@eco-incorp/sauce 0.99.3 → 0.99.5

package/sdk/dist/routes/nest-dynamic.d.ts

@@ -0,0 +1,146 @@
+import { type ByteTemplate, type PlaceholderSpec } from "./template.js";
+import type { AddressInput, Hex, Intent } from "./types.js";
+export { WAD } from "./template.js";
+export type { AmountSource, ByteTemplate, PlaceholderSpec, TemplateSlot } from "./template.js";
+/**
+ * The canonical 32-byte sentinels a caller writes into a child intent wherever a runtime amount
+ * belongs — one ABI word each, which is every amount field on the EVM path (`reward.tokens[].amount`,
+ * `route.tokens[].amount`, `nativeAmount`, and any `uint256` inside a `route.calls[].data` the
+ * caller encodes itself).
+ *
+ * The tag `0x5acef00d` in the high bytes and a one-byte discriminant in the low byte make these
+ * ~1.5e77 — far outside any token amount — and structurally unmistakable in a trace. They are only a
+ * DEFAULT, though, not a magic value the splice recognises: `splitByPlaceholders` matches whatever
+ * sentinel the caller declares, and every match is counted and checked, so a collision fails loudly
+ * rather than corrupting a field.
+ */
+export declare const AMOUNT_IN_PLACEHOLDER: bigint;
+/** @see AMOUNT_IN_PLACEHOLDER */
+export declare const AMOUNT_OUT_PLACEHOLDER: bigint;
+/**
+ * The u64-sized twins, for a child whose DESTINATION is Solana: `encodeRouteSvm` Borsh-encodes
+ * `route.tokens[].amount` as a `u64` and `assertU64` REJECTS the 32-byte sentinels above outright,
+ * so a route-side amount on that leg needs one of these plus `width: 8, littleEndian: true`. The
+ * reward side of the same intent still uses the 32-byte sentinels — the reward is escrowed on the
+ * EVM source chain and ABI-encoded, whatever the destination is. That asymmetry is `encode.ts`'s,
+ * not this module's: `hashIntent` already encodes route and reward for different chain kinds.
+ */
+export declare const AMOUNT_IN_PLACEHOLDER_U64: bigint;
+/** @see AMOUNT_IN_PLACEHOLDER_U64 */
+export declare const AMOUNT_OUT_PLACEHOLDER_U64: bigint;
+/**
+ * Where the one runtime number comes from.
+ *
+ *  - `erc20Balance` — `IERC20.at(token).balanceOf(ctx.self())`, i.e. what the parent's earlier calls
+ *    left in the Pot. The default shape, and `IntentChainer`'s only one.
+ *  - `nativeBalance` — `ctx.selfBalance()`, for a native-in cascade.
+ *  - `expression` — verbatim SauceScript, the escape hatch for a program that ALREADY holds the
+ *    number in a local (a swap's own return value, when these statements are inlined into the
+ *    parent's own body rather than compiled as their own `cook()`). Not validated: whatever is
+ *    written here is what compiles.
+ */
+export type AmountMeasurement = {
+    readonly kind: "erc20Balance";
+    readonly token: AddressInput;
+} | {
+    readonly kind: "nativeBalance";
+} | {
+    readonly kind: "expression";
+    readonly expression: string;
+};
+export interface DynamicChildOptions {
+    /** The Portal the child is published on — the parent's own `route.portal`, since the child's
+     *  source chain IS the parent's execution chain (`nest.ts`'s module doc has the grounding). */
+    readonly portal: AddressInput;
+    readonly measure: AmountMeasurement;
+    /** WAD-denominated: `amountOut = ceil(amountIn * scale / WAD)`. Defaults to `WAD` (identity, so
+     *  `amountOut === amountIn`). Carries BOTH the decimals conversion (`1e30` for 6 -> 18 decimals,
+     *  `1e6` for 18 -> 6) and the proportional margin. */
+    readonly scale?: bigint;
+    /**
+     * Reject a measurement below this floor, reverting the parent's whole fulfillment. Defaults to
+     * `1n` — `IntentChainer.ZeroAmount`'s behaviour, and the right default: publishing a child funded
+     * with nothing burns the parent for nothing, and the revert is free because it unwinds the same
+     * transaction that produced the balance. Pass `0n` to opt out entirely.
+     */
+    readonly minAmountIn?: bigint;
+    /** Passed through to `publishAndFund`. Defaults to `false` — a partially funded child is a
+     *  stalled cascade (same default as `nest.ts`'s publishAndFund mode). */
+    readonly allowPartial?: boolean;
+    /**
+     * Which sentinels to cut the encoded child at. Defaults to both canonical 32-byte placeholders
+     * with no declared occurrence count. Supply this explicitly to PIN the counts (strongly
+     * recommended — see `PlaceholderSpec.occurrences`), to apply a per-slot scale, or to template a
+     * narrower/little-endian field such as a Borsh `u64`.
+     */
+    readonly placeholders?: readonly PlaceholderSpec[];
+    /**
+     * `"auto"` (default) emits one `approve(portal, amount)` per DISTINCT reward token before the
+     * publish — the Portal pulls reward legs with `safeTransferFrom(funder = msg.sender)`, and
+     * `msg.sender` here is the Pot, so without this the funding silently moves nothing and the call
+     * reverts on `InsufficientFunds`. `"none"` emits nothing, for a caller that approved elsewhere.
+     */
+    readonly approve?: "auto" | "none";
+    /** Overrides the native value forwarded to `publishAndFund`. Defaults to `reward.nativeAmount` —
+     *  exactly, never rounded up; see the module doc's note on `Refund.excessNative`. */
+    readonly value?: bigint;
+}
+/**
+ * The child's `publishAndFund` calldata, cut into literal segments and slots.
