@dev.sail.money/sailor 1.3.0-223 → 1.3.0-225

package/packages/cli/dist/index.cjs

@@ -15767,13 +15767,13 @@ var init_getCallError = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withResolvers.js
 function withResolvers() {
-  let resolve3 = () => void 0;
+  let resolve4 = () => void 0;
   let reject = () => void 0;
   const promise = new Promise((resolve_, reject_) => {
-    resolve3 = resolve_;
+    resolve4 = resolve_;
     reject = reject_;
   });
-  return { promise, resolve: resolve3, reject };
+  return { promise, resolve: resolve4, reject };
 }
 var init_withResolvers = __esm({
   "../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withResolvers.js"() {
@@ -15792,8 +15792,8 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
       if (sort && Array.isArray(data))
         data.sort(sort);
       for (let i = 0; i < scheduler.length; i++) {
-        const { resolve: resolve3 } = scheduler[i];
-        resolve3?.([data[i], data]);
+        const { resolve: resolve4 } = scheduler[i];
+        resolve4?.([data[i], data]);
       }
     }).catch((err) => {
       for (let i = 0; i < scheduler.length; i++) {
@@ -15809,16 +15809,16 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
   return {
     flush,
     async schedule(args) {
-      const { promise, resolve: resolve3, reject } = withResolvers();
+      const { promise, resolve: resolve4, reject } = withResolvers();
       const split2 = shouldSplitBatch?.([...getBatchedArgs(), args]);
       if (split2)
         exec();
       const hasActiveScheduler = getScheduler().length > 0;
       if (hasActiveScheduler) {
-        setScheduler({ args, resolve: resolve3, reject });
+        setScheduler({ args, resolve: resolve4, reject });
         return promise;
       }
-      setScheduler({ args, resolve: resolve3, reject });
+      setScheduler({ args, resolve: resolve4, reject });
       setTimeout(exec, wait2);
       return promise;
     }
@@ -16595,7 +16595,7 @@ var init_observe = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/wait.js
 async function wait(time, { signal } = {}) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     if (signal?.aborted) {
       reject(getAbortError(signal));
       return;
@@ -16603,7 +16603,7 @@ async function wait(time, { signal } = {}) {
     const cleanup = () => signal?.removeEventListener("abort", onAbort);
     const timeout = setTimeout(() => {
       cleanup();
-      resolve3();
+      resolve4();
     }, time);
     const onAbort = () => {
       clearTimeout(timeout);
@@ -17419,7 +17419,7 @@ var init_calls = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withRetry.js
 function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shouldRetry2 = () => true, signal } = {}) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const attemptRetry = async ({ count = 0 } = {}) => {
       if (signal?.aborted) {
         reject(getAbortError(signal));
@@ -17439,7 +17439,7 @@ function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shoul
       };
       try {
         const data = await fn();
-        resolve3(data);
+        resolve4(data);
       } catch (err) {
         if (signal?.aborted) {
           reject(getAbortError(signal));
@@ -17586,7 +17586,7 @@ async function sendCalls(client, parameters) {
           results.push({ reason, status: "rejected" });
         }
         if (experimental_fallbackDelay > 0)
-          await new Promise((resolve3) => setTimeout(resolve3, experimental_fallbackDelay));
+          await new Promise((resolve4) => setTimeout(resolve4, experimental_fallbackDelay));
       }
       if (results.every((r) => r.status === "rejected"))
         throw results[0].reason;
@@ -17716,9 +17716,9 @@ async function waitForCallsStatus(client, parameters) {
     throwOnFailure = false
   } = parameters;
   const observerId = stringify(["waitForCallsStatus", client.uid, id]);
-  const { promise, resolve: resolve3, reject } = withResolvers();
+  const { promise, resolve: resolve4, reject } = withResolvers();
   let timer;
-  const unobserve = observe(observerId, { resolve: resolve3, reject }, (emit2) => {
+  const unobserve = observe(observerId, { resolve: resolve4, reject }, (emit2) => {
     const unpoll = poll(async () => {
       const done = (fn) => {
         clearTimeout(timer);
@@ -18123,13 +18123,13 @@ async function isImageUri(uri) {
     }
     if (!Object.hasOwn(globalThis, "Image"))
       return false;
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const img = new Image();
       img.onload = () => {
-        resolve3(true);
+        resolve4(true);
       };
       img.onerror = () => {
-        resolve3(false);
+        resolve4(false);
       };
       img.src = uri;
     });
@@ -20077,7 +20077,7 @@ var init_nonceManager = __esm({
 
 // ../../node_modules/.pnpm/viem@2.51.3_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@5.0.10_zod@4.4.3/node_modules/viem/_esm/utils/promise/withTimeout.js
 function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     ;
     (async () => {
       let timeoutId;
@@ -20092,7 +20092,7 @@ function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, sign
             }
           }, timeout);
         }
-        resolve3(await fn({ signal: controller?.signal || null }));
+        resolve4(await fn({ signal: controller?.signal || null }));
       } catch (err) {
         if (controller?.signal.aborted && isAbortError(err)) {
           reject(errorInstance);
@@ -24137,10 +24137,10 @@ async function getWebSocketRpcClient(url, options = {}) {
       socket.addEventListener("error", onError);
       socket.addEventListener("open", onOpen);
       if (socket.readyState === WebSocket5.CONNECTING) {
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve4, reject) => {
           if (!socket)
             return;
-          socket.onopen = resolve3;
+          socket.onopen = resolve4;
           socket.onerror = reject;
         });
       }
@@ -28321,13 +28321,13 @@ async function waitForTransactionReceipt(client, parameters) {
   let retrying = false;
   let _unobserve;
   let _unwatch;
-  const { promise, resolve: resolve3, reject } = withResolvers();
+  const { promise, resolve: resolve4, reject } = withResolvers();
   const timer = timeout ? setTimeout(() => {
     _unwatch?.();
     _unobserve?.();
     reject(new WaitForTransactionReceiptTimeoutError({ hash: hash3 }));
   }, timeout) : void 0;
-  _unobserve = observe(observerId, { onReplaced, resolve: resolve3, reject }, async (emit2) => {
+  _unobserve = observe(observerId, { onReplaced, resolve: resolve4, reject }, async (emit2) => {
     receipt = await getAction(client, getTransactionReceipt, "getTransactionReceipt")({ hash: hash3 }).catch(() => void 0);
     if (receipt && confirmations <= 1) {
       clearTimeout(timer);
@@ -30586,7 +30586,7 @@ function webSocket(url, config = {}) {
       },
       async subscribe({ params, onData, onError }) {
         const rpcClient = await getWebSocketRpcClient(url_, wsRpcClientOpts);
-        const { result: subscriptionId } = await new Promise((resolve3, reject) => rpcClient.request({
+        const { result: subscriptionId } = await new Promise((resolve4, reject) => rpcClient.request({
           body: {
             method: "eth_subscribe",
             params
@@ -30603,7 +30603,7 @@ function webSocket(url, config = {}) {
               return;
             }
             if (typeof response.id === "number") {
-              resolve3(response);
+              resolve4(response);
               return;
             }
             if (response.method !== "eth_subscription")
@@ -30614,12 +30614,12 @@ function webSocket(url, config = {}) {
         return {
           subscriptionId,
           async unsubscribe() {
-            return new Promise((resolve3) => rpcClient.request({
+            return new Promise((resolve4) => rpcClient.request({
               body: {
                 method: "eth_unsubscribe",
                 params: [subscriptionId]
               },
-              onResponse: resolve3
+              onResponse: resolve4
             }));
           }
         };
@@ -35190,8 +35190,8 @@ var require_websocket_server2 = __commonJS({
 });
 
