@debridge-finance/borderless-validation-sdk 0.0.0-dev-dee2389

package/dist/esm/validations/evm-required-actions.js

@@ -0,0 +1,181 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, } from "../types/index.js";
+import { validateSign7702Actions } from "./evm-sign7702.js";
+import { validateSign712MetaMaskActions } from "./evm-sign712-metamask.js";
+import { validateSign712IntentActions } from "./evm-sign712.js";
+import { validatePermitActions } from "./evm-permit.js";
+import { validatePermit2Actions } from "./evm-permit2.js";
+import { validateTransactionActions } from "./evm-transaction.js";
+import { validateBudgetOperations } from "./evm-op-budget.js";
+import { validateWrapOperations } from "./evm-op-wrap.js";
+import { validateGasCompensationOperations } from "./evm-op-gas-compensation.js";
+import { normalizeAddress } from "../helpers/address.js";
+export function validateEvmRequiredActions(request, response, actions, basePath, realChainId, quoteMode, intent, trades, srcChainAuthorityAddress, envConfig) {
+    return [
+        ...validateUniqueActionIds(actions, basePath),
+        ...validateAAConstraints(request, response, actions, basePath),
+        ...validateSign7702Actions(actions, basePath, realChainId),
+        ...validateSign712MetaMaskActions(actions, basePath, realChainId, quoteMode, request.expirationTimestamp, srcChainAuthorityAddress),
+        // Sign712 Intent check is skipped in quote mode
+        ...(quoteMode ? [] : validateSign712IntentActions(actions, basePath, realChainId, intent, envConfig)),
+        ...validatePermitActions(actions, basePath, request, response, realChainId, quoteMode, trades, srcChainAuthorityAddress, envConfig),
+        ...validatePermit2Actions(actions, basePath, request, response, realChainId, trades, envConfig),
+        ...validateTransactionActions(actions, basePath),
+        ...validateBudgetOperations(actions, basePath, request, trades, realChainId, envConfig),
+        ...validateWrapOperations(actions, basePath, trades, realChainId),
+        ...validateGasCompensationOperations(actions, basePath, request, realChainId),
+        ...validateApprovalMutualExclusivity(actions, basePath, realChainId),
+    ];
+}
+// HIGH: Each actionId must be unique within an intent
+function validateUniqueActionIds(actions, basePath) {
+    const seen = new Map();
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const actionId = actions[i].actionId;
+        const firstIndex = seen.get(actionId);
+        if (firstIndex !== undefined) {
+            violations.push({
+                code: ViolationCode.DuplicateActionId,
+                message: `duplicate actionId "${actionId}" at indices ${firstIndex} and ${i}`,
+                path: `${basePath}.requiredActions[${i}].actionId`,
+                actual: actionId,
+            });
+        }
+        else {
+            seen.set(actionId, i);
+        }
+    }
+    return violations;
+}
+// =============================================
+// Account Abstraction constraints
+// =============================================
+function validateAAConstraints(request, response, actions, basePath) {
+    return request.enableAccountAbstraction
+        ? validateAAEnabled(actions, basePath)
+        : validateAADisabled(response, actions, basePath);
+}
+// AA = true: no Transaction actions allowed
+function validateAAEnabled(actions, basePath) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        if (actions[i].type === EvmActionKind.Transaction) {
+            violations.push({
+                code: ViolationCode.ForbiddenTransactionWithAA,
+                message: `${EvmActionKind.Transaction} action is forbidden when enableAccountAbstraction=true`,
+                path: `${basePath}.requiredActions[${i}].type`,
+                actual: actions[i].type,
+            });
+        }
+    }
+    return violations;
+}
+// AA = false: no Sign7702Authorization, no Sign712MetaMask,
+// no Delegate in actions[], no transactionCalls.