+ *
+ * Built by `portal.ts#publishAndFundTx` — the SAME encoder the static path uses, so a dynamic child
+ * and the concrete intent it renders to are bytes-identical by construction rather than by a second
+ * implementation agreeing. That is also what makes the off-chain check in `renderDynamicChild`
+ * meaningful: it compares this module's output against an encoder neither this module nor the test
+ * re-implements.
+ */
+export declare function dynamicChildTemplate(child: Intent, opts: DynamicChildOptions): ByteTemplate;
+/**
+ * The exact calldata the emitted program would build for a given measurement — the off-chain twin
+ * of the on-chain concatenation, and the only way to check this codegen without an engine. Pair it
+ * with `publishAndFundTx` on the equivalent CONCRETE child and the two must be byte-identical.
+ */
+export declare function renderDynamicChild(child: Intent, opts: DynamicChildOptions, amountIn: bigint): Hex;
+/**
+ * Asserts the child really is dynamic. `nest.ts#assertStaticChild` documents itself as "the SEAM
+ * where an S6 runtime-computed child will be rejected here, rather than silently mis-encoded by
+ * treating a placeholder as a real amount" — this is the other side of that seam, and it fails for
+ * the mirror-image reason: a child routed through THIS path with no sentinel anywhere would compile,
+ * publish, and fund a completely static intent while the program dutifully measured a balance and
+ * used it for nothing.
+ */
+export declare function assertDynamicChild(child: Intent, index: number, opts: DynamicChildOptions): void;
+/**
+ * The SauceScript statements ONE dynamic child contributes to a program: measure, floor-check,
+ * derive, approve, render, publish. `index` namespaces every local (`d<index>_…`) so several
+ * children merge into one program scope without colliding — the same discipline
+ * `nest.ts#nestedTransferStatements` uses.
+ *
+ * Emitted in exactly this order, and the order is load-bearing: the approve must precede the
+ * publish (the Portal pulls during it), and every guard must precede the approve (so a rejected
+ * measurement costs nothing and leaves no allowance behind).
+ */
+export declare function dynamicChildStatements(child: Intent, index: number, opts: DynamicChildOptions): readonly string[];
+/** One `{ child, opts }` pair per dynamic child, merged (in this array's order) into ONE program. */
+export interface DynamicNestEntry {
+    readonly child: Intent;
+    readonly opts: DynamicChildOptions;
+}
+/**
+ * Merges every entry's `dynamicChildStatements` into ONE `function main(){...}` program, shaped
+ * exactly like `nest.ts#nestedTransferProgram` so `intent-dsl.ts` slots it the same way: one extra
+ * `cook()` call in the parent's `route.calls`. `imports` is surfaced separately so a caller
+ * splicing the statements into its own program merges it rather than re-deriving it.
+ *
+ * WHY A SEPARATE COOK RATHER THAN APPENDED TO THE PARENT'S OWN BODY: the measurement is the Pot's
+ * BALANCE, which persists across calls, so a later cook sees exactly what an earlier one earned.
+ * That keeps the parent's own program untouched — the caller's body is compiled from the caller's
+ * source, byte for byte, with nothing injected. A caller who wants the two fused (to measure a
+ * swap's own RETURN value instead of a balance) inlines `dynamicChildStatements` with
+ * `measure: { kind: "expression", … }` into their own body instead.
+ */
+export declare function dynamicChildProgram(entries: readonly DynamicNestEntry[]): {
+    readonly source: string;
+    readonly imports: readonly string[];
+};
+//# sourceMappingURL=nest-dynamic.d.ts.map

package/sdk/dist/routes/nest-dynamic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest-dynamic.d.ts","sourceRoot":"","sources":["../../src/routes/nest-dynamic.ts"],"names":[],"mappings":"AAiEA,OAAO,EAOL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAE9E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,QAA2C,CAAC;AAC9E,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAA+B,CAAC;AACtE,qCAAqC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC;mGAC+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC;;0DAEsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;6EACyE;IACzE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC;yFACqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAG3F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,MAAM,GACf,GAAG,CAGL;AAqCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAiBhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,mBAAmB,GACxB,SAAS,MAAM,EAAE,CAsHnB;AAED,qGAAqG;AACrG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAcA"}

package/sdk/dist/routes/nest-dynamic.js

@@ -0,0 +1,308 @@
+/**
+ * eco-routes V2 DYNAMIC nesting — a child intent CREATED ON-CHAIN, from an amount nobody knew when
+ * the parent was signed.
+ *
+ * `nest.ts` is the static twin and opens with the reason this file exists: "A STATIC child (every
+ * reward field known off-chain) needs no on-chain struct construction and no Sauce-program
+ * involvement at all". The converse is what a real cascade needs and what that path cannot express:
+ * the child's reward IS the output of a swap that runs earlier in the SAME fulfillment, so its
+ * amount does not exist until the parent is already executing. You cannot pre-encode a number you
+ * have not measured.
+ *
+ * WHAT THIS DOES INSTEAD, in the parent's own Sauce program, on the parent's destination chain:
+ *
+ *   1. MEASURE — read the Pot's balance of the token the earlier calls produced (`ctx.self()` is the
+ *      Pot; see CLAUDE.md's engine notes). This is the one runtime measurement in the whole flow,
+ *      exactly as `IntentChainer._measure` describes it.
+ *   2. DERIVE — `amountOut = ceil(amountIn * scale / WAD)`. A delivery obligation is generally not
+ *      the measured input: `scale` carries both the decimals conversion and the proportional margin.
