@eco-incorp/sauce 0.99.4 → 0.99.6

package/sdk/dist/token/evm.d.ts

@@ -1,6 +1,9 @@
 import type { TokenApproveSpec, TokenBalanceSpec, TokenTransferSpec } from "./types.js";
 export declare const ERC20_IMPORT_LINE = "import { IERC20 } from \"./artifacts/IERC20.json\";";
-export declare function evmTransferStatement(spec: TokenTransferSpec): string;
-export declare function evmApproveStatement(spec: TokenApproveSpec): string;
+/** `transfer`, with OpenZeppelin `SafeERC20` semantics — see `token/safe.ts` for why this is not
+ *  `IERC20.at(t).transfer(...)`. `balanceOf` keeps that binding: a `uint256` return is always there. */
+export declare function evmTransferStatements(spec: TokenTransferSpec, prefix?: string): readonly string[];
+/** `approve`, with `SafeERC20` semantics plus `forceApprove`'s reset of a non-zero allowance. */
+export declare function evmApproveStatements(spec: TokenApproveSpec, prefix?: string): readonly string[];
 export declare function evmBalanceExpression(spec: TokenBalanceSpec): string;
 //# sourceMappingURL=evm.d.ts.map

package/sdk/dist/token/evm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evm.d.ts","sourceRoot":"","sources":["../../src/token/evm.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAExF,eAAO,MAAM,iBAAiB,wDAAsD,CAAC;AAmBrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAIpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAIlE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAGnE"}
+{"version":3,"file":"evm.d.ts","sourceRoot":"","sources":["../../src/token/evm.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAExF,eAAO,MAAM,iBAAiB,wDAAsD,CAAC;AA0BrF;wGACwG;AACxG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,SAAQ,GAAG,SAAS,MAAM,EAAE,CAMhG;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,SAAQ,GAAG,SAAS,MAAM,EAAE,CAM9F;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAGnE"}

package/sdk/dist/token/evm.js

@@ -1,10 +1,11 @@
 /**
  * The ERC20 arm — statement/expression builders for the universal token interface's EVM lowering.
- * Typed-binding call against the engine-vendored `IERC20` artifact, the exact shape
- * `swap/source.ts`/`deposit/source.ts` already emit — nothing new reaches the compiler.
+ * The writes go through `safe.ts` (OpenZeppelin `SafeERC20`); the read is a typed call against the
+ * engine-vendored `IERC20` artifact, the shape `swap/source.ts`/`deposit/source.ts` already emit.
  */
-import { formatAddressField, formatBigint } from "../deposit/format.js";
+import { formatAddressField } from "../deposit/format.js";
 import { toAddressBigint, toAmountBigint } from "./params.js";
+import { safeApproveStatements, safeTransferStatements } from "./safe.js";
 export const ERC20_IMPORT_LINE = `import { IERC20 } from "./artifacts/IERC20.json";`;
 function formatOwner(owner) {
     if (owner === undefined)
@@ -13,22 +14,32 @@ function formatOwner(owner) {
         return "ctx.self()";
     return formatAddressField(toAddressBigint(owner, "owner"));
 }
-function amountExpr(amount, tokenLiteral, label) {
-    if (amount === "balance")
-        return `IERC20.at(${tokenLiteral}).balanceOf(ctx.self())`;
-    // formatBigint takes a bigint, so a `number` amount CANNOT be stringified into the emitted
-    // source without going through toAmountBigint first.
-    return formatBigint(toAmountBigint(amount, label));
+/** A write's amount as a `token/safe.ts` word: a literal folds into the calldata, a `"balance"`
+ *  read is bound to a local first so the call and any later use see one value. */
+function amountWord(spec, tokenLiteral, label, prefix) {
+    if (spec.amount !== "balance") {
+        return { word: { literal: toAmountBigint(spec.amount, label) }, pre: [] };
+    }
+    const local = `${prefix}amt`;
+    return {
+        word: { local },
+        pre: [`const ${local} = IERC20.at(${tokenLiteral}).balanceOf(ctx.self());`],
+    };
 }
-export function evmTransferStatement(spec) {
+/** `transfer`, with OpenZeppelin `SafeERC20` semantics — see `token/safe.ts` for why this is not
+ *  `IERC20.at(t).transfer(...)`. `balanceOf` keeps that binding: a `uint256` return is always there. */
+export function evmTransferStatements(spec, prefix = "t0_") {
     const tokenLiteral = formatAddressField(toAddressBigint(spec.token, "token"));
-    const toLiteral = formatAddressField(toAddressBigint(spec.to, "to"));
-    return `IERC20.at(${tokenLiteral}).transfer(${toLiteral}, ${amountExpr(spec.amount, tokenLiteral, "Token.transfer amount")});`;
+    const to = toAddressBigint(spec.to, "to");
+    const { word, pre } = amountWord(spec, tokenLiteral, "Token.transfer amount", prefix);
+    return [...pre, ...safeTransferStatements(prefix, tokenLiteral, { literal: to }, word)];
 }
-export function evmApproveStatement(spec) {
+/** `approve`, with `SafeERC20` semantics plus `forceApprove`'s reset of a non-zero allowance. */
+export function evmApproveStatements(spec, prefix = "t0_") {
     const tokenLiteral = formatAddressField(toAddressBigint(spec.token, "token"));
-    const spenderLiteral = formatAddressField(toAddressBigint(spec.spender, "spender"));
-    return `IERC20.at(${tokenLiteral}).approve(${spenderLiteral}, ${amountExpr(spec.amount, tokenLiteral, "Token.approve amount")});`;
+    const spender = toAddressBigint(spec.spender, "spender");
+    const { word, pre } = amountWord(spec, tokenLiteral, "Token.approve amount", prefix);
+    return [...pre, ...safeApproveStatements(prefix, tokenLiteral, { literal: spender }, word)];
 }
 export function evmBalanceExpression(spec) {
     const tokenLiteral = formatAddressField(toAddressBigint(spec.token, "token"));

