@dev.sail.money/sailor 0.1.0-local → 1.0.0-39

package/examples/permissions/BoundedSupply_AaveV3_Arbitrum.sol

@@ -1,82 +1,82 @@
-// SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Protocol : Aave V3
-// Version  : Pool (proxy) — fully on-chain, oracle-based accounting
-// Chain    : Arbitrum mainnet (42161)
-// Target   : Aave V3 Pool  0x794a61358D6845594F94dc1DB02A252b5b4814aD  (verified on Arbiscan;
-//            same Pool as BoundedBorrow_AaveV3_Arbitrum — supply 0x617ba037 confirmed present
-//            in the live implementation 0xf05fd3cc...)
-//
-// ENFORCES ON-CHAIN (kernel calls evaluate() on every dispatch; false ⇒ dispatch blocked):
-//   supply(address asset,uint256 amount,address onBehalfOf,uint16 referralCode)  selector 0x617ba037
-//     • target must be AAVE_POOL
-//     • asset must be in ALLOWED_ASSETS
-//     • amount ≤ MAX_SUPPLY_AMOUNT
-//     • onBehalfOf must equal ctx.account (the SMA — collateral is credited to the SMA, not
-//       to another account)
-//
-// AGENT-ENFORCED / NOT BOUNDED HERE (off-chain — can change without redeploying this contract):
-//   • referralCode (informational only, does not affect fund safety)
-//   • Supply timing / cadence and choice of asset within ALLOWED_ASSETS
-//   • Withdrawal: not gated here (add a withdraw(asset,amount,to) permission with to==SMA if needed)
-//   • A supply also needs a prior ERC-20 approve of the Pool — gate that separately
-//     (see BoundedApproveAndCallBatch.sol for the atomic approve→call→reset pattern).
-//
-// VERIFY BEFORE USE:
-//   • Selector 0x617ba037 = supply(address,uint256,address,uint16) — verified via `cast sig`
-//     and confirmed present in the deployed Pool implementation on Arbitrum.
-//   • This is the canonical Aave V3 Pool.supply. (V3.x also exposes supplyWithPermit — not
-//     gated here; add it if your agent supplies via EIP-2612 permits.)
-//   • MAX_SUPPLY_AMOUNT is in the asset's base units (e.g. USDC = 6 decimals).
-// ─────────────────────────────────────────────────────────────────────────────
-
-import {IPermission, Context} from "@sail/interfaces/IPermission.sol";
-import {SailCalldata} from "./SailCalldata.sol";
-
-contract BoundedSupply_AaveV3_Arbitrum is IPermission {
-    bytes32 private constant DISCRIMINATOR = keccak256("BoundedSupply_AaveV3_Arbitrum");
-
-    address public immutable AAVE_POOL;
-    mapping(address => bool) public isAllowedAsset;
-    uint256 public immutable MAX_SUPPLY_AMOUNT;
-
-    // supply(address,uint256,address,uint16) — verified 0x617ba037
-    bytes4 private constant SEL_SUPPLY = 0x617ba037;
-
-    /// @param aavePool         Aave V3 Pool proxy address
-    /// @param allowedAssets    Assets the agent may supply (must be non-empty)
-    /// @param maxSupplyAmount  Per-call supply cap in asset base units (must be > 0)
-    constructor(address aavePool, address[] memory allowedAssets, uint256 maxSupplyAmount) {
-        require(aavePool != address(0),      "zero pool address");
-        require(allowedAssets.length > 0,    "empty asset allowlist");
-        require(maxSupplyAmount > 0,         "zero supply cap");
-        AAVE_POOL        = aavePool;
-        MAX_SUPPLY_AMOUNT = maxSupplyAmount;
-        for (uint256 i = 0; i < allowedAssets.length; i++) {
-            require(allowedAssets[i] != address(0), "zero asset address");
-            isAllowedAsset[allowedAssets[i]] = true;
-        }
-    }
-
-    function evaluate(bytes calldata txData, Context calldata ctx) external view returns (bool) {
-        if (ctx.target != AAVE_POOL)    return false;
-        if (ctx.selector != SEL_SUPPLY) return false;
-        // supply(address asset, uint256 amount, address onBehalfOf, uint16 referralCode)
-        if (!SailCalldata.hasParams(txData, 4)) return false;
-
-        address asset      = SailCalldata.asAddress(txData, 0);
-        uint256 amount     = SailCalldata.asUint256(txData, 1);
-        address onBehalfOf = SailCalldata.asAddress(txData, 2);
-        // slot 3 = referralCode (uint16) — informational, not bounded
-
-        if (!isAllowedAsset[asset])       return false;
-        if (amount > MAX_SUPPLY_AMOUNT)   return false;
-        if (onBehalfOf != ctx.account)    return false; // collateral credited only to the SMA
-
-        return true;
-    }
-
-    function discriminator() external pure returns (bytes32) { return DISCRIMINATOR; }
-}
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.26;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Protocol : Aave V3
+// Version  : Pool (proxy) — fully on-chain, oracle-based accounting
+// Chain    : Arbitrum mainnet (42161)
+// Target   : Aave V3 Pool  0x794a61358D6845594F94dc1DB02A252b5b4814aD  (verified on Arbiscan;
+//            same Pool as BoundedBorrow_AaveV3_Arbitrum — supply 0x617ba037 confirmed present
+//            in the live implementation 0xf05fd3cc...)