+ *   3. RENDER — concatenate the child's precompiled `publishAndFund` calldata around those two
+ *      numbers (`template.ts`), which is only possible because an ABI word splice moves nothing
+ *      after it.
+ *   4. CALL — `evm.call(portal, value, rendered)`. One call, no intermediary.
+ *
+ * NO CHAINER CONTRACT IS IN THE PATH, deliberately (2026-09-25 USER DIRECTIVE: "Chainer contracts in
+ * routes and routes-svm are just examples of how it should work. we don't need to use them. We can
+ * precompile sauce for nested intents and then template the bytes on the fly with numbers same way
+ * chainer does it."). `../eco-routes/contracts/chain/IntentChainer.sol` and `IntentTemplate.sol`
+ * were read as the REFERENCE DESIGN — the `Template { segments, items }` shape, the single
+ * measurement, the WAD-scaled `amountOut`, the ceil rounding, the `minAmountIn` floor — and none of
+ * it is called. There is nothing to deploy and nothing to trust beyond the Portal itself.
+ *
+ * WHY THIS IS SAFE WITHOUT ACCESS CONTROL — the same anchor `IntentChainer`'s NatSpec names, one
+ * layer down. The whole child (its route bytes, its `reward.creator`, its prover) is baked into the
+ * bytecode of a program that rides inside `parent.route.calls[k].data`, which
+ * `keccak256(abi.encode(route))` covers, which the `intentHash` `Inbox` re-derives covers. A solver
+ * choosing to fulfill the parent cannot alter the child it is publishing; it can only decline.
+ *
+ * WHAT IS DELIBERATELY NOT DEFENDED AGAINST, stated so it is a choice and not an oversight:
+ *
+ *   - A DONATED BALANCE rides along. The measurement is the Pot's CURRENT balance, not a delta
+ *     against a baseline — the same accepted property `svm/recipes/settle.sauce.ts` and
+ *     `nest.ts`'s transfer mode already carry, and the same one `IntentChainer` accepts. Do not add
+ *     baseline machinery here without changing those too.
+ *   - A RESIDUAL ALLOWANCE. `IntentSource._fundToken` pulls
+ *     `min(remaining, allowance(funder, portal), balanceOf(funder))`, so a fully funded leg consumes
+ *     the approval exactly; a PARTIALLY funded one (`allowPartial: true`, or a short balance) leaves
+ *     the remainder approved to the Portal. The Portal can only ever spend it into a vault, so this
+ *     is untidy rather than dangerous, and resetting would cost a second call on every cascade.
+ *   - NATIVE OVER-SEND. `publishAndFund` ends in `Refund.excessNative()`, which forwards the
+ *     Portal's ENTIRE balance to `msg.sender` — here the Pot. That is the hazard that made
+ *     `IntentChainer` refuse to be payable at all, but its `msg.sender` was a shared, solver-driven
+ *     contract; ours is the Pot executing this very program. `Refund.excessNative` also swallows a
+ *     failed send rather than reverting, so a Pot with no payable fallback loses the excess instead
+ *     of bricking the fulfillment. The emitted `value` is therefore exactly `reward.nativeAmount`,
+ *     never rounded up.
+ *
+ * Pure SOURCE text, no compiler import — same posture as `nest.ts`. `intent-dsl.ts` owns the
+ * `compile()` seam.
+ */
+import { denormalizeToEvm } from "./encode.js";
+import { formatBigint } from "../deposit/format.js";
+import { toAddressBigint } from "../token/params.js";
+import { ERC20_IMPORT_LINE } from "../token/evm.js";
+import { safeApproveStatements } from "../token/safe.js";
+import { publishAndFundTx } from "./portal.js";
+import { emitTemplate, renderTemplate, scaleAmount, splitByPlaceholders, maxScalableBase, WAD, } from "./template.js";
+export { WAD } from "./template.js";
+/**
+ * The canonical 32-byte sentinels a caller writes into a child intent wherever a runtime amount
+ * belongs — one ABI word each, which is every amount field on the EVM path (`reward.tokens[].amount`,
+ * `route.tokens[].amount`, `nativeAmount`, and any `uint256` inside a `route.calls[].data` the
+ * caller encodes itself).
+ *
+ * The tag `0x5acef00d` in the high bytes and a one-byte discriminant in the low byte make these
+ * ~1.5e77 — far outside any token amount — and structurally unmistakable in a trace. They are only a
+ * DEFAULT, though, not a magic value the splice recognises: `splitByPlaceholders` matches whatever
+ * sentinel the caller declares, and every match is counted and checked, so a collision fails loudly
+ * rather than corrupting a field.
+ */
+export const AMOUNT_IN_PLACEHOLDER = BigInt(`0x5acef00d${"00".repeat(27)}01`);
+/** @see AMOUNT_IN_PLACEHOLDER */
+export const AMOUNT_OUT_PLACEHOLDER = BigInt(`0x5acef00d${"00".repeat(27)}02`);
+/**
+ * The u64-sized twins, for a child whose DESTINATION is Solana: `encodeRouteSvm` Borsh-encodes
+ * `route.tokens[].amount` as a `u64` and `assertU64` REJECTS the 32-byte sentinels above outright,
+ * so a route-side amount on that leg needs one of these plus `width: 8, littleEndian: true`. The
+ * reward side of the same intent still uses the 32-byte sentinels — the reward is escrowed on the
+ * EVM source chain and ABI-encoded, whatever the destination is. That asymmetry is `encode.ts`'s,
+ * not this module's: `hashIntent` already encodes route and reward for different chain kinds.