+// Note: preHooks/postHooks AA constraint is now checked in hooks-common.ts
+function validateAADisabled(_response, actions, basePath) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        // CRITICAL: no Sign7702Authorization
+        if (action.type === EvmActionKind.Sign7702Authorization) {
+            violations.push({
+                code: ViolationCode.ForbiddenSign7702WithoutAA,
+                message: `${EvmActionKind.Sign7702Authorization} action is forbidden when enableAccountAbstraction=false`,
+                path: `${actionPath}.type`,
+                actual: action.type,
+            });
+        }
+        // CRITICAL: no Sign712MetaMask
+        if (action.type === EvmActionKind.Sign712MetaMask) {
+            violations.push({
+                code: ViolationCode.ForbiddenSign712MetaMaskWithoutAA,
+                message: `${EvmActionKind.Sign712MetaMask} action is forbidden when enableAccountAbstraction=false`,
+                path: `${actionPath}.type`,
+                actual: action.type,
+            });
+        }
+        // CRITICAL: no Delegate operation in actions[]
+        if (action.actions.includes(EvmActionOperation.Delegate)) {
+            violations.push({
+                code: ViolationCode.ForbiddenDelegateWithoutAA,
+                message: `${EvmActionOperation.Delegate} operation is forbidden when enableAccountAbstraction=false`,
+                path: `${actionPath}.actions`,
+                actual: action.actions,
+            });
+        }
+        // CRITICAL: transactionCalls must be empty or undefined
+        const txCalls = action.details?.transactionCalls;
+        if (txCalls && txCalls.length > 0) {
+            violations.push({
+                code: ViolationCode.ForbiddenTransactionCallsWithoutAA,
+                message: `details.transactionCalls must be empty when enableAccountAbstraction=false`,
+                path: `${actionPath}.details.transactionCalls`,
+                expected: [],
+                actual: txCalls,
+            });
+        }
+    }
+    return violations;
+}
+// =============================================
+// CRITICAL: Permit, Permit2, and Transaction with Budget operation
+// are mutually exclusive per token per intent
+// =============================================
+var ApprovalActionKind;
+(function (ApprovalActionKind) {
+    ApprovalActionKind[ApprovalActionKind["Permit"] = 0] = "Permit";
+    ApprovalActionKind[ApprovalActionKind["Permit2"] = 1] = "Permit2";
+    ApprovalActionKind[ApprovalActionKind["TransactionBudget"] = 2] = "TransactionBudget";
+})(ApprovalActionKind || (ApprovalActionKind = {}));
+// CRITICAL: for one token per intent, at most one approval action
+function validateApprovalMutualExclusivity(actions, basePath, realChainId) {
+    const seen = new Map();
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const entry = classifyApprovalAction(actions[i]);
+        if (!entry)
+            continue;
+        const key = normalizeAddress(realChainId, entry.tokenAddress);
+        const existing = seen.get(key);
+        if (existing) {
+            violations.push({
+                code: ViolationCode.ApprovalMutualExclusivity,
+                message: `${entry.kind} at index ${i} conflicts with ${existing.kind} at index ${existing.index} for token ${key}`,
+                path: `${basePath}.requiredActions[${i}]`,
+                expected: 1,
+                actual: 2,
+            });
+        }
+        else {
+            seen.set(key, { kind: entry.kind, index: i });
+        }
+    }
+    return violations;
+}
+function classifyApprovalAction(action) {
+    if (action.type === EvmActionKind.Permit) {
+        const vc = action.data
+            .domain?.verifyingContract;
+        if (vc)
+            return { kind: ApprovalActionKind.Permit, tokenAddress: vc };
+    }
+    if (action.type === EvmActionKind.Permit2) {
+        const token = action.data.message?.details?.token;
+        if (token)
+            return { kind: ApprovalActionKind.Permit2, tokenAddress: token };
+    }
+    if (action.type === EvmActionKind.Transaction &&
+        // Stricter check for action.actions to be exactly ['Budget'] is performed in another place.
+        // Here we filter Transaction actions that include 'Budget' among other operations.
+        action.actions.includes(EvmActionOperation.Budget) &&
+        action.details?.tokenAddress) {
+        return {
+            kind: ApprovalActionKind.TransactionBudget,
+            tokenAddress: action.details.tokenAddress,
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=evm-required-actions.js.map