 // src/index.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path18 = require("node:path");
 
 // ../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
@@ -36355,7 +36355,7 @@ var CONFIGURABLE_PERMISSION_ABI = [
 ];
 var DEFAULT_DISPATCH_GAS = 2000000n;
 function delay(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 var CALL_COMPONENTS = [
   { name: "target", type: "address" },
@@ -37877,6 +37877,60 @@ var SailGovernanceAbi = [
   }
 ];
 
+// ../sdk/dist/abis/ConfigurablePermission.js
+var ConfigurablePermissionAbi = [
+  {
+    type: "function",
+    name: "configure",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "params", type: "bytes" },
+      { name: "deadline", type: "uint256" },
+      { name: "sig", type: "bytes" }
+    ],
+    outputs: []
+  },
+  {
+    type: "function",
+    name: "configureDirect",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "account", type: "address" },
+      { name: "params", type: "bytes" }
+    ],
+    outputs: []
+  },
+  {
+    type: "function",
+    name: "isConfigured",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "bool" }]
+  },
+  {
+    type: "function",
+    name: "configNonces",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "configuredEpoch",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "hashTypedDataV4",
+    stateMutability: "view",
+    inputs: [{ name: "structHash", type: "bytes32" }],
+    outputs: [{ name: "", type: "bytes32" }]
+  }
+];
+
 // ../sdk/dist/safe.js
 init_esm2();
 var setManagerAbi = [
@@ -38759,14 +38813,14 @@ function getRl() {
 function ask(query) {
   getRl();
   process.stdout.write(query);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const buffered = lineQueue.shift();
     if (buffered !== void 0) {
-      resolve3(buffered);
+      resolve4(buffered);
     } else if (inputClosed) {
-      resolve3("");
+      resolve4("");
     } else {
-      waiters.push(resolve3);
+      waiters.push(resolve4);
     }
   });
 }
@@ -38957,11 +39011,11 @@ function isProcessAlive(pid) {
   }
 }
 function findFreePort(from14) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const server = import_node_net.default.createServer();
     server.unref();
-    server.on("error", () => findFreePort(from14 + 1).then(resolve3, reject));
-    server.listen(from14, "127.0.0.1", () => server.close(() => resolve3(from14)));
+    server.on("error", () => findFreePort(from14 + 1).then(resolve4, reject));
+    server.listen(from14, "127.0.0.1", () => server.close(() => resolve4(from14)));
   });
 }
 
@@ -41514,13 +41568,13 @@ Added (new in template):`);
 var import_node_fs12 = __toESM(require("node:fs"), 1);
 var import_node_path10 = __toESM(require("node:path"), 1);
 function readStdin() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (c) => {
       data += c;
     });
-    process.stdin.on("end", () => resolve3(data));
+    process.stdin.on("end", () => resolve4(data));
     process.stdin.on("error", reject);
   });
 }
@@ -41828,6 +41882,22 @@ var MandateStore = class {
     this.write(data);
     return mandate2;
   }
+  /**
+   * Track a permission only if no record at its address exists yet, returning the
+   * record either way. Used by `mandate attach` for addresses that were never
+   * deployed from this project — e.g. a shared permission singleton the operator
+   * attaches by address. Without a store record, `recordAttachment` is a no-op and
+   * the permission stays invisible to `mandate prepare`/`sign`. Unlike `add`, this
+   * never overwrites an existing record (so richer deploy-time metadata such as
+   * `sourcePath` is preserved). For attach-only records, `txHash`/`deployedAt`
+   * reflect the registration/first-tracked moment, not an on-chain deployment.
+   */
+  ensureTracked(mandate2) {
+    const existing = this.read().mandates.find(
+      (m) => m.address.toLowerCase() === mandate2.address.toLowerCase()
+    );
+    return existing ?? this.add(mandate2);
+  }
   /** Update mutable metadata fields on a tracked mandate (name, sourcePath, artifactPath). */
   update(addressOrName, patch) {
     const data = this.read();
@@ -42474,6 +42544,14 @@ function publicClientFor(project) {
     transport: http(getRpcUrl(project.chainId))
   }).extend(publicActions);
 }
+function knownTemplateLabel(chainId, address) {
+  try {
+    const known = getSailDeployment(chainId).knownTemplates ?? [];
+    return known.find((t) => t.address.toLowerCase() === address.toLowerCase())?.label;
+  } catch {
+    return void 0;
+  }
+}
 async function mandateDeploy(options) {
   const project = requireProject();
   const channel = await createSigningChannel(process.cwd());
@@ -42943,7 +43021,14 @@ async function runAttach(project, channel, options) {
     label,
     json
   );
-  if (tracked) store.recordAttachment(mandateAddress, { sma, txHash });
+  store.ensureTracked({
+    name: label,
+    address: mandateAddress,
+    txHash,
+    chainId: project.chainId,
+    deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  store.recordAttachment(mandateAddress, { sma, txHash });
   emit(json, () => {
   }, {
     status: "ok",
@@ -42957,7 +43042,14 @@ async function runAttachBatch(project, channel, options, sma, store) {
   announceSigningUrl(json);
   const txHash = await attachBatchToSma(project, channel, publicClient, sma, permissions, json);
   for (const permission of permissions) {
-    if (store.find(permission)) store.recordAttachment(permission, { sma, txHash });
+    store.ensureTracked({
+      name: knownTemplateLabel(project.chainId, permission) ?? permission,
+      address: permission,
+      txHash,
+      chainId: project.chainId,
+      deployedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    store.recordAttachment(permission, { sma, txHash });
   }
   emit(json, () => {
   }, {
@@ -43553,14 +43645,37 @@ async function trackedPermissionsFor(account2, chainId, kernel) {
     };
   });
   const onChain = kernel ? await fetchOnChainPermissions(account2.safe, chainId, kernel) : null;
-  if (onChain !== null) {
-    for (const p of local) {
-      if (p.registeredOnSma && !onChain.has(p.address.toLowerCase())) {
-        p.revokedOnChain = true;
-      }
+  if (onChain === null) return local;
+  return mergeOnChainPermissions(local, onChain, knownTemplateLabeler(chainId));
+}
+function mergeOnChainPermissions(local, onChain, labelFor = () => void 0) {
+  for (const p of local) {
+    if (p.registeredOnSma && !onChain.has(p.address.toLowerCase())) {
+      p.revokedOnChain = true;
+    }
+  }
+  const localAddrs = new Set(local.map((p) => p.address.toLowerCase()));
+  const extra = [];
+  for (const addr of onChain) {
+    if (!localAddrs.has(addr)) {
+      extra.push({
+        address: addr,
+        label: labelFor(addr) ?? `permission ${addr.slice(0, 10)}\u2026`,
+        registeredOnSma: true
+      });
     }
   }
-  return local;
+  return [...local, ...extra];
+}
+function knownTemplateLabeler(chainId) {
+  const map = /* @__PURE__ */ new Map();
+  try {
+    for (const t of getSailDeployment(chainId).knownTemplates ?? []) {
+      map.set(t.address.toLowerCase(), t.label);
+    }
+  } catch {
+  }
+  return (addr) => map.get(addr.toLowerCase());
 }
 function printNoPermissionsGuidance() {
   console.log(
@@ -43682,8 +43797,451 @@ ${unregistered.length} permission(s) are not yet registered on this SMA. Initiat
 \u2713 Saved to .sail/mandate.json \u2014 agent is ready to run.`);
 }
 