+//
+// ENFORCES ON-CHAIN (kernel calls evaluate() on every dispatch; false ⇒ dispatch blocked):
+//   supply(address asset,uint256 amount,address onBehalfOf,uint16 referralCode)  selector 0x617ba037
+//     • target must be AAVE_POOL
+//     • asset must be in ALLOWED_ASSETS
+//     • amount ≤ MAX_SUPPLY_AMOUNT
+//     • onBehalfOf must equal ctx.account (the SMA — collateral is credited to the SMA, not
+//       to another account)
+//
+// AGENT-ENFORCED / NOT BOUNDED HERE (off-chain — can change without redeploying this contract):
+//   • referralCode (informational only, does not affect fund safety)
+//   • Supply timing / cadence and choice of asset within ALLOWED_ASSETS
+//   • Withdrawal: not gated here (add a withdraw(asset,amount,to) permission with to==SMA if needed)
+//   • A supply also needs a prior ERC-20 approve of the Pool — gate that separately
+//     (see BoundedApproveAndCallBatch.sol for the atomic approve→call→reset pattern).
+//
+// VERIFY BEFORE USE:
+//   • Selector 0x617ba037 = supply(address,uint256,address,uint16) — verified via `cast sig`
+//     and confirmed present in the deployed Pool implementation on Arbitrum.
+//   • This is the canonical Aave V3 Pool.supply. (V3.x also exposes supplyWithPermit — not
+//     gated here; add it if your agent supplies via EIP-2612 permits.)
+//   • MAX_SUPPLY_AMOUNT is in the asset's base units (e.g. USDC = 6 decimals).
+// ─────────────────────────────────────────────────────────────────────────────
+
+import {IPermission, Context} from "@sail/interfaces/IPermission.sol";
+import {SailCalldata} from "./SailCalldata.sol";
+
+contract BoundedSupply_AaveV3_Arbitrum is IPermission {
+    bytes32 private constant DISCRIMINATOR = keccak256("BoundedSupply_AaveV3_Arbitrum");
+
+    address public immutable AAVE_POOL;
+    mapping(address => bool) public isAllowedAsset;
+    uint256 public immutable MAX_SUPPLY_AMOUNT;
+
+    // supply(address,uint256,address,uint16) — verified 0x617ba037
+    bytes4 private constant SEL_SUPPLY = 0x617ba037;
+
+    /// @param aavePool         Aave V3 Pool proxy address
+    /// @param allowedAssets    Assets the agent may supply (must be non-empty)
+    /// @param maxSupplyAmount  Per-call supply cap in asset base units (must be > 0)
+    constructor(address aavePool, address[] memory allowedAssets, uint256 maxSupplyAmount) {
+        require(aavePool != address(0),      "zero pool address");
+        require(allowedAssets.length > 0,    "empty asset allowlist");
+        require(maxSupplyAmount > 0,         "zero supply cap");
+        AAVE_POOL        = aavePool;
+        MAX_SUPPLY_AMOUNT = maxSupplyAmount;
+        for (uint256 i = 0; i < allowedAssets.length; i++) {
+            require(allowedAssets[i] != address(0), "zero asset address");
+            isAllowedAsset[allowedAssets[i]] = true;
+        }
+    }
+
+    function evaluate(bytes calldata txData, Context calldata ctx) external view returns (bool) {
+        if (ctx.target != AAVE_POOL)    return false;
+        if (ctx.selector != SEL_SUPPLY) return false;
+        // supply(address asset, uint256 amount, address onBehalfOf, uint16 referralCode)