package/dist/esm/validations/evm-required-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-required-actions.js","sourceRoot":"","sources":["../../../src/validations/evm-required-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAIb,aAAa,EACb,kBAAkB,GAIrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,UAAU,0BAA0B,CACtC,OAA8B,EAC9B,QAAgC,EAChC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,MAAsB,EACtB,MAAsB,EACtB,wBAA4C,EAC5C,SAA4B;IAE5B,OAAO;QACH,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC7C,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC9D,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;QAC1D,GAAG,8BAA8B,CAC7B,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EACzC,OAAO,CAAC,mBAAmB,EAAE,wBAAwB,CACxD;QACD,gDAAgD;QAChD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAC7C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CACpD,CAAC;QACF,GAAG,qBAAqB,CACpB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EACpC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,CACtE;QACD,GAAG,sBAAsB,CACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CACvE;QACD,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC;QAChD,GAAG,wBAAwB,CACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAC7D;QACD,GAAG,sBAAsB,CACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CACzC;QACD,GAAG,iCAAiC,CAChC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAC1C;QACD,GAAG,iCAAiC,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;KACvE,CAAC;AACN,CAAC;AAED,sDAAsD;AACtD,SAAS,uBAAuB,CAC5B,OAA4B,EAC5B,QAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO,EAAE,uBAAuB,QAAQ,gBAAgB,UAAU,QAAQ,CAAC,EAAE;gBAC7E,IAAI,EAAE,GAAG,QAAQ,oBAAoB,CAAC,YAAY;gBAClD,MAAM,EAAE,QAAQ;aACnB,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,kCAAkC;AAClC,gDAAgD;AAEhD,SAAS,qBAAqB,CAC1B,OAA8B,EAC9B,QAAgC,EAChC,OAA4B,EAC5B,QAAgB;IAEhB,OAAO,OAAO,CAAC,wBAAwB;QACnC,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACtC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,4CAA4C;AAC5C,SAAS,iBAAiB,CACtB,OAA4B,EAC5B,QAAgB;IAEhB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,yDAAyD;gBAC9F,IAAI,EAAE,GAAG,QAAQ,oBAAoB,CAAC,QAAQ;gBAC9C,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;aAC1B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,4DAA4D;AAC5D,iDAAiD;AACjD,2EAA2E;AAC3E,SAAS,kBAAkB,CACvB,SAAiC,EACjC,OAA4B,EAC5B,QAAgB;IAEhB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QAEvD,qCAAqC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,qBAAqB,EAAE,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,OAAO,EAAE,GAAG,aAAa,CAAC,qBAAqB,0DAA0D;gBACzG,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,MAAM,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC;QACP,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,eAAe,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,iCAAiC;gBACrD,OAAO,EAAE,GAAG,aAAa,CAAC,eAAe,0DAA0D;gBACnG,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,MAAM,EAAE,MAAM,CAAC,IAAI;aACtB,CAAC,CAAC;QACP,CAAC;QAED,+CAA+C;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,OAAO,EAAE,GAAG,kBAAkB,CAAC,QAAQ,6DAA6D;gBACpG,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC;QACjD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,kCAAkC;gBACtD,OAAO,EAAE,4EAA4E;gBACrF,IAAI,EAAE,GAAG,UAAU,2BAA2B;gBAC9C,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,OAAO;aAClB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,mEAAmE;AACnE,8CAA8C;AAC9C,gDAAgD;AAEhD,IAAK,kBAIJ;AAJD,WAAK,kBAAkB;IACnB,+DAAM,CAAA;IACN,iEAAO,CAAA;IACP,qFAAiB,CAAA;AACrB,CAAC,EAJI,kBAAkB,KAAlB,kBAAkB,QAItB;AAED,kEAAkE;AAClE,SAAS,iCAAiC,CACtC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC5E,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,QAAQ,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,yBAAyB;gBAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,aAAa,CAAC,mBAAmB,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,KAAK,cAAc,GAAG,EAAE;gBAClH,IAAI,EAAE,GAAG,QAAQ,oBAAoB,CAAC,GAAG;gBACzC,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,CAAC;aACZ,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAC3B,MAAyB;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,EAAE,GAAI,MAAM,CAAC,IAAoD;aAClE,MAAM,EAAE,iBAAiB,CAAC;QAC/B,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GACP,MAAM,CAAC,IACV,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC1B,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IACD,IACI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,WAAW;QACzC,4FAA4F;QAC5F,mFAAmF;QACnF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAClD,MAAM,CAAC,OAAO,EAAE,YAAY,EAC9B,CAAC;QACC,OAAO;YACH,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;YAC1C,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;SAC5C,CAAC;IACN,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/dist/esm/validations/evm-sign712-metamask.js

@@ -0,0 +1,144 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { DELEGATION_MANAGER_CONTRACTS } from "../whitelists/evm/index.js";
+import { addressEquals } from "../helpers/address.js";
+import { classifyCaveats, validateExactExecutionPresence, validateExactExecutionContent, validateTimestampEnforcerValue, } from "./evm-caveats.js";
+const SIGN712_METAMASK_ALLOWED_ACTIONS = [
+    EvmActionOperation.Budget,
+    EvmActionOperation.Wrap,
+    EvmActionOperation.Hook,
+    EvmActionOperation.GasCompensation,
+];
+export function validateSign712MetaMaskActions(actions, basePath, realChainId, quoteMode, expirationTimestamp, srcChainAuthorityAddress) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        if (action.type !== EvmActionKind.Sign712MetaMask)
+            continue;
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        const data = action.data;
+        // CRITICAL: `data` must be present and contain `domain` and `message`
+        if (!data || !data.domain || !data.message) {
+            violations.push({
+                code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
+                message: `Sign712MetaMask data is missing domain or message`,