-// src/commands/mandate-simulate.ts
+// src/commands/mandate-configure.ts
 var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
+
+// ../sdk/dist/templates/boundedSwap.js
+init_esm2();
+var ABI = [
+  { name: "routers", type: "address[]" },
+  { name: "tokensIn", type: "address[]" },
+  { name: "tokensOut", type: "address[]" },
+  { name: "maxAmountPerTx", type: "uint256" },
+  { name: "maxSlippageBps", type: "uint256" },
+  { name: "priceOracle", type: "address" },
+  { name: "maxPriceAgeSec", type: "uint256" }
+];
+var ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+var boundedSwapTemplate = {
+  name: "SharedBoundedSwapPermission",
+  address: "0x0000000000000000000000000000000000000000",
+  encoder: {
+    encode(params) {
+      return encodeAbiParameters(ABI, [
+        params.routers,
+        params.tokensIn,
+        params.tokensOut,
+        params.maxAmountPerTx,
+        BigInt(params.maxSlippageBps),
+        params.priceOracle,
+        BigInt(params.maxPriceAgeSec)
+      ]);
+    },
+    decode(data) {
+      const decoded = decodeAbiParameters(ABI, data);
+      return {
+        routers: [...decoded[0]],
+        tokensIn: [...decoded[1]],
+        tokensOut: [...decoded[2]],
+        maxAmountPerTx: decoded[3],
+        maxSlippageBps: Number(decoded[4]),
+        priceOracle: decoded[5],
+        maxPriceAgeSec: Number(decoded[6])
+      };
+    }
+  },
+  explainer: {
+    explain(params) {
+      const warnings = [];
+      if (params.maxSlippageBps > 100) {
+        warnings.push(`High slippage tolerance: ${params.maxSlippageBps / 100}%`);
+      }
+      if (params.priceOracle === ZERO_ADDRESS) {
+        warnings.push("No price oracle configured \u2014 swaps are not checked against a reference price");
+      }
+      return {
+        templateName: "SharedBoundedSwapPermission",
+        humanReadable: [
+          `Maximum input per swap: ${params.maxAmountPerTx.toString()} (input-token base units)`,
+          `Maximum slippage: ${params.maxSlippageBps / 100}%`,
+          `Allowed routers: ${params.routers.join(", ")}`,
+          `Allowed input tokens: ${params.tokensIn.join(", ")}`,
+          `Allowed output tokens: ${params.tokensOut.join(", ")}`,
+          params.priceOracle === ZERO_ADDRESS ? "Price oracle: none" : `Price oracle: ${params.priceOracle} (max age ${params.maxPriceAgeSec}s)`
+        ],
+        warnings
+      };
+    }
+  }
+};
+
+// src/commands/mandate-configure.ts
+init_esm2();
+var TEMPLATE_REGISTRY = {
+  SwapPermission: {
+    label: "Bounded Swap (Uniswap V3)",
+    bigintFields: ["maxAmountPerTx"],
+    encode: (raw) => boundedSwapTemplate.encoder.encode(coerceSwapParams(raw)),
+    decode: (blob) => {
+      const p = boundedSwapTemplate.encoder.decode(blob);
+      return {
+        routers: p.routers,
+        tokensIn: p.tokensIn,
+        tokensOut: p.tokensOut,
+        maxAmountPerTx: p.maxAmountPerTx.toString(),
+        maxSlippageBps: p.maxSlippageBps,
+        priceOracle: p.priceOracle,
+        maxPriceAgeSec: p.maxPriceAgeSec
+      };
+    }
+  }
+};
+function asAddressArray(v, field) {
+  if (!Array.isArray(v)) throw new Error(`${field}: expected an array of addresses`);
+  return v.map((x, i) => {
+    if (typeof x !== "string" || !isAddress(x, { strict: false })) {
+      throw new Error(`${field}[${i}]: invalid address "${String(x)}"`);
+    }
+    return getAddress(x);
+  });
+}
+function asAddress(v, field) {
+  if (typeof v !== "string" || !isAddress(v, { strict: false })) {
+    throw new Error(`${field}: invalid address "${String(v)}"`);
+  }
+  return getAddress(v);
+}
+function asUint(v, field) {
+  if (v === void 0 || v === null) throw new Error(`${field}: missing`);
+  try {
+    return BigInt(typeof v === "string" || typeof v === "number" ? v : String(v));
+  } catch {
+    throw new Error(`${field}: expected an integer, got "${String(v)}"`);
+  }
+}
+function asInt(v, field) {
+  const n = asUint(v, field);
+  return Number(n);
+}
+function coerceSwapParams(raw) {
+  return {
+    routers: asAddressArray(raw.routers, "routers"),
+    tokensIn: asAddressArray(raw.tokensIn, "tokensIn"),
+    tokensOut: asAddressArray(raw.tokensOut, "tokensOut"),
+    maxAmountPerTx: asUint(raw.maxAmountPerTx, "maxAmountPerTx"),
+    maxSlippageBps: asInt(raw.maxSlippageBps, "maxSlippageBps"),
+    priceOracle: asAddress(raw.priceOracle, "priceOracle"),
+    maxPriceAgeSec: asInt(raw.maxPriceAgeSec, "maxPriceAgeSec")
+  };
+}
+function requireProject2() {
+  if (!ProjectContext.exists()) {
+    console.log('No Sailor project found. Run "sailor init" first.');
+    process.exit(1);
+  }
+  return new ProjectContext();
+}
+function fail2(err, json = false) {
+  const msg = err instanceof Error ? err.message : String(err);
+  emit(json, () => console.error(`
+Mandate configure failed: ${msg}`), {
+    status: "error",
+    error: msg
+  });
+  process.exit(1);
+}
+function publicClientFor2(project) {
+  return createPublicClient({
+    chain: getChainById(project.chainId),
+    transport: http(getRpcUrl(project.chainId))
+  }).extend(publicActions);
+}
+function announceSigningUrl2(json) {
+  const url = signingPageUrl(projectPort(process.cwd()));
+  if (json) {
+    process.stdout.write(`${JSON.stringify({ status: "waiting_for_signature", url })}
+`);
+  } else {
+    console.log(`
+\u2192 Open the Sailor dashboard to approve signing requests:
+  ${url}
+`);
+  }
+}
+function resolveBlob(options) {
+  const hasParams = options.params !== void 0;
+  const hasArgsFile = options.argsFile !== void 0;
+  if (hasParams && hasArgsFile) {
+    throw new Error("Provide EITHER --params <hex> OR --args-file <path>, not both.");
+  }
+  if (!hasParams && !hasArgsFile) {
+    throw new Error(
+      "Provide the config blob as --params <0x-hex>, or as --args-file <path> paired with --template <Name>."
+    );
+  }
+  if (hasParams) {
+    const raw2 = options.params.trim();
+    if (!isHex(raw2) || raw2.length <= 2) {
+      throw new Error(`--params must be 0x-prefixed hex; got "${options.params}".`);
+    }
+    return { blob: raw2, via: "params" };
+  }
+  const templateName = options.template;
+  if (!templateName) {
+    throw new Error("--args-file requires --template <Name> (e.g. SwapPermission).");
+  }
+  const entry = TEMPLATE_REGISTRY[templateName];
+  if (!entry) {
+    throw new Error(
+      `Unknown --template "${templateName}". Known: ${Object.keys(TEMPLATE_REGISTRY).join(", ")}. Pass a pre-encoded blob with --params for any other template.`
+    );
+  }
+  const argsFilePath = (0, import_node_path13.resolve)(options.argsFile);
+  let raw;
+  try {
+    raw = (0, import_node_fs15.readFileSync)(argsFilePath, "utf8").trim();
+  } catch {
+    throw new Error(`Cannot read --args-file: ${argsFilePath}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`--args-file is not valid JSON: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("--args-file must contain a JSON object of template params.");
+  }
+  const blob = entry.encode(parsed);
+  return { blob, via: `template:${templateName}` };
+}
+async function mandateConfigure(options) {
+  const project = requireProject2();
+  const channel = await createSigningChannel(process.cwd());
+  try {
+    await channel.start();
+    await runConfigure(project, channel, options);
+  } catch (err) {
+    fail2(err, options.json);
+  } finally {
+    channel.stop();
+  }
+}
+async function runConfigure(project, channel, options) {
+  const json = !!options.json;
+  const say = (fn) => {
+    if (!json) fn();
+  };
+  if (!isAddress(options.sma, { strict: false })) {
+    throw new Error(`Invalid --sma address: ${options.sma}`);
+  }
+  if (!isAddress(options.address, { strict: false })) {
+    throw new Error(
+      `--address must be a deployed shared-template singleton address: ${options.address}`
+    );
+  }
+  const sma = getAddress(options.sma);
+  const singleton = getAddress(options.address);
+  const { blob, via } = resolveBlob(options);
+  const publicClient = publicClientFor2(project);
+  const registered = await publicClient.readContract({
+    address: project.contracts.kernel,
+    abi: SailKernelAbi,
+    functionName: "registered",
+    args: [sma]
+  });
+  if (!registered) {
+    throw new Error(`SMA ${sma} is not registered with SailKernel; cannot configure a permission for it.`);
+  }
+  const kernelConfig = await publicClient.readContract({
+    address: project.contracts.kernel,
+    abi: SailKernelAbi,
+    functionName: "configs",
+    args: [sma]
+  });
+  const permissionSigner = kernelConfig[0];
+  if (!permissionSigner || permissionSigner === getAddress("0x0000000000000000000000000000000000000000")) {
+    throw new Error(`SMA ${sma} has no on-chain permissionSigner; cannot configure.`);
+  }
+  const alreadyConfigured = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "isConfigured",
+    args: [sma]
+  });
+  if (alreadyConfigured && !options.force) {
+    say(
+      () => console.log(
+        `
+\u2713 ${singleton} is already configured for ${sma} (isConfigured == true).
+  Re-run with --force to overwrite the current bounds.`
+      )
+    );
+    emit(
+      json,
+      () => {
+      },
+      { status: "ok", alreadyConfigured: true, singleton, sma, chainId: project.chainId }
+    );
+    return;
+  }
+  const nonce = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "configNonces",
+    args: [sma]
+  });
+  say(() => {
+    console.log(`
+configure ${singleton}`);
+    console.log(`  SMA:              ${sma}`);
+    console.log(`  permissionSigner: ${permissionSigner}  (must sign in the browser \u2014 owner tx)`);
+    console.log(`  current nonce:   ${nonce}`);
+    console.log(`  already set:     ${alreadyConfigured ? "yes (--force will overwrite)" : "no"}`);
+    console.log(`  config blob:     ${blob}  (via ${via}, ${Math.floor((blob.length - 2) / 2)} bytes)`);
+  });
+  const configureDirectData = encodeFunctionData({
+    abi: ConfigurablePermissionAbi,
+    functionName: "configureDirect",
+    args: [sma, blob]
+  });
+  say(() => console.log(`
+Pre-flight (eth_call of configureDirect, no gas)\u2026`));
+  try {
+    await publicClient.simulateContract({
+      address: singleton,
+      abi: ConfigurablePermissionAbi,
+      functionName: "configureDirect",
+      args: [sma, blob],
+      account: permissionSigner
+    });
+  } catch (err) {
+    const ce = getContractError(err, {
+      abi: ConfigurablePermissionAbi,
+      address: singleton,
+      args: [sma, blob],
+      functionName: "configureDirect"
+    });
+    const reason = ce?.message ?? err?.message ?? String(err);
+    throw new Error(
+      `Pre-flight reverted \u2014 the config blob is invalid for ${singleton} on ${sma}.
+  Revert: ${reason}
+  This is the encoding gotcha (flat params vs wrapped struct) or an internal bound check. Re-encode per the template's _applyConfig tuple and retry.`
+    );
+  }
+  say(() => console.log("\u2713 pre-flight passed (configureDirect would succeed)."));
+  let decoded;
+  if (options.template && TEMPLATE_REGISTRY[options.template]) {
+    try {
+      decoded = TEMPLATE_REGISTRY[options.template].decode(blob);
+      say(() => {
+        console.log("\nDecoded bounds (what the singleton will store):");
+        for (const [k, v] of Object.entries(decoded)) {
+          const display = Array.isArray(v) ? v.join(", ") : String(v);
+          console.log(`  ${k}: ${display}`);
+        }
+      });
+    } catch {
+    }
+  }
+  if (options.simulateOnly) {
+    emit(
+      json,
+      () => {
+        console.log("\n--simulate-only: stopping after pre-flight (no signing, no gas).");
+      },
+      {
+        status: "ok",
+        simulateOnly: true,
+        singleton,
+        sma,
+        permissionSigner,
+        nonce: nonce.toString(),
+        alreadyConfigured,
+        blob,
+        blobBytes: Math.floor((blob.length - 2) / 2),
+        decoded,
+        chainId: project.chainId
+      }
+    );
+    return;
+  }
+  const label = options.label ?? (options.template ?? "shared-template");
+  announceSigningUrl2(json);
+  say(
+    () => console.log(
+      `Pushing configure request \u2014 the mandate signer (${permissionSigner}) must approve in the browser\u2026`
+    )
+  );
+  const response = await channel.requestSignature({
+    type: "transaction",
+    kind: "arbitrary-tx",
+    title: `Configure "${label}"`,
+    description: `Write per-account bounds on the shared permission ${singleton}.
+You (the mandate signer) send the transaction \u2014 configureDirect requires msg.sender to be the permissionSigner.`,
+    chainId: project.chainId,
+    to: singleton,
+    data: configureDirectData,
+    details: [
+      { label: "SMA", value: sma },
+      { label: "Singleton", value: singleton },
+      { label: "Template", value: options.template ?? "(raw blob)" },
+      { label: "Mandate signer", value: permissionSigner },
+      { label: "Config blob (bytes)", value: String(Math.floor((blob.length - 2) / 2)) },
+      ...decoded ? Object.entries(decoded).map(([k, v]) => ({
+        label: k,
+        value: Array.isArray(v) ? v.join(", ") : String(v)
+      })) : []
+    ]
+  });
+  if (response.status === "rejected") {
+    throw new Error(`User rejected configure: ${response.reason ?? "no reason given"}`);
+  }
+  if (response.status !== "signed") {
+    throw new Error(`Expected a signed transaction, got: ${response.status}`);
+  }
+  say(() => console.log("Waiting for confirmation\u2026"));
+  const receipt = await publicClient.waitForTransactionReceipt({ hash: response.txHash });
+  if (receipt.status !== "success") {
+    throw new Error(`configureDirect transaction failed (tx ${response.txHash})`);
+  }
+  const configuredNow = await publicClient.readContract({
+    address: singleton,
+    abi: ConfigurablePermissionAbi,
+    functionName: "isConfigured",
+    args: [sma]
+  });
+  if (!configuredNow) {
+    throw new Error(
+      `Tx ${response.txHash} mined, but isConfigured(${sma}) is still false. Verify on-chain.`
+    );
+  }
+  say(() => console.log("\u2713", `Configured ${singleton} for ${sma} (isConfigured == true).`));
+  appendActivity({
+    ts: nowIso(),
+    actor: "owner",
+    type: "permission_configured",
+    permission: singleton,
+    name: label,
+    sma,
+    txHash: response.txHash,
+    chainId: project.chainId
+  });
+  emit(
+    json,
+    () => {
+      console.log(
+        `
+Next: prove it accepts/rejects the right calls before dispatching:
+  sailor mandate simulate --address ${singleton} --sma ${sma} --calls ./probe.json`
+      );
+    },
+    {
+      status: "ok",
+      singleton,
+      sma,
+      template: options.template,
+      permissionSigner,
+      txHash: response.txHash,
+      blob,
+      chainId: project.chainId
+    }
+  );
+}
+
+// src/commands/mandate-simulate.ts
+var import_node_fs16 = require("node:fs");
 init_esm2();
 function parseExpect(raw, where) {
   if (raw === void 0) return void 0;
@@ -43699,7 +44257,7 @@ function resolveSampleCalls(options) {
   if (options.calls) {
     let raw;
     try {
-      raw = JSON.parse((0, import_node_fs15.readFileSync)(options.calls, "utf8"));
+      raw = JSON.parse((0, import_node_fs16.readFileSync)(options.calls, "utf8"));
     } catch (err) {
       throw new Error(`Could not read --calls file "${options.calls}": ${err.message}`);
     }
@@ -43915,7 +44473,7 @@ async function mandateSimulate(options) {
 }
 