+        if (!SailCalldata.hasParams(txData, 4)) return false;
+
+        address asset      = SailCalldata.asAddress(txData, 0);
+        uint256 amount     = SailCalldata.asUint256(txData, 1);
+        address onBehalfOf = SailCalldata.asAddress(txData, 2);
+        // slot 3 = referralCode (uint16) — informational, not bounded
+
+        if (!isAllowedAsset[asset])       return false;
+        if (amount > MAX_SUPPLY_AMOUNT)   return false;
+        if (onBehalfOf != ctx.account)    return false; // collateral credited only to the SMA
+
+        return true;
+    }
+
+    function discriminator() external pure returns (bytes32) { return DISCRIMINATOR; }
+}

package/examples/permissions/BoundedSwap_UniswapV3_Base.sol

@@ -1,116 +1,116 @@
-// SPDX-License-Identifier: MIT
-pragma solidity 0.8.26;
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Protocol : Uniswap V3
-// Version  : SwapRouter02 (NOT the older SwapRouter — different selectors)
-// Chain    : Base mainnet (8453)
-// Target   : SwapRouter02  0x2626664c2603336E57B271c5C0b26F421741e481  (verified on Basescan)
-//
-// ENFORCES ON-CHAIN (kernel calls evaluate() on every dispatch; false ⇒ dispatch blocked):
-//   exactInputSingle((address,address,uint24,address,uint256,uint256,uint160))  selector 0x04e45aaf
-//     • target must be SWAP_ROUTER
-//     • tokenIn  must equal FIXED_TOKEN_IN
-//     • tokenOut must be in ALLOWED_TOKENS_OUT
-//     • amountIn ≤ MAX_AMOUNT_IN
-//     • amountOutMinimum ≥ amountIn × MIN_BPS / 10 000  (slippage floor — see caveat below)
-//   approve(address,uint256)  selector 0x095ea7b3
-//     • target must be FIXED_TOKEN_IN (the ERC-20 being approved)
-//     • spender must be SWAP_ROUTER
-//     • amount  ≤ MAX_AMOUNT_IN
-//
-// AGENT-ENFORCED / NOT BOUNDED HERE (off-chain — can change without redeploying this contract):
-//   • fee tier, sqrtPriceLimitX96, recipient address
-//   • swap frequency / cadence
-//   • real (cross-denomination) slippage — see MIN_BPS caveat in evaluate()
-//
-// VERIFY BEFORE USE:
-//   • Confirm SwapRouter02 address on your chain (Base default shown above; verified on Basescan).
-//   • Selector 0x04e45aaf = exactInputSingle((address,address,uint24,address,uint256,uint256,uint160))
-//     on SwapRouter02 (verified via `cast sig`). The OLDER SwapRouter's exactInputSingle (the
-//     deadline variant) is 0x414bf389 — a different selector; do not confuse the two.
-//   • Confirm that amountOutMinimum slippage floor fits your price-impact expectations for the
-//     chosen pool. Large amountIn values may trigger price impact beyond MIN_BPS.
-// ─────────────────────────────────────────────────────────────────────────────
-
-import {IPermission, Context} from "@sail/interfaces/IPermission.sol";
-
-contract BoundedSwap_UniswapV3_Base is IPermission {
-    bytes32 private constant DISCRIMINATOR = keccak256("BoundedSwap_UniswapV3_Base");
-
-    address public immutable SWAP_ROUTER;
-    address public immutable FIXED_TOKEN_IN;
-    mapping(address => bool) public isAllowedTokenOut;
-    uint256 public immutable MAX_AMOUNT_IN;
-    /// @dev Slippage floor in basis points. 9 900 = allow at most 1% slippage.