+                path: `${actionPath}.data`,
+                actual: data,
+            });
+            continue;
+        }
+        violations.push(...validateSign712TransactionCalls(action, actionPath), ...validateSign712AllowedActions(action, actionPath), ...validateSign712Domain(data, actionPath, realChainId), ...validateSign712Delegator(data, actionPath, realChainId, quoteMode, srcChainAuthorityAddress));
+        const caveats = (data.message.caveats ?? []);
+        violations.push(...validateSign712MetaMaskCaveats(caveats, action, actionPath, realChainId, expirationTimestamp));
+    }
+    return violations;
+}
+// CRITICAL: transactionCalls must have at least one element
+function validateSign712TransactionCalls(action, actionPath) {
+    const txCalls = action.details?.transactionCalls ?? [];
+    if (txCalls.length === 0) {
+        return [{
+                code: ViolationCode.Sign712MetaMaskEmptyTransactionCalls,
+                message: `Sign712MetaMask must have at least one transactionCall`,
+                path: `${actionPath}.details.transactionCalls`,
+                actual: txCalls,
+            }];
+    }
+    return [];
+}
+// HIGH: actions[] can only contain items from the allowed list
+function validateSign712AllowedActions(action, actionPath) {
+    const violations = [];
+    for (const op of action.actions) {
+        if (!SIGN712_METAMASK_ALLOWED_ACTIONS.includes(op)) {
+            violations.push({
+                code: ViolationCode.Sign712MetaMaskForbiddenAction,
+                message: `Sign712MetaMask action "${op}" is not allowed`,
+                path: `${actionPath}.actions`,
+                expected: SIGN712_METAMASK_ALLOWED_ACTIONS,
+                actual: action.actions,
+            });
+        }
+    }
+    return violations;
+}
+// CRITICAL: domain.name must be "DelegationManager"
+// CRITICAL: domain.chainId must equal the real chainId
+// CRITICAL: domain.verifyingContract must be in the DelegationManager whitelist
+function validateSign712Domain(data, actionPath, realChainId) {
+    const violations = [];
+    if (data.domain.name !== "DelegationManager") {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskDomainNameNotDelegationManager,
+            message: `Sign712MetaMask domain.name must be "DelegationManager"`,
+            path: `${actionPath}.data.domain.name`,
+            expected: "DelegationManager",
+            actual: data.domain.name,
+        });
+    }
+    if (data.domain.chainId !== realChainId) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskChainIdMismatch,
+            message: `Sign712MetaMask domain.chainId does not match the real chainId`,
+            path: `${actionPath}.data.domain.chainId`,
+            expected: realChainId,
+            actual: data.domain.chainId,
+        });
+    }
+    if (data.domain.verifyingContract === undefined ||
+        !isWhitelisted(DELEGATION_MANAGER_CONTRACTS, realChainId, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskVerifyingContractNotWhitelisted,
+            message: `Sign712MetaMask domain.verifyingContract is not whitelisted`,
+            path: `${actionPath}.data.domain.verifyingContract`,
+            actual: data.domain.verifyingContract,
+        });
+    }
+    return violations;
+}
+// LOW: in execution mode, message.delegator must match srcChainAuthorityAddress
+function validateSign712Delegator(data, actionPath, realChainId, quoteMode, srcChainAuthorityAddress) {
+    if (quoteMode)
+        return [];
+    const delegator = data.message.delegator;
+    if (srcChainAuthorityAddress === undefined ||
+        delegator === undefined ||
+        !addressEquals(realChainId, delegator, srcChainAuthorityAddress)) {
+        return [{
+                code: ViolationCode.Sign712MetaMaskDelegatorMismatch,
+                message: `Sign712MetaMask message.delegator must match srcChainAuthorityAddress`,
+                path: `${actionPath}.data.message.delegator`,
+                expected: srcChainAuthorityAddress,
+                actual: delegator,
+            }];
+    }
+    return [];
+}
+function validateSign712MetaMaskCaveats(caveats, action, actionPath, realChainId, expirationTimestamp) {
+    const violations = [];
+    const classified = classifyCaveats(caveats, action.actionId, actionPath, realChainId, violations);
+    const txCalls = action.details?.transactionCalls ?? [];
+    violations.push(...validateExactExecutionPresence(classified, txCalls, actionPath));
+    validateExactExecutionContent(classified, txCalls, actionPath, violations);
+    // CRITICAL: must have at least one IdEnforcer caveat (replay protection)
+    if (!classified.hasIdEnforcer) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskMissingIdEnforcerCaveat,
+            message: `Sign712MetaMask must have an IdEnforcer caveat`,
+            path: `${actionPath}.data.message.caveats`,
+        });
+    }
+    // CRITICAL: must have exactly one TimestampEnforcer caveat
+    if (classified.timestampCount === 0) {
+        violations.push({
+            code: ViolationCode.Sign712MetaMaskMissingTimestampEnforcerCaveat,
+            message: `Sign712MetaMask must have a TimestampEnforcer caveat`,
+            path: `${actionPath}.data.message.caveats`,
+        });
+    }
+    if (classified.firstTimestamp) {