+ */
+export const AMOUNT_IN_PLACEHOLDER_U64 = BigInt("0x5acef00d00000001");
+/** @see AMOUNT_IN_PLACEHOLDER_U64 */
+export const AMOUNT_OUT_PLACEHOLDER_U64 = BigInt("0x5acef00d00000002");
+function defaultPlaceholders() {
+    return [
+        { value: AMOUNT_IN_PLACEHOLDER, source: "amountIn" },
+        { value: AMOUNT_OUT_PLACEHOLDER, source: "amountOut" },
+    ];
+}
+/**
+ * The child's `publishAndFund` calldata, cut into literal segments and slots.
+ *
+ * Built by `portal.ts#publishAndFundTx` — the SAME encoder the static path uses, so a dynamic child
+ * and the concrete intent it renders to are bytes-identical by construction rather than by a second
+ * implementation agreeing. That is also what makes the off-chain check in `renderDynamicChild`
+ * meaningful: it compares this module's output against an encoder neither this module nor the test
+ * re-implements.
+ */
+export function dynamicChildTemplate(child, opts) {
+    const tx = publishAndFundTx(child, opts.allowPartial ?? false, { portal: opts.portal });
+    return splitByPlaceholders(tx.data, opts.placeholders ?? defaultPlaceholders());
+}
+/**
+ * The exact calldata the emitted program would build for a given measurement — the off-chain twin
+ * of the on-chain concatenation, and the only way to check this codegen without an engine. Pair it
+ * with `publishAndFundTx` on the equivalent CONCRETE child and the two must be byte-identical.
+ */
+export function renderDynamicChild(child, opts, amountIn) {
+    const scale = opts.scale ?? WAD;
+    return renderTemplate(dynamicChildTemplate(child, opts), amountIn, scaleAmount(amountIn, scale));
+}
+function evmTokenLiteral(token) {
+    return formatBigint(BigInt(denormalizeToEvm(token)));
+}
+/** Every distinct sentinel the caller declared, so a reward leg's amount can be recognised as
+ *  templated rather than literal. */
+function placeholderIndexOf(amount, placeholders) {
+    const i = placeholders.findIndex((p) => p.value === amount);
+    return i === -1 ? undefined : i;
+}
+/** The local a given placeholder's value lands in, found by matching its (source, scale) against
+ *  the slots `emitTemplate` named — never re-derived, so the approve and the reward tuple can never
+ *  disagree about the number. */
+function localForPlaceholder(spec, template, slotVars) {
+    const scale = spec.scale ?? WAD;
+    const i = template.slots.findIndex((s) => s.source === spec.source && s.scale === scale);
+    if (i === -1) {
+        // Unreachable via `dynamicChildStatements` (every slot comes from a declared placeholder), but
+        // a wrong local name here would approve or forward a different number than the bytes carry.
+        throw new Error(`nest-dynamic: no template slot renders (${spec.source}, scale ${scale}) — cannot name the local ` +
+            `holding that amount.`);
+    }
+    return slotVars[i];
+}
+/**
+ * Asserts the child really is dynamic. `nest.ts#assertStaticChild` documents itself as "the SEAM
+ * where an S6 runtime-computed child will be rejected here, rather than silently mis-encoded by
+ * treating a placeholder as a real amount" — this is the other side of that seam, and it fails for
+ * the mirror-image reason: a child routed through THIS path with no sentinel anywhere would compile,
+ * publish, and fund a completely static intent while the program dutifully measured a balance and
+ * used it for nothing.
+ */
+export function assertDynamicChild(child, index, opts) {
+    // Building the template IS the check: `splitByPlaceholders` throws when a declared sentinel matched
+    // nothing. What it cannot know is WHY that is interesting here, so its diagnostic is wrapped rather
+    // than re-derived -- the cause keeps the byte-level detail (which sentinel, how long the payload
+    // was) while this message names the decision the caller has to revisit.
+    try {
+        dynamicChildTemplate(child, opts);
+    }
+    catch (cause) {
+        const placeholders = opts.placeholders ?? defaultPlaceholders();
+        throw new Error(`assertDynamicChild: child[${index}] does not carry all ${placeholders.length} declared ` +
+            `placeholder(s), so there is nothing for a measurement to fill. Either write the sentinels into ` +
+            `the child's amount fields, or nest it with via: "publishAndFund"/"transfer" — a fully static ` +
+            `child routed through here would measure a balance and use it for nothing.`, { cause });
+    }
+}
+/**
+ * The SauceScript statements ONE dynamic child contributes to a program: measure, floor-check,
+ * derive, approve, render, publish. `index` namespaces every local (`d<index>_…`) so several
+ * children merge into one program scope without colliding — the same discipline
+ * `nest.ts#nestedTransferStatements` uses.
+ *
+ * Emitted in exactly this order, and the order is load-bearing: the approve must precede the
+ * publish (the Portal pulls during it), and every guard must precede the approve (so a rejected
+ * measurement costs nothing and leaves no allowance behind).
+ */
+export function dynamicChildStatements(child, index, opts) {
+    assertDynamicChild(child, index, opts);
+    const placeholders = opts.placeholders ?? defaultPlaceholders();
+    const template = dynamicChildTemplate(child, opts);
+    const scale = opts.scale ?? WAD;
+    if (scale <= 0n) {
+        throw new Error(`dynamicChildStatements: child[${index}] scale must be positive (a zero scale obliges the solver ` +
+            `to deliver nothing while collecting the whole escrow), got ${scale}`);
+    }
+    const minAmountIn = opts.minAmountIn ?? 1n;
+    const portalLiteral = formatBigint(toAddressBigint(opts.portal, "portal"));
+    const prefix = `d${index}_`;
+    const inVar = `${prefix}in`;
+    const statements = [];
+    // 1. MEASURE.