 // src/commands/rotate-signer.ts
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 init_esm2();
 var PENDING_REATTACH_FILE = ["state", "pending-reattach.json"];
 async function rotateSigner(options) {
@@ -44301,7 +44859,7 @@ ensure the agent that signs dispatches holds this key.`
   const keystore = await keyring.exportKeystore(password);
   writeJsonFile(target, keystore, 384);
   const perManagerPath = managerKeystorePath(keyring.address);
-  (0, import_node_fs16.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs17.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   writeJsonFile(perManagerPath, keystore, 384);
   say(
     () => console.log(
@@ -44313,7 +44871,7 @@ ensure the agent that signs dispatches holds this key.`
 function promoteManagerKeystore(newManager, say) {
   const stored = readJsonFile(managerKeystorePath(newManager));
   if (!stored) return;
-  (0, import_node_fs16.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
+  (0, import_node_fs17.mkdirSync)(sailPath("keys", "managers"), { recursive: true });
   const activeTarget = keyPath("manager");
   const displaced = readJsonFile(activeTarget);
   if (displaced?.address) {
@@ -44365,7 +44923,7 @@ function writePending(pending) {
 }
 function clearPending() {
   try {
-    (0, import_node_fs16.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
+    (0, import_node_fs17.rmSync)(sailPath(...PENDING_REATTACH_FILE), { force: true });
   } catch {
   }
 }
@@ -44464,12 +45022,12 @@ function ownerShow(options) {
 }
 