+        validateTimestampEnforcerValue(classified.firstTimestamp.caveat, expirationTimestamp, classified.firstTimestamp.index, actionPath, violations);
+    }
+    return violations;
+}
+//# sourceMappingURL=evm-sign712-metamask.js.map

package/dist/esm/validations/evm-sign712-metamask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-sign712-metamask.js","sourceRoot":"","sources":["../../../src/validations/evm-sign712-metamask.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,eAAe,EACf,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,GACjC,MAAM,eAAe,CAAC;AAEvB,MAAM,gCAAgC,GAAkC;IACpE,kBAAkB,CAAC,MAAM;IACzB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,IAAI;IACvB,kBAAkB,CAAC,eAAe;CACrC,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAC1C,OAA4B,EAC5B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,mBAA2B,EAC3B,wBAAiC;IAEjC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,eAAe;YAAE,SAAS;QAE5D,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAkC,CAAC;QAEvD,sEAAsE;QACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;gBACjE,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,UAAU,CAAC,IAAI,CACX,GAAG,+BAA+B,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,6BAA6B,CAAC,MAAM,EAAE,UAAU,CAAC,EACpD,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EACvD,GAAG,wBAAwB,CACvB,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACrE,CACJ,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAa,CAAC;QACzD,UAAU,CAAC,IAAI,CACX,GAAG,8BAA8B,CAC7B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,CAChE,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,4DAA4D;AAC5D,SAAS,+BAA+B,CACpC,MAAyB,EACzB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oCAAoC;gBACxD,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,GAAG,UAAU,2BAA2B;gBAC9C,MAAM,EAAE,OAAO;aAClB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,6BAA6B,CAClC,MAAyB,EACzB,UAAkB;IAElB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,2BAA2B,EAAE,kBAAkB;gBACxD,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,oDAAoD;AACpD,uDAAuD;AACvD,gFAAgF;AAChF,SAAS,qBAAqB,CAC1B,IAAoB,EACpB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;YACjE,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,GAAG,UAAU,mBAAmB;YACtC,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;YAClD,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CACV,4BAA4B,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC3E,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8CAA8C;YAClE,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,SAAS,wBAAwB,CAC7B,IAAoB,EACpB,UAAkB,EAClB,WAAoB,EACpB,SAAkB,EAClB,wBAAiC;IAEjC,IAAI,SAAS;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAA+B,CAAC;IAC/D,IACI,wBAAwB,KAAK,SAAS;QACtC,SAAS,KAAK,SAAS;QACvB,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,wBAAwB,CAAC,EAClE,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,GAAG,UAAU,yBAAyB;gBAC5C,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CACnC,OAAiB,EACjB,MAAyB,EACzB,UAAkB,EAClB,WAAoB,EACpB,mBAA2B;IAE3B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,eAAe,CAC9B,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAChE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAEvD,UAAU,CAAC,IAAI,CACX,GAAG,8BAA8B,CAC7B,UAAU,EAAE,OAAO,EAAE,UAAU,CAClC,CACJ,CAAC;IAEF,6BAA6B,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAE3E,yEAAyE;IACzE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,sCAAsC;YAC1D,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,GAAG,UAAU,uBAAuB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,2DAA2D;IAC3D,IAAI,UAAU,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,6CAA6C;YACjE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,GAAG,UAAU,uBAAuB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAC5B,8BAA8B,CAC1B,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,mBAAmB,EACrD,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAC1D,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/esm/validations/evm-sign712.js

@@ -0,0 +1,200 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { computeIntentId } from "../helpers/evm-intent-id.js";
+// =============================================
+// Sign712 (Intent) constraints
+// =============================================
+const EXPECTED_TYPES = {
+    EIP712Domain: [
+        { name: "name", type: "string" },
+        { name: "version", type: "string" },
+        { name: "chainId", type: "uint256" },
+        { name: "verifyingContract", type: "address" },
+    ],
+    SignedIntent: [
+        { name: "intentId", type: "bytes32" },
+    ],
+};
+export function validateSign712IntentActions(actions, basePath, realChainId, intent, envConfig) {
+    const intentActions = findSign712IntentActions(actions);
+    const violations = [];
+    // HIGH: each intent must have exactly one Sign712 Intent action
+    violations.push(...validateSign712IntentCount(intentActions, basePath));
+    for (const { action, index } of intentActions) {
+        const actionPath = `${basePath}.requiredActions[${index}]`;
+        const data = action.data;
+        violations.push(...validateSign712IntentActionsList(action, actionPath), ...validateSign712IntentPrimaryType(data, actionPath), ...validateSign712IntentDomain(data, actionPath, realChainId, envConfig), ...validateSign712IntentTypes(data, actionPath), ...validateSign712IntentId(data, actionPath, intent));