+    switch (opts.measure.kind) {
+        case "erc20Balance":
+            statements.push(`const ${inVar} = IERC20.at(${formatBigint(toAddressBigint(opts.measure.token, "measure.token"))}).balanceOf(ctx.self());`);
+            break;
+        case "nativeBalance":
+            statements.push(`const ${inVar} = ctx.selfBalance();`);
+            break;
+        case "expression":
+            statements.push(`const ${inVar} = ${opts.measure.expression};`);
+            break;
+    }
+    // 2. FLOOR. Before anything is derived or approved, so a rejected measurement leaves no trace.
+    if (minAmountIn > 0n) {
+        statements.push(`if (${inVar} < ${formatBigint(minAmountIn)}) { throw 'sauce: measured amount below floor'; }`);
+    }
+    // 3. DERIVE. The identity scale needs no arithmetic and no local at all -- `amountOut` IS the
+    // measurement -- which keeps the common case free of the overflow guard below entirely.
+    let outVar = inVar;
+    if (scale !== WAD) {
+        outVar = `${prefix}out`;
+        statements.push(`if (${inVar} > ${formatBigint(maxScalableBase(scale))}) { throw 'sauce: measured amount overflows scale'; }`, `const ${outVar} = (${inVar} * ${formatBigint(scale)} + ${formatBigint(WAD - 1n)}) / ${formatBigint(WAD)};`);
+    }
+    // 4. RENDER.
+    const emitted = emitTemplate(template, { prefix, amountInVar: inVar, amountOutVar: outVar });
+    statements.push(...emitted.statements);
+    // 5. APPROVE, one per DISTINCT reward token. A token whose legs are all literal approves the
+    // LARGEST of them, never their sum, for the reason `portal.ts#approvalTxs` states: `_fundToken`
+    // compares each leg against the vault's TOTAL balance and short-circuits, so the largest leg is
+    // the binding allowance. A token with exactly one leg, and that leg templated, approves the local
+    // holding the rendered amount. Anything else -- a templated leg alongside another leg in the same
+    // token -- has no single correct allowance to emit without runtime max arithmetic, and is
+    // rejected rather than guessed at.
+    //
+    // Issued through `token/safe.ts`, NOT as `IERC20.at(t).approve(...)`. The vendored IERC20
+    // declares a `bool` return, the compiler lowers that to call-then-decode even though nothing
+    // reads it, and decoding from empty returndata reverts on this engine -- so a USDT reward used to
+    // revert the entire parent fulfilment. The raw call avoids that decode and the emitted SafeERC20
+    // check then judges the result itself. A token that genuinely refuses the approve still reverts,
+    // because `evm.call` propagates it.
+    if ((opts.approve ?? "auto") === "auto") {
+        const byToken = new Map();
+        for (const t of child.reward.tokens) {
+            const key = evmTokenLiteral(t.token);
+            const group = byToken.get(key) ?? { literal: key, amounts: [] };
+            group.amounts.push(t.amount);
+            byToken.set(key, group);
+        }
+        const portalWord = { literal: toAddressBigint(opts.portal, "portal") };
+        let approveIndex = 0;
+        for (const [key, group] of byToken) {
+            const approvePrefix = `${prefix}${approveIndex++}`;
+            const templated = group.amounts
+                .map((a) => placeholderIndexOf(a, placeholders))
+                .filter((i) => i !== undefined);
+            if (templated.length === 0) {
+                const max = group.amounts.reduce((a, b) => (b > a ? b : a), 0n);
+                statements.push(...safeApproveStatements(approvePrefix, key, portalWord, { literal: max }));
+                continue;
+            }
+            if (group.amounts.length !== 1) {
+                throw new Error(`dynamicChildStatements: child[${index}]'s reward has ${group.amounts.length} legs in token ` +
+                    `${key} and at least one is templated — there is no single allowance to approve without ` +
+                    `runtime max arithmetic. Collapse them into one leg, or pass approve: "none" and emit the ` +
+                    `approval yourself.`);
+            }
+            const local = localForPlaceholder(placeholders[templated[0]], template, emitted.slotVars);
+            statements.push(...safeApproveStatements(approvePrefix, key, portalWord, { local }));
+        }
+    }
+    // 6. PUBLISH. `value` is the reward's own declared native amount -- templated too when the caller
+    // made it a placeholder, so the forwarded ETH and the encoded `reward.nativeAmount` are the same
+    // number by construction rather than by two agreeing derivations.
+    let valueExpr;
+    if (opts.value !== undefined) {
+        valueExpr = formatBigint(opts.value);
+    }
+    else {
+        const nativeSpec = placeholderIndexOf(child.reward.nativeAmount, placeholders);
+        valueExpr =
+            nativeSpec === undefined
+                ? formatBigint(child.reward.nativeAmount)
+                : localForPlaceholder(placeholders[nativeSpec], template, emitted.slotVars);
+    }
+    statements.push(`evm.call(${portalLiteral}, ${valueExpr}, ${emitted.dataVar});`);
+    return statements;
+}
+/**
+ * Merges every entry's `dynamicChildStatements` into ONE `function main(){...}` program, shaped
+ * exactly like `nest.ts#nestedTransferProgram` so `intent-dsl.ts` slots it the same way: one extra
+ * `cook()` call in the parent's `route.calls`. `imports` is surfaced separately so a caller
+ * splicing the statements into its own program merges it rather than re-deriving it.
+ *
+ * WHY A SEPARATE COOK RATHER THAN APPENDED TO THE PARENT'S OWN BODY: the measurement is the Pot's
+ * BALANCE, which persists across calls, so a later cook sees exactly what an earlier one earned.