package/sdk/dist/token/evm.js.map

@@ -1 +1 @@
-{"version":3,"file":"evm.js","sourceRoot":"","sources":["../../src/token/evm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAErF,SAAS,WAAW,CAAC,KAAgC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAChG,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC1C,OAAO,kBAAkB,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CACjB,MAAmC,EACnC,YAAoB,EACpB,KAAa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,aAAa,YAAY,yBAAyB,CAAC;IACpF,2FAA2F;IAC3F,qDAAqD;IACrD,OAAO,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,OAAO,aAAa,YAAY,cAAc,SAAS,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,uBAAuB,CAAC,IAAI,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,OAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,OAAO,aAAa,YAAY,aAAa,cAAc,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,sBAAsB,CAAC,IAAI,CAAC;AACpI,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,OAAO,aAAa,YAAY,eAAe,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"evm.js","sourceRoot":"","sources":["../../src/token/evm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAG1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAErF,SAAS,WAAW,CAAC,KAAgC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAChG,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC1C,OAAO,kBAAkB,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;kFACkF;AAClF,SAAS,UAAU,CACjB,IAA6C,EAC7C,YAAoB,EACpB,KAAa,EACb,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,MAAM,KAAK,CAAC;IAC7B,OAAO;QACL,IAAI,EAAE,EAAE,KAAK,EAAE;QACf,GAAG,EAAE,CAAC,SAAS,KAAK,gBAAgB,YAAY,0BAA0B,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,IAAuB,EAAE,MAAM,GAAG,KAAK;IAC3E,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAEtF,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,MAAM,GAAG,KAAK;IACzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAQ,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,MAAM,YAAY,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,OAAO,aAAa,YAAY,eAAe,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC5E,CAAC"}

