hint, callDataBytes, baseOffset, hopsOffset, hopCount);
 	if (typeof base !== "number") return navigationViolation(frame, base.code);
-	return targetViolation(frame, evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData, context));
+	return targetViolation(frame, evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData, referenceOperand(opCode, operandData, context)));
 }
 function evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, hopCount, opCode, operandData, groupIndex, ruleIndex, pathHex, context) {
 	const frameOffset = hopsOffset + hopCount * PolicyFormat.HINT_HOP_SIZE;
@@ -3048,23 +3158,23 @@ function evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, h
 	const chained = chainResolve(hint, callDataBytes, baseOffset, hopsOffset, hopCount);
 	if (typeof chained !== "number") return navigationViolation(frame, chained.code);
 	let elems = chained + readU32(hint, frameOffset);
-	let count = readU16(hint, frameOffset + PolicyFormat.HINT_FRAME_COUNT_OFFSET);
-	if (count === 0) {
-		const length = readPointer(callDataBytes, elems);
-		if (typeof length !== "number") return navigationViolation(frame, length.code);
+	let count = BigInt(readU16(hint, frameOffset + PolicyFormat.HINT_FRAME_COUNT_OFFSET));
+	if (count === 0n) {
+		const length = readLength(callDataBytes, elems);
+		if (typeof length !== "bigint") return navigationViolation(frame, length.code);
 		count = length;
 		elems += 32;
 	}
-	if (count > Limits.MAX_QUANTIFIED_ARRAY_LENGTH) return {
+	if (count > BigInt(PolicyFormat.MAX_QUANTIFIED_ARRAY_LENGTH)) return {
 		group: groupIndex,
 		rule: ruleIndex,
 		code: "QUANTIFIER_LIMIT_EXCEEDED",
 		scope: Scope.CALLDATA,
 		path: pathHex,
-		resolvedValue: bigintToHex(BigInt(count))
+		resolvedValue: bigintToHex(count)
 	};
 	const isUniversal = kind === PolicyFormat.HINT_KIND_ALL;
-	if (count === 0) {
+	if (count === 0n) {
 		if (isUniversal) return null;
 		return {
 			group: groupIndex,
@@ -3077,7 +3187,7 @@ function evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, h
 	const meta = readU16(hint, frameOffset + PolicyFormat.HINT_FRAME_META_OFFSET);
 	const elemStride = (meta & PolicyFormat.HINT_META_STRIDE_MASK) * 32;
 	const elemIsDynamic = (meta & PolicyFormat.HINT_META_ELEM_DYNAMIC) !== 0;
-	let ctxOperand;
+	const reference = referenceOperand(opCode, operandData, context);
 	for (let elemIndex = 0; elemIndex < count; elemIndex++) {
 		const slot = elems + elemIndex * elemStride;
 		let elem = slot;
@@ -3092,68 +3202,54 @@ function evaluateQuantified(hint, callDataBytes, baseOffset, kind, hopsOffset, h
 			if (typeof chainedElem !== "number") return navigationViolation(frame, chainedElem.code, elemIndex);
 			base = chainedElem;
 		}
-		const applied = evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData, context);
+		const applied = evalTarget(callDataBytes, base + block.targetDelta, block, opCode, operandData, reference);
 		if ("error" in applied) return targetViolation(frame, applied, elemIndex);
 		if (applied.passed) {
 			if (!isUniversal) return null;
 		} else if (isUniversal) return targetViolation(frame, applied, elemIndex);
-		ctxOperand = applied.ctxOperand;
 	}
 	if (isUniversal) return null;
 	return {
-		group: groupIndex,
-		rule: ruleIndex,
 		code: "VALUE_MISMATCH",
-		scope: Scope.CALLDATA,
-		path: pathHex,