+ * That keeps the parent's own program untouched — the caller's body is compiled from the caller's
+ * source, byte for byte, with nothing injected. A caller who wants the two fused (to measure a
+ * swap's own RETURN value instead of a balance) inlines `dynamicChildStatements` with
+ * `measure: { kind: "expression", … }` into their own body instead.
+ */
+export function dynamicChildProgram(entries) {
+    if (entries.length === 0) {
+        throw new Error("dynamicChildProgram: no entries — nothing to compile");
+    }
+    const statements = entries.flatMap((e, i) => dynamicChildStatements(e.child, i, e.opts));
+    // Sniffed from the emitted text rather than re-derived from the options on purpose: a caller's own
+    // `measure: { kind: "expression" }` may name `IERC20.at(...)` itself, and an options-derived check
+    // would miss that and emit a program referencing an unimported binding. The statements are what
+    // actually compiles, so they are what decides.
+    const needsErc20 = statements.some((s) => s.includes("IERC20.at("));
+    const imports = needsErc20 ? [ERC20_IMPORT_LINE] : [];
+    const body = statements.join("\n");
+    const source = `${imports.length > 0 ? `${imports.join("\n")}\n` : ""}function main() {\n${body}\n}`;
+    return { source, imports };
+}
+//# sourceMappingURL=nest-dynamic.js.map

package/sdk/dist/routes/nest-dynamic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest-dynamic.js","sourceRoot":"","sources":["../../src/routes/nest-dynamic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,GAAG,GAGJ,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9E,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AACtE,qCAAqC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAwDvE,SAAS,mBAAmB;IAC1B,OAAO;QACL,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE;QACpD,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAyB;IAC3E,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,OAAO,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAyB,EACzB,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAChC,OAAO,cAAc,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAuB;IAC9C,OAAO,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;qCACqC;AACrC,SAAS,kBAAkB,CACzB,MAAc,EACd,YAAwC;IAExC,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;iCAEiC;AACjC,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,QAAsB,EACtB,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACb,+FAA+F;QAC/F,4FAA4F;QAC5F,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,MAAM,WAAW,KAAK,4BAA4B;YAChG,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACxF,oGAAoG;IACpG,oGAAoG;IACpG,iGAAiG;IACjG,wEAAwE;IACxE,IAAI,CAAC;QACH,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,wBAAwB,YAAY,CAAC,MAAM,YAAY;YACvF,iGAAiG;YACjG,+FAA+F;YAC/F,2EAA2E,EAC7E,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,KAAa,EACb,IAAyB;IAEzB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAChC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,4DAA4D;YAChG,8DAA8D,KAAK,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,cAAc;IACd,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,cAAc;YACjB,UAAU,CAAC,IAAI,CACb,SAAS,KAAK,gBAAgB,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,0BAA0B,CAC3H,CAAC;YACF,MAAM;QACR,KAAK,eAAe;YAClB,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,uBAAuB,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,YAAY;YACf,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;YAChE,MAAM;IACV,CAAC;IAED,+FAA+F;IAC/F,IAAI,WAAW,GAAG,EAAE,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CACb,OAAO,KAAK,MAAM,YAAY,CAAC,WAAW,CAAC,mDAAmD,CAC/F,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC;QACxB,UAAU,CAAC,IAAI,CACb,OAAO,KAAK,MAAM,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,uDAAuD,EAC7G,SAAS,MAAM,OAAO,KAAK,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvC,6FAA6F;IAC7F,gGAAgG;IAChG,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,0FAA0F;IAC1F,mCAAmC;IACnC,EAAE;IACF,0FAA0F;IAC1F,6FAA6F;IAC7F,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,oCAAoC;IACpC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkD,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAChE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAW,CAAC;QAChF,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,GAAG,MAAM,GAAG,YAAY,EAAE,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO;iBAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;iBAC/C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChE,UAAU,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,kBAAkB,KAAK,CAAC,OAAO,CAAC,MAAM,iBAAiB;oBAC3F,GAAG,GAAG,mFAAmF;oBACzF,2FAA2F;oBAC3F,oBAAoB,CACvB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAE,CAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5F,UAAU,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,kEAAkE;IAClE,IAAI,SAAiB,CAAC;IACtB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,SAAS;YACP,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;gBACzC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,UAAU,CAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,YAAY,aAAa,KAAK,SAAS,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;IAEjF,OAAO,UAAU,CAAC;AACpB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoC;IAItE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,+CAA+C;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,sBAAsB,IAAI,KAAK,CAAC;IACrG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/sdk/dist/routes/nest.d.ts

@@ -53,8 +53,13 @@ export declare function assertStaticChild(_child: Intent): void;
  * instead of splicing a runtime `publishAndFund` — see `nestedTransferStatements`/
  * `nestedTransferProgram` below for the codegen, and this file's module doc for the on-chain grounding
  * (balance-based payout, no funded-flag gate, no publication requirement).
+ *
+ * `"dynamic"` is the one mode whose child is NOT static: its amounts are placeholders until the
+ * parent runs, and `nest-dynamic.ts` (not this file) emits the program that measures, derives and
+ * splices them. Everything here still applies to it EXCEPT the two invariants that read a child's
+ * amounts as numbers — see `assertNestingInvariants`'s 3 and 5.