+    }
+    return violations;
+}
+function findSign712IntentActions(actions) {
+    const result = [];
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        if (action.type === EvmActionKind.Sign712 &&
+            action.actions.includes(EvmActionOperation.Intent)) {
+            result.push({ action, index: i });
+        }
+    }
+    return result;
+}
+// HIGH: each intent must have exactly one Sign712 Intent action
+function validateSign712IntentCount(intentActions, basePath) {
+    if (intentActions.length === 0) {
+        return [{
+                code: ViolationCode.Sign712IntentMissing,
+                message: `each intent must have exactly one Sign712 Intent action`,
+                path: `${basePath}.requiredActions`,
+                expected: 1,
+                actual: 0,
+            }];
+    }
+    else if (intentActions.length > 1) {
+        return [{
+                code: ViolationCode.Sign712IntentDuplicate,
+                message: `each intent must have exactly one Sign712 Intent action, found ${intentActions.length}`,
+                path: `${basePath}.requiredActions`,
+                expected: 1,
+                actual: intentActions.length,
+            }];
+    }
+    return [];
+}
+// HIGH: actions[] must contain exactly [Intent]
+function validateSign712IntentActionsList(action, actionPath) {
+    if (action.actions.length !== 1 ||
+        action.actions[0] !== EvmActionOperation.Intent) {
+        return [{
+                code: ViolationCode.Sign712IntentActionsNotSingleIntent,
+                message: `Sign712 Intent actions must contain exactly [Intent]`,
+                path: `${actionPath}.actions`,
+                expected: [EvmActionOperation.Intent],
+                actual: action.actions,
+            }];
+    }
+    return [];
+}
+// HIGH: primaryType must be "SignedIntent"
+function validateSign712IntentPrimaryType(data, actionPath) {
+    if (data.primaryType !== "SignedIntent") {
+        return [{
+                code: ViolationCode.Sign712IntentPrimaryTypeInvalid,
+                message: `Sign712 Intent primaryType must be "SignedIntent"`,
+                path: `${actionPath}.data.primaryType`,
+                expected: "SignedIntent",
+                actual: data.primaryType,
+            }];
+    }
+    return [];
+}
+// CRITICAL: domain.name must be "DeBridgeIntentManager"
+// LOW: domain.version must be "1" or undefined
+// CRITICAL: domain.chainId must equal real chainId
+// CRITICAL: domain.verifyingContract must be whitelisted
+function validateSign712IntentDomain(data, actionPath, realChainId, envConfig) {
+    const violations = [];
+    // CRITICAL: domain.name must be "DeBridgeIntentManager"
+    if (data.domain.name !== "DeBridgeIntentManager") {
+        violations.push({
+            code: ViolationCode.Sign712IntentDomainNameInvalid,
+            message: `Sign712 Intent domain.name must be "DeBridgeIntentManager"`,
+            path: `${actionPath}.data.domain.name`,
+            expected: "DeBridgeIntentManager",
+            actual: data.domain.name,
+        });
+    }
+    // LOW: domain.version must be "1" or undefined
+    if (data.domain.version !== undefined &&
+        data.domain.version !== "1") {
+        violations.push({
+            code: ViolationCode.Sign712IntentDomainVersionInvalid,
+            message: `Sign712 Intent domain.version must be "1" or undefined`,
+            path: `${actionPath}.data.domain.version`,
+            expected: "1",
+            actual: data.domain.version,
+        });
+    }
+    // CRITICAL: domain.chainId must equal real chainId
+    if (data.domain.chainId !== realChainId) {
+        violations.push({
+            code: ViolationCode.Sign712IntentChainIdMismatch,
+            message: `Sign712 Intent domain.chainId does not match the real chainId`,
+            path: `${actionPath}.data.domain.chainId`,
+            expected: realChainId,
+            actual: data.domain.chainId,
+        });
+    }
+    // CRITICAL: domain.verifyingContract must be whitelisted
+    if (data.domain.verifyingContract === undefined ||
+        !isWhitelisted(envConfig.intentManagerContracts, realChainId, data.domain.verifyingContract)) {
+        violations.push({
+            code: ViolationCode.Sign712IntentVerifyingContractNotWhitelisted,
+            message: `Sign712 Intent domain.verifyingContract is not whitelisted`,
+            path: `${actionPath}.data.domain.verifyingContract`,
+            actual: data.domain.verifyingContract,
+        });
+    }
+    return violations;
+}
+// CRITICAL: types must match the expected EIP712 structure
+function validateSign712IntentTypes(data, actionPath) {
+    const types = data.types;
+    const keys = Object.keys(types).sort();
+    const expectedKeys = Object.keys(EXPECTED_TYPES).sort();
+    if (keys.length !== expectedKeys.length ||
+        !keys.every((k, i) => k === expectedKeys[i]) ||
+        !typesMatch(types)) {
+        return [{
+                code: ViolationCode.Sign712IntentTypesInvalid,
+                message: `Sign712 Intent types must match the expected EIP712 structure`,
+                path: `${actionPath}.data.types`,
+                expected: EXPECTED_TYPES,
+                actual: types,
+            }];
+    }
+    return [];
+}
+function typesMatch(types) {