-		opCode,
-		operandData: bytesToHex(operandData),
-		typeCode: block.typeCode,
-		...ctxOperand !== void 0 && { resolvedOperand: bigintToHex(ctxOperand) }
+		...ruleFields(frame),
+		...typeof reference === "bigint" && { resolvedOperand: bigintToHex(reference) }
 	};
 }
 function evaluateContextRule(pathBytes, opCode, operandData, groupIndex, ruleIndex, pathHex, context) {
-	const propertyId = readU16(pathBytes, 0);
-	if (propertyId > MAX_CONTEXT_PROPERTY_ID) throw new CallciumError("UNKNOWN_CONTEXT_PROPERTY", `Unknown context property ID 0x${propertyId.toString(16).padStart(4, "0")}`);
-	const propInfo = lookupContextProperty(propertyId);
-	const contextValue = context?.[propInfo.contextKey];
-	if (contextValue === void 0) return {
+	const propertyInfo = lookupContextProperty(readU16(pathBytes, 0));
+	const contextValue = context?.[propertyInfo.contextKey];
+	const site = {
 		group: groupIndex,
 		rule: ruleIndex,
-		code: "MISSING_CONTEXT",
 		scope: Scope.CONTEXT,
-		path: pathHex,
-		typeCode: propInfo.typeCode
+		path: pathHex
+	};
+	if (contextValue === void 0) return {
+		code: "MISSING_CONTEXT",
+		...site,
+		typeCode: propertyInfo.typeCode
 	};
-	let value;
-	if (typeof contextValue === "string") value = addressToBigInt(contextValue);
-	else value = contextValue;
+	const value = contextValueToWord(contextValue);
 	let result;
 	let ctxOperand;
 	if ((opCode & ~Op.NOT) === Op.EQ_CTX) {
 		const operand = resolveContextOperand(operandData, context);
 		if (typeof operand !== "bigint") return {
-			group: groupIndex,
-			rule: ruleIndex,
 			code: "MISSING_CONTEXT",
-			scope: Scope.CONTEXT,
-			path: pathHex,
+			...site,
 			opCode,
 			operandData: bytesToHex(operandData),
 			typeCode: operand.ctxTypeCode
 		};
 		result = value === operand !== ((opCode & Op.NOT) !== 0);
 		ctxOperand = operand;
-	} else result = applyOperator(opCode, value, 32, operandData, propInfo.typeCode);
+	} else result = applyOperator(opCode, value, 32n, operandData, propertyInfo.typeCode);
 	if (!result) return {
-		group: groupIndex,
-		rule: ruleIndex,
 		code: "VALUE_MISMATCH",
-		scope: Scope.CONTEXT,
-		path: pathHex,
+		...site,
 		opCode,
 		operandData: bytesToHex(operandData),
-		typeCode: propInfo.typeCode,
+		typeCode: propertyInfo.typeCode,
 		resolvedValue: bigintToHex(value),
 		...ctxOperand !== void 0 && { resolvedOperand: bigintToHex(ctxOperand) }
 	};
@@ -3164,6 +3260,6 @@ const PolicyEnforcer = {
 	enforce
 };
 //#endregion
-export { CallciumError, ContextProperty, Descriptor, DescriptorCoder, Limits, MAX_CONTEXT_PROPERTY_ID, Op, PolicyBuilder, PolicyCoder, PolicyEnforcer, PolicyFormat, PolicyValidator, PolicyViolationError, Quantifier, Scope, TypeCode, ValidationError, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
+export { CallciumError, ContextProperty, Descriptor, DescriptorCoder, MAX_CONTEXT_PROPERTY_ID, Op, PolicyBuilder, PolicyCoder, PolicyEnforcer, PolicyFormat, PolicyValidator, PolicyViolationError, Quantifier, Scope, TypeCode, ValidationError, arg, baseFee, blockNumber, blockTimestamp, bytesToHex, chainId, findContextProperty, gasPrice, hexToBytes, isLengthOp, isOpAllowed, isQuantifier, lookupContextProperty, lookupOp, lookupQuantifier, lookupScope, lookupTypeCode, msgSender, msgValue, parsePathSteps, toAddress, txOrigin };
 
 //# sourceMappingURL=index.js.map