  */
-export type NestVia = "transfer" | "publishAndFund";
+export type NestVia = "transfer" | "publishAndFund" | "dynamic";
 export interface NestChild {
     readonly intent: Intent;
     /** Opt-out of invariant 5's funding-coverage check for this one child: the legitimate case where
@@ -107,7 +112,11 @@ export interface AssertNestingInvariantsArgs {
  *  1. EVM parent — `parentChain.kind === "evm"`. The Solana Portal PROGRAM is not in eco-routes on
  *     `main` (zero `.rs`); a child's OWN destination may still be `svm`.
  *  2. Source match — every child's `sourceChainId` equals the parent's destination chain id.
- *  3. Static child — `assertStaticChild` per child (the S6 seam).
+ *  3. Static child — `assertStaticChild` per child (the S6 seam). SKIPPED for a `via: "dynamic"`
+ *     child, which is the case that seam was reserved for: its reward amounts are deliberately
+ *     placeholders. `nest-dynamic.ts#assertDynamicChild` is its mirror-image check (a child routed
+ *     there with NO placeholder is the error), and it runs at codegen time, where the options that
+ *     say which sentinels to look for are in scope.
  *  4. Deadlines INCREASE with depth — `child.route.deadline >= parentRoute.deadline` AND
  *     `child.reward.deadline >= parentRoute.deadline`. The child publishes DURING the parent's
  *     fulfillment, which `Inbox._fulfill` allows right up to the parent's own `route.deadline`
@@ -120,6 +129,9 @@ export interface AssertNestingInvariantsArgs {
  *     the (balance-based) funding, so there is nothing static left to compare against
  *     `parentRoute.tokens`/`nativeAmount`. See `intent-dsl.ts`'s T5 for the one native-only coverage
  *     check that DOES still apply to a transfer child (only when it opts into `fundNativeFromRoute`).
+ *     A `via: "dynamic"` child is skipped for a STRONGER reason than a transfer one: its reward
+ *     amount is a ~1.5e77 sentinel, so summing it would not merely be uninformative, it would fail
+ *     every parent. The funding is the runtime measurement, bounded by the Pot's own balance.
  *  6. No duplicate intent hash — `normalizeRoute` defaults `salt` to 32 zero bytes, so two
  *     structurally identical children silently collapse into the SAME intent. A repeat `intentHash`
  *     anywhere in `children` throws, pointing at `options.salt`.
@@ -142,13 +154,12 @@ export interface TransferNestEntry {
 /**
  * Merges every entry's `nestedTransferStatements` into ONE `function main(){...}` Sauce program —
  * `intent-dsl.ts` is the only caller that ever `compile()`s this text, keeping the compiler
- * dependency out of this pure module entirely. `imports`/`baseDirs` are surfaced separately so a
- * caller with its own `baseDirs`/compile options can merge them rather than re-deriving what this
+ * dependency out of this pure module entirely. `imports` is surfaced separately so a caller
+ * splicing these statements into its own program can merge them rather than re-deriving what this
  * program needs.
  */
 export declare function nestedTransferProgram(entries: readonly TransferNestEntry[]): {
     readonly source: string;
     readonly imports: readonly string[];
-    readonly baseDirs: readonly string[];
 };
 //# sourceMappingURL=nest.d.ts.map

package/sdk/dist/routes/nest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.ts","sourceRoot":"","sources":["../../src/routes/nest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAO7D,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAC;AAE3F,qGAAqG;AACrG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,SAAS,SAAS,EAAE,CAK9F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEpD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;oFAIgF;IAChF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;8FAC8F;AAC9F,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAEhE,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAC/C;uGACmG;IACnG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;6EACyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;iGAC6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,2BAA2B;IAC1C;wBACoB;IACpB,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC;qDACiD;IACjD,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;CACzC;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAmG/E;AA2DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,GACzB,SAAS,MAAM,EAAE,CA6DnB;AAED;0CAC0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAOA"}
+{"version":3,"file":"nest.d.ts","sourceRoot":"","sources":["../../src/routes/nest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAO7D,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAC;AAE3F,qGAAqG;AACrG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,SAAS,SAAS,EAAE,CAK9F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;oFAIgF;IAChF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;8FAC8F;AAC9F,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAEhE,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAC/C;uGACmG;IACnG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;6EACyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;iGAC6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,2BAA2B;IAC1C;wBACoB;IACpB,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC;qDACiD;IACjD,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;CACzC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAoG/E;AA2DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,GACzB,SAAS,MAAM,EAAE,CA0EnB;AAED;0CAC0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAOA"}

package/sdk/dist/routes/nest.js

@@ -24,7 +24,7 @@
 import { formatAddressField, formatBigint } from "../deposit/format.js";
 import { toAddressBigint } from "../token/params.js";
 import { ERC20_IMPORT_LINE } from "../token/evm.js";
-import { TOKEN_BASE_DIRS } from "../token/source.js";
+import { safeTransferStatements } from "../token/safe.js";
 import { denormalizeToEvm, hashIntent } from "./encode.js";
 import { approvalTxs, intentVaultAddressCall, publishAndFundTx } from "./portal.js";
 import { predictVaultAddress } from "./vault.js";
@@ -61,7 +61,11 @@ function tokenKey(token) {
  *  1. EVM parent — `parentChain.kind === "evm"`. The Solana Portal PROGRAM is not in eco-routes on
  *     `main` (zero `.rs`); a child's OWN destination may still be `svm`.
  *  2. Source match — every child's `sourceChainId` equals the parent's destination chain id.
- *  3. Static child — `assertStaticChild` per child (the S6 seam).
+ *  3. Static child — `assertStaticChild` per child (the S6 seam). SKIPPED for a `via: "dynamic"`
+ *     child, which is the case that seam was reserved for: its reward amounts are deliberately
+ *     placeholders. `nest-dynamic.ts#assertDynamicChild` is its mirror-image check (a child routed
+ *     there with NO placeholder is the error), and it runs at codegen time, where the options that
+ *     say which sentinels to look for are in scope.