 // src/commands/run.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var import_node_url = require("node:url");
 init_esm2();
 var DEFAULT_INTERVAL_SEC = 60;
-var sleep2 = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var sleep2 = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var ERC20_READ_ABI = [
   {
     type: "function",
@@ -44499,7 +45057,7 @@ var ERC20_READ_ABI = [
 function loadAgentData(filePath) {
   if (!filePath) return {};
   try {
-    const parsed = JSON.parse(import_node_fs17.default.readFileSync(filePath, "utf-8"));
+    const parsed = JSON.parse(import_node_fs18.default.readFileSync(filePath, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -44508,8 +45066,8 @@ function loadAgentData(filePath) {
 async function loadAgent() {
   const candidates = ["src/agent.ts", "src/agent.js", "dist/agent.js", "dist/src/agent.js"];
   for (const rel of candidates) {
-    const abs = import_node_path13.default.join(process.cwd(), rel);
-    if (!import_node_fs17.default.existsSync(abs)) continue;
+    const abs = import_node_path14.default.join(process.cwd(), rel);
+    if (!import_node_fs18.default.existsSync(abs)) continue;
     let mod2;
     if (abs.endsWith(".ts")) {
       const { tsImport } = await import("tsx/esm/api");
@@ -44804,7 +45362,7 @@ Configure the chain in the SDK chain registry or set KERNEL_ADDRESS in .sail/.en
         if (isConjunctive && result.txHash) {
           try {
             await publicClient.waitForTransactionReceipt({ hash: result.txHash, timeout: 3e4 });
-            await new Promise((resolve3) => setTimeout(resolve3, 500));
+            await new Promise((resolve4) => setTimeout(resolve4, 500));
           } catch {
           }
         }
@@ -44985,9 +45543,9 @@ async function scan(options) {
 