+    for (const [key, expectedFields] of Object.entries(EXPECTED_TYPES)) {
+        const actualFields = types[key];
+        if (!actualFields)
+            return false;
+        if (actualFields.length !== expectedFields.length)
+            return false;
+        for (let i = 0; i < expectedFields.length; i++) {
+            if (actualFields[i].name !== expectedFields[i].name ||
+                actualFields[i].type !== expectedFields[i].type) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+// CRITICAL: message.intentId must equal computed intent ID
+function validateSign712IntentId(data, actionPath, intent) {
+    const messageIntentId = data.message.intentId;
+    let computed;
+    try {
+        computed = computeIntentId(intent);
+    }
+    catch (e) {
+        return [{
+                code: ViolationCode.Sign712IntentIdComputeError,
+                message: `failed to compute intent ID`,
+                path: `${actionPath}.data.message.intentId`,
+                actual: messageIntentId,
+                details: e,
+            }];
+    }
+    if (messageIntentId !== computed) {
+        return [{
+                code: ViolationCode.Sign712IntentIdMismatch,
+                message: `Sign712 Intent message.intentId does not match computed intent ID`,
+                path: `${actionPath}.data.message.intentId`,
+                expected: computed,
+                actual: messageIntentId,
+            }];
+    }
+    return [];
+}
+//# sourceMappingURL=evm-sign712.js.map

package/dist/esm/validations/evm-sign712.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-sign712.js","sourceRoot":"","sources":["../../../src/validations/evm-sign712.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAIrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,gDAAgD;AAChD,+BAA+B;AAC/B,gDAAgD;AAEhD,MAAM,cAAc,GAAG;IACnB,YAAY,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACjD;IACD,YAAY,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;KACxC;CACJ,CAAC;AAEF,MAAM,UAAU,4BAA4B,CACxC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB,EACpB,MAAsB,EACtB,SAA4B;IAE5B,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,CACX,GAAG,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,CACzD,CAAC;IAEF,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,KAAK,GAAG,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsB,CAAC;QAE3C,UAAU,CAAC,IAAI,CACX,GAAG,gCAAgC,CAAC,MAAM,EAAE,UAAU,CAAC,EACvD,GAAG,gCAAgC,CAAC,IAAI,EAAE,UAAU,CAAC,EACrD,GAAG,2BAA2B,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,EACxE,GAAG,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,EAC/C,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CACvD,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAID,SAAS,wBAAwB,CAC7B,OAA4B;IAE5B,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IACI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,OAAO;YACrC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,EACpD,CAAC;YACC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAS,0BAA0B,CAC/B,aAA8B,EAC9B,QAAgB;IAEhB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO,EAAE,yDAAyD;gBAClE,IAAI,EAAE,GAAG,QAAQ,kBAAkB;gBACnC,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,CAAC;aACZ,CAAC,CAAC;IACP,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,sBAAsB;gBAC1C,OAAO,EAAE,kEAAkE,aAAa,CAAC,MAAM,EAAE;gBACjG,IAAI,EAAE,GAAG,QAAQ,kBAAkB;gBACnC,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,aAAa,CAAC,MAAM;aAC/B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,gCAAgC,CACrC,MAAyB,EACzB,UAAkB;IAElB,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,MAAM,EACjD,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,mCAAmC;gBACvD,OAAO,EAAE,sDAAsD;gBAC/D,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,2CAA2C;AAC3C,SAAS,gCAAgC,CACrC,IAAoB,EACpB,UAAkB;IAElB,IAAI,IAAI,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,+BAA+B;gBACnD,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,GAAG,UAAU,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,+CAA+C;AAC/C,mDAAmD;AACnD,yDAAyD;AACzD,SAAS,2BAA2B,CAChC,IAAoB,EACpB,UAAkB,EAClB,WAAoB,EACpB,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,wDAAwD;IACxD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;YAClD,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,GAAG,UAAU,mBAAmB;YACtC,QAAQ,EAAE,uBAAuB;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACP,CAAC;IAED,+CAA+C;IAC/C,IACI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,GAAG,EAC7B,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,iCAAiC;YACrD,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,4BAA4B;YAChD,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,GAAG,UAAU,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,yDAAyD;IACzD,IACI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAC3C,CAAC,aAAa,CACV,SAAS,CAAC,sBAAsB,EAChC,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,EACH,CAAC;QACC,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,4CAA4C;YAChE,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,GAAG,UAAU,gCAAgC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;SACxC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,2DAA2D;AAC3D,SAAS,0BAA0B,CAC/B,IAAoB,EACpB,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IAExD,IACI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACnC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