-    uint256 public immutable MIN_BPS;
-
-    bytes4 private constant SEL_EXACT_INPUT_SINGLE = 0x04e45aaf;
-    bytes4 private constant SEL_APPROVE            = 0x095ea7b3;
-
-    struct ExactInputSingleParams {
-        address tokenIn;
-        address tokenOut;
-        uint24  fee;
-        address recipient;
-        uint256 amountIn;
-        uint256 amountOutMinimum;
-        uint160 sqrtPriceLimitX96;
-    }
-
-    /// @param swapRouter      SwapRouter02 address (0x2626... on Base)
-    /// @param fixedTokenIn    The one token the agent is allowed to sell
-    /// @param allowedTokensOut  Tokens the agent may receive
-    /// @param maxAmountIn     Per-call spend cap in fixedTokenIn base units
-    /// @param minBps          Minimum amountOutMinimum as fraction of amountIn ×10 000
-    ///                        e.g. 9900 → require amountOutMinimum ≥ 99% of amountIn
-    ///                        (denominated in fixedTokenIn units, not USD — set per your pair)
-    constructor(
-        address swapRouter,
-        address fixedTokenIn,
-        address[] memory allowedTokensOut,
-        uint256 maxAmountIn,
-        uint256 minBps
-    ) {
-        require(minBps <= 10_000, "minBps > 10000");
-        SWAP_ROUTER    = swapRouter;
-        FIXED_TOKEN_IN = fixedTokenIn;
-        MAX_AMOUNT_IN  = maxAmountIn;
-        MIN_BPS        = minBps;
-        for (uint256 i = 0; i < allowedTokensOut.length; i++) {
-            isAllowedTokenOut[allowedTokensOut[i]] = true;
-        }
-    }
-
-    function evaluate(bytes calldata txData, Context calldata ctx) external view returns (bool) {
-        if (txData.length < 4) return false;
-
-        // exactInputSingle: agent swaps FIXED_TOKEN_IN for an allowed output token
-        if (ctx.target == SWAP_ROUTER && ctx.selector == SEL_EXACT_INPUT_SINGLE) {
-            if (txData.length < 4 + 7 * 32) return false;
-            ExactInputSingleParams memory p = abi.decode(txData[4:], (ExactInputSingleParams));
-            if (p.tokenIn != FIXED_TOKEN_IN)         return false;
-            if (!isAllowedTokenOut[p.tokenOut])      return false;
-            if (p.amountIn > MAX_AMOUNT_IN)          return false;
-            // Slippage floor: amountOutMinimum ≥ amountIn × MIN_BPS / 10 000.
-            // WARNING: compares tokenOut against tokenIn base units. For same-price/same-decimal
-            // pairs this maps to a slippage %. For cross-price pairs (e.g. USDC→WETH) it is
-            // trivially satisfied — real slippage is enforced by the agent off-chain, not here.
-            if (p.amountOutMinimum < (p.amountIn * MIN_BPS) / 10_000) return false;
-            return true;
-        }
-
-        // approve: agent approves the router to spend FIXED_TOKEN_IN
-        if (ctx.target == FIXED_TOKEN_IN && ctx.selector == SEL_APPROVE) {
-            if (txData.length < 4 + 2 * 32) return false;
-            (address spender, uint256 amount) = abi.decode(txData[4:], (address, uint256));
-            if (spender != SWAP_ROUTER)  return false;
-            if (amount > MAX_AMOUNT_IN)  return false;
-            return true;
-        }
-
-        return false;
-    }
-
-    function discriminator() external pure returns (bytes32) { return DISCRIMINATOR; }
-}
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.26;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Protocol : Uniswap V3
+// Version  : SwapRouter02 (NOT the older SwapRouter — different selectors)
+// Chain    : Base mainnet (8453)
+// Target   : SwapRouter02  0x2626664c2603336E57B271c5C0b26F421741e481  (verified on Basescan)
+//
+// ENFORCES ON-CHAIN (kernel calls evaluate() on every dispatch; false ⇒ dispatch blocked):
+//   exactInputSingle((address,address,uint24,address,uint256,uint256,uint160))  selector 0x04e45aaf
+//     • target must be SWAP_ROUTER
+//     • tokenIn  must equal FIXED_TOKEN_IN
+//     • tokenOut must be in ALLOWED_TOKENS_OUT
+//     • amountIn ≤ MAX_AMOUNT_IN
+//     • amountOutMinimum ≥ amountIn × MIN_BPS / 10 000  (slippage floor — see caveat below)
+//   approve(address,uint256)  selector 0x095ea7b3
+//     • target must be FIXED_TOKEN_IN (the ERC-20 being approved)
+//     • spender must be SWAP_ROUTER
+//     • amount  ≤ MAX_AMOUNT_IN
+//
+// AGENT-ENFORCED / NOT BOUNDED HERE (off-chain — can change without redeploying this contract):
+//   • fee tier, sqrtPriceLimitX96, recipient address
+//   • swap frequency / cadence
+//   • real (cross-denomination) slippage — see MIN_BPS caveat in evaluate()
+//
+// VERIFY BEFORE USE:
+//   • Confirm SwapRouter02 address on your chain (Base default shown above; verified on Basescan).
+//   • Selector 0x04e45aaf = exactInputSingle((address,address,uint24,address,uint256,uint256,uint160))
+//     on SwapRouter02 (verified via `cast sig`). The OLDER SwapRouter's exactInputSingle (the
+//     deadline variant) is 0x414bf389 — a different selector; do not confuse the two.