 // src/commands/service.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 function sanitizeName(raw) {
   const s = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   return s || "agent";
@@ -45106,21 +45664,21 @@ function buildWindowsTaskXml(cfg) {
 `;
 }
 function isTccProtected(projectDir, home = import_node_os.default.homedir()) {
-  const rel = import_node_path14.default.relative(home, import_node_path14.default.resolve(projectDir));
-  if (rel.startsWith("..") || import_node_path14.default.isAbsolute(rel)) return false;
-  const top = rel.split(import_node_path14.default.sep)[0];
+  const rel = import_node_path15.default.relative(home, import_node_path15.default.resolve(projectDir));
+  if (rel.startsWith("..") || import_node_path15.default.isAbsolute(rel)) return false;
+  const top = rel.split(import_node_path15.default.sep)[0];
   return ["Desktop", "Documents", "Downloads"].includes(top ?? "");
 }
 function resolveCliEntry() {
   try {
-    return import_node_fs18.default.realpathSync(process.argv[1]);
+    return import_node_fs19.default.realpathSync(process.argv[1]);
   } catch {
-    return import_node_path14.default.resolve(process.argv[1]);
+    return import_node_path15.default.resolve(process.argv[1]);
   }
 }
 function resolveProjectDir(explicit) {
-  const dir = import_node_path14.default.resolve(explicit ?? process.cwd());
-  if (!import_node_fs18.default.existsSync(import_node_path14.default.join(dir, ".sail"))) {
+  const dir = import_node_path15.default.resolve(explicit ?? process.cwd());
+  if (!import_node_fs19.default.existsSync(import_node_path15.default.join(dir, ".sail"))) {
     throw new Error(
       `No .sail/ found in ${dir}.
 Run this from your Sailor project root, or pass --project <path>. (The installer does not search parent directories \u2014 that would risk targeting the wrong project.)`
@@ -45132,7 +45690,7 @@ function passphraseReadiness(projectDir) {
   const account2 = (() => {
     try {
       return JSON.parse(
-        import_node_fs18.default.readFileSync(import_node_path14.default.join(projectDir, ".sail", "account.json"), "utf-8")
+        import_node_fs19.default.readFileSync(import_node_path15.default.join(projectDir, ".sail", "account.json"), "utf-8")
       );
     } catch {
       return null;
@@ -45148,28 +45706,28 @@ function passphraseReadiness(projectDir) {
   } finally {
     process.chdir(prevCwd);
   }
-  const env = parseEnvFile(import_node_path14.default.join(projectDir, ".sail", ".env.local"));
+  const env = parseEnvFile(import_node_path15.default.join(projectDir, ".sail", ".env.local"));
   const passphraseInEnvFile = Boolean(env.SAIL_PASSPHRASE);
   return { keystorePresent, passphraseInEnvFile, ready: keystorePresent && passphraseInEnvFile };
 }
 function buildConfig(opts) {
   const projectDir = resolveProjectDir(opts.project);
   return {
-    projectName: sanitizeName(import_node_path14.default.basename(projectDir)),
+    projectName: sanitizeName(import_node_path15.default.basename(projectDir)),
     projectDir,
     nodePath: process.execPath,
     cliEntry: resolveCliEntry(),
-    logPath: import_node_path14.default.join(projectDir, ".sail", "agent.log"),
+    logPath: import_node_path15.default.join(projectDir, ".sail", "agent.log"),
     interval: opts.interval != null ? Number(opts.interval) : void 0,
     chain: opts.chain != null ? Number(opts.chain) : void 0,
     restartSec: 30
   };
 }
 function plistPath(projectName) {
-  return import_node_path14.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
+  return import_node_path15.default.join(import_node_os.default.homedir(), "Library", "LaunchAgents", `${launchdLabel(projectName)}.plist`);
 }
 function systemdPath(projectName) {
-  return import_node_path14.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
+  return import_node_path15.default.join(import_node_os.default.homedir(), ".config", "systemd", "user", systemdUnitName(projectName));
 }
 async function serviceInstall(opts = {}) {
   const cfg = buildConfig(opts);
@@ -45193,12 +45751,12 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
     console.warn(`\u26A0 ${msg}
   Proceeding because --force was given.`);
   }
-  import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(cfg.logPath), { recursive: true });
+  import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(cfg.logPath), { recursive: true });
   if (platform === "darwin") {
     const plist = buildLaunchdPlist(cfg);
     const dest = plistPath(cfg.projectName);
-    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
-    import_node_fs18.default.writeFileSync(dest, plist);
+    import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(dest), { recursive: true });
+    import_node_fs19.default.writeFileSync(dest, plist);
     const uid2 = process.getuid?.() ?? 0;
     try {
       try {
@@ -45217,8 +45775,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   if (platform === "linux") {
     const unit = buildSystemdUnit(cfg);
     const dest = systemdPath(cfg.projectName);
-    import_node_fs18.default.mkdirSync(import_node_path14.default.dirname(dest), { recursive: true });
-    import_node_fs18.default.writeFileSync(dest, unit);
+    import_node_fs19.default.mkdirSync(import_node_path15.default.dirname(dest), { recursive: true });
+    import_node_fs19.default.writeFileSync(dest, unit);
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "enable", "--now", systemdUnitName(cfg.projectName)], {
@@ -45232,8 +45790,8 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
   }
   if (platform === "win32") {
     const xml = buildWindowsTaskXml(cfg);
-    const dest = import_node_path14.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
-    import_node_fs18.default.writeFileSync(dest, xml, "utf-8");
+    const dest = import_node_path15.default.join(import_node_os.default.tmpdir(), `${windowsTaskName(cfg.projectName)}.xml`);
+    import_node_fs19.default.writeFileSync(dest, xml, "utf-8");
     try {
       (0, import_node_child_process2.execFileSync)(
         "schtasks",
@@ -45244,7 +45802,7 @@ Run "sailor keys generate" (and save the passphrase) or set it in .sail/.env.loc
       throw new Error(`schtasks /Create failed: ${err.message}`);
     } finally {
       try {
-        import_node_fs18.default.rmSync(dest, { force: true });
+        import_node_fs19.default.rmSync(dest, { force: true });
       } catch {
       }
     }
@@ -45270,14 +45828,14 @@ function okInstall(cfg, unit) {
   );
 }
 async function serviceStatus(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   let installed = false;
   let running = false;
   let detail = "";
   try {
     if (platform === "darwin") {
-      installed = import_node_fs18.default.existsSync(plistPath(projectName));
+      installed = import_node_fs19.default.existsSync(plistPath(projectName));
       const uid2 = process.getuid?.() ?? 0;
       try {
         detail = (0, import_node_child_process2.execFileSync)("launchctl", ["print", `gui/${uid2}/${launchdLabel(projectName)}`], {
@@ -45289,7 +45847,7 @@ async function serviceStatus(opts = {}) {
       } catch {
       }
     } else if (platform === "linux") {
-      installed = import_node_fs18.default.existsSync(systemdPath(projectName));
+      installed = import_node_fs19.default.existsSync(systemdPath(projectName));
       try {
         detail = (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "is-active", systemdUnitName(projectName)], {
           encoding: "utf-8",
@@ -45325,7 +45883,7 @@ async function serviceStatus(opts = {}) {
   );
 }
 async function serviceStop(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -45344,7 +45902,7 @@ async function serviceStop(opts = {}) {
   });
 }
 async function serviceUninstall(opts = {}) {
-  const projectName = sanitizeName(import_node_path14.default.basename(resolveProjectDir(opts.project)));
+  const projectName = sanitizeName(import_node_path15.default.basename(resolveProjectDir(opts.project)));
   const platform = process.platform;
   if (platform === "darwin") {
     const uid2 = process.getuid?.() ?? 0;
@@ -45354,7 +45912,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs18.default.rmSync(plistPath(projectName), { force: true });
+    import_node_fs19.default.rmSync(plistPath(projectName), { force: true });
   } else if (platform === "linux") {
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "disable", "--now", systemdUnitName(projectName)], {
@@ -45362,7 +45920,7 @@ async function serviceUninstall(opts = {}) {
       });
     } catch {
     }
-    import_node_fs18.default.rmSync(systemdPath(projectName), { force: true });
+    import_node_fs19.default.rmSync(systemdPath(projectName), { force: true });
     try {
       (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
     } catch {
@@ -45380,21 +45938,21 @@ async function serviceUninstall(opts = {}) {
 }
 async function serviceLogs(opts = {}) {
   const projectDir = resolveProjectDir(opts.project);
-  const logPath = import_node_path14.default.join(projectDir, ".sail", "agent.log");
-  if (!import_node_fs18.default.existsSync(logPath)) {
+  const logPath = import_node_path15.default.join(projectDir, ".sail", "agent.log");
+  if (!import_node_fs19.default.existsSync(logPath)) {
     console.log(`No log yet at ${logPath}. The service writes here once it runs.`);
     return;
   }
   if (opts.follow) {
     if (process.platform === "win32") {
-      console.log(import_node_fs18.default.readFileSync(logPath, "utf-8"));
+      console.log(import_node_fs19.default.readFileSync(logPath, "utf-8"));
       console.log("(follow mode is not supported on Windows here \u2014 re-run to refresh)");
       return;
     }
     (0, import_node_child_process2.execFileSync)("tail", ["-f", logPath], { stdio: "inherit" });
     return;
   }
-  const lines = import_node_fs18.default.readFileSync(logPath, "utf-8").split("\n");
+  const lines = import_node_fs19.default.readFileSync(logPath, "utf-8").split("\n");
   console.log(lines.slice(-200).join("\n"));
 }
 