,UAAU,CAAC,KAAK,CAAC,EACpB,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,yBAAyB;gBAC7C,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,GAAG,UAAU,aAAa;gBAChC,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACf,KAAuD;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IACI,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC/C,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACjD,CAAC;gBACC,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,SAAS,uBAAuB,CAC5B,IAAoB,EACpB,UAAkB,EAClB,MAAsB;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAA8B,CAAC;IAEpE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACD,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,OAAO,EAAE,6BAA6B;gBACtC,IAAI,EAAE,GAAG,UAAU,wBAAwB;gBAC3C,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,CAAC;aACb,CAAC,CAAC;IACP,CAAC;IAED,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,uBAAuB;gBAC3C,OAAO,EAAE,mEAAmE;gBAC5E,IAAI,EAAE,GAAG,UAAU,wBAAwB;gBAC3C,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,eAAe;aAC1B,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC"}

package/dist/esm/validations/evm-sign7702.js

@@ -0,0 +1,56 @@
+import { ViolationCode, EvmActionKind, EvmActionOperation, } from "../types/index.js";
+import { isWhitelisted } from "../whitelists/types.js";
+import { EIP7702_DELEGATION_CONTRACTS } from "../whitelists/evm/index.js";
+// =============================================
+// Sign7702Authorization constraints
+// =============================================
+export function validateSign7702Actions(actions, basePath, realChainId) {
+    const violations = [];
+    let sign7702Count = 0;
+    let firstSign7702Index = -1;
+    for (let i = 0; i < actions.length; i++) {
+        const action = actions[i];
+        if (action.type !== EvmActionKind.Sign7702Authorization)
+            continue;
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        // HIGH: actions[] must contain exactly one element — Delegate
+        if (action.actions.length !== 1 ||
+            action.actions[0] !== EvmActionOperation.Delegate) {
+            violations.push({
+                code: ViolationCode.Sign7702ActionsNotSingleDelegate,
+                message: `Sign7702Authorization actions must contain exactly [Delegate]`,
+                path: `${actionPath}.actions`,
+                expected: [EvmActionOperation.Delegate],
+                actual: action.actions,
+            });
+        }
+        // CRITICAL: data.contractAddress must be in the whitelist
+        const data = action.data;
+        const contractAddress = data?.contractAddress;
+        if (!contractAddress || !isWhitelisted(EIP7702_DELEGATION_CONTRACTS, realChainId, contractAddress)) {
+            violations.push({
+                code: ViolationCode.Sign7702ContractAddressNotWhitelisted,
+                message: `Sign7702Authorization contractAddress is not in the whitelist`,
+                path: `${actionPath}.data.contractAddress`,
+                actual: contractAddress,
+            });
+        }
+        // HIGH: at most one Sign7702Authorization per intent
+        // Note: only the first duplicate will be reported, subsequent ones will be ignored
+        sign7702Count++;
+        if (sign7702Count === 1) {
+            firstSign7702Index = i;
+        }
+        else if (sign7702Count === 2) {
+            violations.push({
+                code: ViolationCode.DuplicateSign7702Authorization,
+                message: `at most one Sign7702Authorization per intent, found at indices ${firstSign7702Index} and ${i}`,
+                path: `${actionPath}.type`,
+                expected: 1,
+                actual: sign7702Count,
+            });
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=evm-sign7702.js.map

package/dist/esm/validations/evm-sign7702.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-sign7702.js","sourceRoot":"","sources":["../../../src/validations/evm-sign7702.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,EAEb,aAAa,EACb,kBAAkB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,gDAAgD;AAChD,oCAAoC;AACpC,gDAAgD;AAEhD,MAAM,UAAU,uBAAuB,CACnC,OAA4B,EAC5B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,qBAAqB;YAAE,SAAS;QAElE,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QAEvD,8DAA8D;QAC9D,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,QAAQ,EACnD,CAAC;YACC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,gCAAgC;gBACpD,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;gBACvC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;QACP,CAAC;QAED,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAgD,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;QAC9C,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,4BAA4B,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;YACjG,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,qCAAqC;gBACzD,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,GAAG,UAAU,uBAAuB;gBAC1C,MAAM,EAAE,eAAe;aAC1B,CAAC,CAAC;QACP,CAAC;QAED,qDAAqD;QACrD,mFAAmF;QACnF,aAAa,EAAE,CAAC;QAChB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACtB,kBAAkB,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,kEAAkE,kBAAkB,QAAQ,CAAC,EAAE;gBACxG,IAAI,EAAE,GAAG,UAAU,OAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,aAAa;aACxB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}