  *  4. Deadlines INCREASE with depth — `child.route.deadline >= parentRoute.deadline` AND
  *     `child.reward.deadline >= parentRoute.deadline`. The child publishes DURING the parent's
  *     fulfillment, which `Inbox._fulfill` allows right up to the parent's own `route.deadline`
@@ -74,6 +78,9 @@ function tokenKey(token) {
  *     the (balance-based) funding, so there is nothing static left to compare against
  *     `parentRoute.tokens`/`nativeAmount`. See `intent-dsl.ts`'s T5 for the one native-only coverage
  *     check that DOES still apply to a transfer child (only when it opts into `fundNativeFromRoute`).
+ *     A `via: "dynamic"` child is skipped for a STRONGER reason than a transfer one: its reward
+ *     amount is a ~1.5e77 sentinel, so summing it would not merely be uninformative, it would fail
+ *     every parent. The funding is the runtime measurement, bounded by the Pot's own balance.
  *  6. No duplicate intent hash — `normalizeRoute` defaults `salt` to 32 zero bytes, so two
  *     structurally identical children silently collapse into the SAME intent. A repeat `intentHash`
  *     anywhere in `children` throws, pointing at `options.salt`.
@@ -103,8 +110,11 @@ export function assertNestingInvariants(args) {
                 `the parent's destination chain id (${parentDestinationId}) — a child's source chain is always ` +
                 `the parent's execution chain.`);
         }
-        // 3. Static child (the S6 seam).
-        assertStaticChild(intent);
+        // 3. Static child (the S6 seam) — the `"dynamic"` child is exactly what that seam was held
+        // open for, so it is the one mode that skips it rather than being rejected by it.
+        const via = child.via ?? "publishAndFund";
+        if (via !== "dynamic")
+            assertStaticChild(intent);
         // 4. Deadlines increase with depth.
         if (intent.route.deadline < parentRoute.deadline) {
             throw new Error(`assertNestingInvariants: child[${i}].route.deadline (${intent.route.deadline}) is earlier than ` +
@@ -117,9 +127,8 @@ export function assertNestingInvariants(args) {
                 `the parent's route.deadline (${parentRoute.deadline}) — see the route.deadline check above for why.`);
         }
         // 5. Funding coverage (accumulate; checked after the loop) — dropped entirely for a
-        // "transfer"-mode child (see the doc comment above); `fundedByBody` remains the
+        // "transfer"- or "dynamic"-mode child (see the doc comment above); `fundedByBody` remains the
         // publishAndFund-only opt-out it always was.
-        const via = child.via ?? "publishAndFund";
         if (via === "publishAndFund" && !child.fundedByBody) {
             childNativeTotal += intent.reward.nativeAmount;
             for (const t of intent.reward.tokens) {
@@ -234,7 +243,17 @@ export function nestedTransferStatements(child, index, opts) {
         if (clamp) {
             stmts.push(`const ${amtVar} = ${balVar} > ${capLit} ? ${capLit} : ${balVar};`);
         }
-        stmts.push(`if (${amtExpr} > 0n) { IERC20.at(${tokenLit}).transfer(${vaultVar}, ${amtExpr}); }`);
+        // Written with OpenZeppelin `SafeERC20` semantics rather than `IERC20.at(t).transfer(...)`:
+        // the vendored IERC20 declares a `bool` the compiler decodes even when discarded, which reverts
+        // on a no-return token (USDT). `token/safe.ts` issues the call raw and then CHECKS what came
+        // back -- so a token returning `false`, or an address with no code, fails rather than passing
+        // silently. `balanceOf` above keeps its binding; a `uint256` return is always there.
+        const transferStmts = safeTransferStatements(`n${index}_${i}_`, tokenLit, { local: vaultVar }, { local: amtExpr });
+        // The calldata consts are hoisted out of the zero-guard; the call AND its SafeERC20 check go
+        // inside it, since checking a call that never happened would read a stale result.
+        const firstCall = transferStmts.findIndex((line) => line.includes("evm.call("));
+        stmts.push(...transferStmts.slice(0, firstCall));
+        stmts.push(`if (${amtExpr} > 0n) { ${transferStmts.slice(firstCall).join(" ")} }`);
     });
     if (willTransferNative) {
         const capLit = formatBigint(child.reward.nativeAmount);
@@ -260,8 +279,8 @@ export function nestedTransferStatements(child, index, opts) {
 /**
  * Merges every entry's `nestedTransferStatements` into ONE `function main(){...}` Sauce program —
  * `intent-dsl.ts` is the only caller that ever `compile()`s this text, keeping the compiler
- * dependency out of this pure module entirely. `imports`/`baseDirs` are surfaced separately so a
- * caller with its own `baseDirs`/compile options can merge them rather than re-deriving what this
+ * dependency out of this pure module entirely. `imports` is surfaced separately so a caller
+ * splicing these statements into its own program can merge them rather than re-deriving what this
  * program needs.
  */
 export function nestedTransferProgram(entries) {
@@ -270,6 +289,6 @@ export function nestedTransferProgram(entries) {
     const imports = needsErc20 ? [ERC20_IMPORT_LINE] : [];
     const body = statements.join("\n");
     const source = `${imports.length > 0 ? `${imports.join("\n")}\n` : ""}function main() {\n${body}\n}`;
-    return { source, imports, baseDirs: needsErc20 ? [...TOKEN_BASE_DIRS] : [] };
+    return { source, imports };
 }
 //# sourceMappingURL=nest.js.map