+//   • Confirm that amountOutMinimum slippage floor fits your price-impact expectations for the
+//     chosen pool. Large amountIn values may trigger price impact beyond MIN_BPS.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import {IPermission, Context} from "@sail/interfaces/IPermission.sol";
+
+contract BoundedSwap_UniswapV3_Base is IPermission {
+    bytes32 private constant DISCRIMINATOR = keccak256("BoundedSwap_UniswapV3_Base");
+
+    address public immutable SWAP_ROUTER;
+    address public immutable FIXED_TOKEN_IN;
+    mapping(address => bool) public isAllowedTokenOut;
+    uint256 public immutable MAX_AMOUNT_IN;
+    /// @dev Slippage floor in basis points. 9 900 = allow at most 1% slippage.
+    uint256 public immutable MIN_BPS;
+
+    bytes4 private constant SEL_EXACT_INPUT_SINGLE = 0x04e45aaf;
+    bytes4 private constant SEL_APPROVE            = 0x095ea7b3;
+
+    struct ExactInputSingleParams {
+        address tokenIn;
+        address tokenOut;
+        uint24  fee;
+        address recipient;
+        uint256 amountIn;
+        uint256 amountOutMinimum;
+        uint160 sqrtPriceLimitX96;
+    }
+
+    /// @param swapRouter      SwapRouter02 address (0x2626... on Base)
+    /// @param fixedTokenIn    The one token the agent is allowed to sell
+    /// @param allowedTokensOut  Tokens the agent may receive
+    /// @param maxAmountIn     Per-call spend cap in fixedTokenIn base units
+    /// @param minBps          Minimum amountOutMinimum as fraction of amountIn ×10 000
+    ///                        e.g. 9900 → require amountOutMinimum ≥ 99% of amountIn
+    ///                        (denominated in fixedTokenIn units, not USD — set per your pair)
+    constructor(
+        address swapRouter,
+        address fixedTokenIn,
+        address[] memory allowedTokensOut,
+        uint256 maxAmountIn,
+        uint256 minBps
+    ) {
+        require(minBps <= 10_000, "minBps > 10000");
+        SWAP_ROUTER    = swapRouter;
+        FIXED_TOKEN_IN = fixedTokenIn;
+        MAX_AMOUNT_IN  = maxAmountIn;
+        MIN_BPS        = minBps;
+        for (uint256 i = 0; i < allowedTokensOut.length; i++) {
+            isAllowedTokenOut[allowedTokensOut[i]] = true;
+        }
+    }
+
+    function evaluate(bytes calldata txData, Context calldata ctx) external view returns (bool) {
+        if (txData.length < 4) return false;
+
+        // exactInputSingle: agent swaps FIXED_TOKEN_IN for an allowed output token
+        if (ctx.target == SWAP_ROUTER && ctx.selector == SEL_EXACT_INPUT_SINGLE) {
+            if (txData.length < 4 + 7 * 32) return false;
+            ExactInputSingleParams memory p = abi.decode(txData[4:], (ExactInputSingleParams));
+            if (p.tokenIn != FIXED_TOKEN_IN)         return false;
+            if (!isAllowedTokenOut[p.tokenOut])      return false;
+            if (p.amountIn > MAX_AMOUNT_IN)          return false;
+            // Slippage floor: amountOutMinimum ≥ amountIn × MIN_BPS / 10 000.
+            // WARNING: compares tokenOut against tokenIn base units. For same-price/same-decimal
+            // pairs this maps to a slippage %. For cross-price pairs (e.g. USDC→WETH) it is
+            // trivially satisfied — real slippage is enforced by the agent off-chain, not here.
+            if (p.amountOutMinimum < (p.amountIn * MIN_BPS) / 10_000) return false;
+            return true;
+        }
+
+        // approve: agent approves the router to spend FIXED_TOKEN_IN
+        if (ctx.target == FIXED_TOKEN_IN && ctx.selector == SEL_APPROVE) {
+            if (txData.length < 4 + 2 * 32) return false;
+            (address spender, uint256 amount) = abi.decode(txData[4:], (address, uint256));
+            if (spender != SWAP_ROUTER)  return false;
+            if (amount > MAX_AMOUNT_IN)  return false;
+            return true;
+        }
+
+        return false;
+    }
+
+    function discriminator() external pure returns (bytes32) { return DISCRIMINATOR; }
+}