@@ -45550,14 +46108,14 @@ async function sessionResume(opts = {}) {
 }
 
 // src/commands/station.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path15 = require("node:path");
-var RUNTIME_SERVER_FILE2 = (0, import_node_path15.join)(".sail", "runtime", "server.json");
+var import_node_fs20 = require("node:fs");
+var import_node_path16 = require("node:path");
+var RUNTIME_SERVER_FILE2 = (0, import_node_path16.join)(".sail", "runtime", "server.json");
 function readState(projectRoot) {
-  const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
-  if (!(0, import_node_fs19.existsSync)(file)) return null;
+  const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
+  if (!(0, import_node_fs20.existsSync)(file)) return null;
   try {
-    return JSON.parse((0, import_node_fs19.readFileSync)(file, "utf8"));
+    return JSON.parse((0, import_node_fs20.readFileSync)(file, "utf8"));
   } catch {
     return null;
   }
@@ -45629,9 +46187,9 @@ async function stationStop(options) {
   }
   const daemon = await discoverDaemon(projectRoot);
   if (!daemon) {
-    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
+      if ((0, import_node_fs20.existsSync)(file)) (0, import_node_fs20.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -45647,9 +46205,9 @@ async function stationStop(options) {
       pid: state.pid
     });
   } catch {
-    const file = (0, import_node_path15.join)(projectRoot, RUNTIME_SERVER_FILE2);
+    const file = (0, import_node_path16.join)(projectRoot, RUNTIME_SERVER_FILE2);
     try {
-      if ((0, import_node_fs19.existsSync)(file)) (0, import_node_fs19.rmSync)(file);
+      if ((0, import_node_fs20.existsSync)(file)) (0, import_node_fs20.rmSync)(file);
     } catch {
     }
     emit(options.json, () => console.log("Station process not found; cleared stale state."), {
@@ -45711,9 +46269,9 @@ async function status() {
 
 // src/commands/ui.ts
 var import_node_child_process5 = require("node:child_process");
-var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
 var import_node_net2 = __toESM(require("node:net"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 
 // src/lib/tailscale.ts
 var import_node_child_process4 = require("node:child_process");
@@ -45759,12 +46317,12 @@ function tailscaleServeDown() {
 }
 
 // src/commands/ui.ts
-var UI_STATE_FILE = import_node_path16.default.join(".sail", "runtime", "ui.json");
+var UI_STATE_FILE = import_node_path17.default.join(".sail", "runtime", "ui.json");
 function readState2(projectRoot) {
-  const file = import_node_path16.default.join(projectRoot, UI_STATE_FILE);
-  if (!import_node_fs20.default.existsSync(file)) return null;
+  const file = import_node_path17.default.join(projectRoot, UI_STATE_FILE);
+  if (!import_node_fs21.default.existsSync(file)) return null;
   try {
-    return JSON.parse(import_node_fs20.default.readFileSync(file, "utf-8"));
+    return JSON.parse(import_node_fs21.default.readFileSync(file, "utf-8"));
   } catch {
     return null;
   }
@@ -45772,7 +46330,7 @@ function readState2(projectRoot) {
 function installedCliVersion() {
   try {
     const pkg = JSON.parse(
-      import_node_fs20.default.readFileSync(import_node_path16.default.join(packageRoot(), "package.json"), "utf-8")
+      import_node_fs21.default.readFileSync(import_node_path17.default.join(packageRoot(), "package.json"), "utf-8")
     );
     return pkg.version ?? null;
   } catch {
@@ -45799,16 +46357,16 @@ async function warnIfVersionSkew(port) {
 }
 function waitForPort(port, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const attempt = () => {
       const socket = import_node_net2.default.connect(port, "127.0.0.1");
       socket.once("connect", () => {
         socket.destroy();
-        resolve3(true);
+        resolve4(true);
       });
       socket.once("error", () => {
         socket.destroy();
-        if (Date.now() > deadline) resolve3(false);
+        if (Date.now() > deadline) resolve4(false);
         else setTimeout(attempt, 150);
       });
     };
@@ -45817,16 +46375,16 @@ function waitForPort(port, timeoutMs) {
 }
 async function uiCommand(opts = {}) {
   const distDir = cliDistDir();
-  const uiDistDir = import_node_path16.default.join(packageRoot(), "packages", "ui", "dist");
-  const serverBundle = import_node_path16.default.resolve(distDir, "server.cjs");
+  const uiDistDir = import_node_path17.default.join(packageRoot(), "packages", "ui", "dist");
+  const serverBundle = import_node_path17.default.resolve(distDir, "server.cjs");
   const projectRoot = process.cwd();
-  const sailDir2 = import_node_path16.default.join(projectRoot, ".sail");
+  const sailDir2 = import_node_path17.default.join(projectRoot, ".sail");
   const envPort = Number(process.env.PORT);
   const port = await findFreePort(Number.isInteger(envPort) && envPort > 0 && envPort <= 65535 ? envPort : projectPort(projectRoot));
-  if (!import_node_fs20.default.existsSync(serverBundle)) {
+  if (!import_node_fs21.default.existsSync(serverBundle)) {
     throw new Error(`Server bundle not found at ${serverBundle}. Re-run the sailor build.`);
   }
-  if (!import_node_fs20.default.existsSync(import_node_path16.default.join(uiDistDir, "index.html"))) {
+  if (!import_node_fs21.default.existsSync(import_node_path17.default.join(uiDistDir, "index.html"))) {
     throw new Error(`UI dist not found at ${uiDistDir}. Re-run the sailor build.`);
   }
   let tailnetUrl = null;
@@ -45856,10 +46414,10 @@ async function uiCommand(opts = {}) {
     await warnIfVersionSkew(existing.port);
     return;
   }
-  const runtimeDir = import_node_path16.default.join(projectRoot, ".sail", "runtime");
-  import_node_fs20.default.mkdirSync(runtimeDir, { recursive: true });
-  const logFile = import_node_path16.default.join(runtimeDir, "ui.log");
-  const logFd = import_node_fs20.default.openSync(logFile, "a");
+  const runtimeDir = import_node_path17.default.join(projectRoot, ".sail", "runtime");
+  import_node_fs21.default.mkdirSync(runtimeDir, { recursive: true });
+  const logFile = import_node_path17.default.join(runtimeDir, "ui.log");
+  const logFd = import_node_fs21.default.openSync(logFile, "a");
   const corsOrigins = [process.env.SAILOR_CORS_ORIGINS, tailnetUrl].filter(Boolean).join(",");
   const child = (0, import_node_child_process5.spawn)(process.execPath, [serverBundle], {
     detached: true,
@@ -45874,7 +46432,7 @@ async function uiCommand(opts = {}) {
     }
   });
   child.unref();
-  import_node_fs20.default.closeSync(logFd);
+  import_node_fs21.default.closeSync(logFd);
   const READY_TIMEOUT_MS = 1e4;
   const deadline = Date.now() + READY_TIMEOUT_MS;
   let ready = false;
@@ -45888,14 +46446,14 @@ async function uiCommand(opts = {}) {
   if (!ready) {
     let tail = "";
     try {
-      tail = import_node_fs20.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
+      tail = import_node_fs21.default.readFileSync(logFile, "utf-8").split("\n").filter(Boolean).slice(-15).join("\n");
     } catch {
     }
     throw new Error(
       `Sailor UI failed to start within ${READY_TIMEOUT_MS / 1e3}s on port ${port}.` + (tail ? `
 
 Server output:
-${tail}` : ` See ${import_node_path16.default.relative(projectRoot, logFile)}.`)
+${tail}` : ` See ${import_node_path17.default.relative(projectRoot, logFile)}.`)
     );
   }
   let exposed = false;
@@ -45910,8 +46468,8 @@ ${tail}` : ` See ${import_node_path16.default.relative(projectRoot, logFile)}.`)
       );
     }
   }
-  import_node_fs20.default.writeFileSync(
-    import_node_path16.default.join(projectRoot, UI_STATE_FILE),
+  import_node_fs21.default.writeFileSync(
+    import_node_path17.default.join(projectRoot, UI_STATE_FILE),
     JSON.stringify({ pid: child.pid, port, startedAt: (/* @__PURE__ */ new Date()).toISOString(), exposed }, null, 2)
   );
   console.log(`Sailor UI started at http://localhost:${port}  (pid ${child.pid})`);
@@ -45924,7 +46482,7 @@ async function uiStatus() {
     console.log(`\u25CF running  http://localhost:${state.port}  (pid ${state.pid})`);
     await warnIfVersionSkew(state.port);
   } else {
-    if (state) import_node_fs20.default.rmSync(import_node_path16.default.join(process.cwd(), UI_STATE_FILE), { force: true });
+    if (state) import_node_fs21.default.rmSync(import_node_path17.default.join(process.cwd(), UI_STATE_FILE), { force: true });
     console.log("\u25CB Sailor UI is not running");
   }
 }
@@ -45936,7 +46494,7 @@ function uiStop() {
     return;
   }
   if (!isProcessAlive(state.pid)) {
-    import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
+    import_node_fs21.default.rmSync(import_node_path17.default.join(projectRoot, UI_STATE_FILE), { force: true });
     console.log("Sailor UI is not running (stale state file removed).");
     return;
   }
@@ -45945,14 +46503,14 @@ function uiStop() {
     tailscaleServeDown();
     console.log("Tailnet exposure removed.");
   }
-  import_node_fs20.default.rmSync(import_node_path16.default.join(projectRoot, UI_STATE_FILE), { force: true });
+  import_node_fs21.default.rmSync(import_node_path17.default.join(projectRoot, UI_STATE_FILE), { force: true });
   console.log(`Stopped Sailor UI (pid ${state.pid}).`);
 }
 
 // src/index.ts
 function cliVersion() {
   try {
-    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path17.join)(packageRoot(), "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path18.join)(packageRoot(), "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -46023,6 +46581,9 @@ mandate.command("attach").description("Register one or more already-deployed per
   "--address <mandateOrName>",
   "Permission address or locally-tracked name; or a comma-separated list of addresses to register together in one signature"
 ).requiredOption("--sma <address>", "SMA to register the permission on").option("--label <label>", "Human-readable label shown in the signing UI").option("--json", "Emit machine-readable JSON").action(actionWith(mandateAttach));
+mandate.command("configure").description(
+  "Write per-account bounds on an already-deployed shared permission singleton (configureDirect; owner tx via the signing station). Pairs with `mandate attach`, which only registers \u2014 a registered-but-unconfigured singleton denies every call."
+).requiredOption("--address <singleton>", "Shared permission singleton address (deployed on this chain)").requiredOption("--sma <address>", "SMA to configure the singleton for").option("--params <hex>", "Pre-encoded config blob (0x-prefixed hex)").option("--args-file <path>", "JSON file of typed params (paired with --template)").option("--template <name>", "Template name (e.g. SwapPermission) \u2014 resolves the encoder for --args-file").option("--label <label>", "Human-readable label shown in the signing UI").option("--simulate-only", "Stop after the off-chain pre-flight (no signing, no gas)").option("--force", "Re-configure even if isConfigured is already true").option("--json", "Emit machine-readable JSON").action(actionWith(mandateConfigure));
 mandate.command("deploy-clone").description("[currently unavailable \u2014 no clone templates deployed on any chain; use `mandate deploy`] Deploy + register a standalone clone permission via the signing UI").requiredOption("--template <key>", "Standalone clone template key (e.g. boundedApprove)").requiredOption("--sma <address>", "SMA to deploy the clone for and register it on").option("--tokens <csv>", "Comma-separated allowed token addresses").option("--spenders <csv>", "Comma-separated allowed spender addresses").option("--max <amount>", "Max amount per tx in base units (default: uint256 max)").option("--label <label>", "Human-readable label to track this permission under").option("--json", "Emit machine-readable JSON").action(actionWith(mandateDeployClone));
 mandate.command("revoke").description("Revoke permission(s) from an SMA (EIP-712 RevokePermissions, owner-authorized)").option("--address <permissionOrName>", "Permission address, or a name tracked locally").requiredOption("--sma <address>", "Safe (SMA) to revoke the permission(s) from").option("--all", "Revoke every permission currently registered on the SMA").option("--json", "Output JSON").action(actionWith(mandateRevoke));
 mandate.command("templates").description("Show how to author your own permission contract (and any community-deployed addresses)").option("--json", "Emit machine-readable JSON").action(actionWith(mandateTemplates));