package/sdk/dist/token/index.d.ts

@@ -2,19 +2,19 @@
  * `@eco-incorp/sauce`'s `token` module — the universal token interface.
  *
  * One object, `Token`, exposing `transfer`/`approve`/`balanceOf` — lowered to an ERC20 call on an
- * EVM compile target, and to an SPL Token program CPI on `svm`. Installed as a DEFAULT GLOBAL (zero
- * import, `const Token: TokenApi`) by `sdk/src/routes/globals.ts`; this module is also importable
- * directly as `token.Token` (or any of its named exports) for a caller who prefers not to rely on
- * the global.
+ * EVM compile target, and to an SPL Token program CPI on `svm`. Re-exported from the package root
+ * as `Token` (with the `Token(addr)` call signature intersected in — see
+ * `sdk/src/routes/chain-exports.generated.ts`); this module is also importable directly as
+ * `token.Token`, or any of its named exports.
  *
  * Compiler-free, like `swap/` and `deposit/`: every function here returns SauceScript SOURCE (or a
  * structured EVM `Call`); the caller runs `compile()` with explicit options. See
  * `sdk/src/token/source.ts` for the per-target emission seam and `sdk/src/token/api.ts` for the
  * `Token`/`TokenCall` builder shape.
  *
- * Two arms, chosen per call (not per accessor): the ERC20 arm (`evm.ts`) emits a typed-binding
- * `IERC20.at(token).transfer(...)` call, identical to how `swap/source.ts`/`deposit/source.ts`
- * already call protocol contracts; the SPL arm (`svm.ts`) emits `svm.call(program, accounts,
+ * Two arms, chosen per call (not per accessor): the ERC20 arm (`evm.ts`) emits the writes with
+ * OpenZeppelin `SafeERC20` semantics through `safe.ts`, and the `balanceOf` read as a typed
+ * `IERC20.at(token).balanceOf(...)` binding; the SPL arm (`svm.ts`) emits `svm.call(program, accounts,
  * accounts)` against the SPL Token program, reusing the `svmSettleSource` idiom
  * (`accountData`/`accountUint`, the `le8` u64 byteswap helper, `TransferChecked`/`ApproveChecked`).
  * The two arms are NOT interchangeable at compile time — the compiler rejects a contract binding on

package/sdk/dist/token/index.js

@@ -2,19 +2,19 @@
  * `@eco-incorp/sauce`'s `token` module — the universal token interface.
  *
  * One object, `Token`, exposing `transfer`/`approve`/`balanceOf` — lowered to an ERC20 call on an
- * EVM compile target, and to an SPL Token program CPI on `svm`. Installed as a DEFAULT GLOBAL (zero
- * import, `const Token: TokenApi`) by `sdk/src/routes/globals.ts`; this module is also importable
- * directly as `token.Token` (or any of its named exports) for a caller who prefers not to rely on
- * the global.
+ * EVM compile target, and to an SPL Token program CPI on `svm`. Re-exported from the package root
+ * as `Token` (with the `Token(addr)` call signature intersected in — see
+ * `sdk/src/routes/chain-exports.generated.ts`); this module is also importable directly as
+ * `token.Token`, or any of its named exports.
  *
  * Compiler-free, like `swap/` and `deposit/`: every function here returns SauceScript SOURCE (or a
  * structured EVM `Call`); the caller runs `compile()` with explicit options. See
  * `sdk/src/token/source.ts` for the per-target emission seam and `sdk/src/token/api.ts` for the
  * `Token`/`TokenCall` builder shape.
  *
- * Two arms, chosen per call (not per accessor): the ERC20 arm (`evm.ts`) emits a typed-binding
- * `IERC20.at(token).transfer(...)` call, identical to how `swap/source.ts`/`deposit/source.ts`
- * already call protocol contracts; the SPL arm (`svm.ts`) emits `svm.call(program, accounts,
+ * Two arms, chosen per call (not per accessor): the ERC20 arm (`evm.ts`) emits the writes with
+ * OpenZeppelin `SafeERC20` semantics through `safe.ts`, and the `balanceOf` read as a typed
+ * `IERC20.at(token).balanceOf(...)` binding; the SPL arm (`svm.ts`) emits `svm.call(program, accounts,
  * accounts)` against the SPL Token program, reusing the `svmSettleSource` idiom
  * (`accountData`/`accountUint`, the `le8` u64 byteswap helper, `TransferChecked`/`ApproveChecked`).
  * The two arms are NOT interchangeable at compile time — the compiler rejects a contract binding on

package/sdk/dist/token/safe.d.ts

@@ -0,0 +1,17 @@
+/** One ABI word: a build-time constant, or the name of a SauceScript local holding it. */
+export type WordArg = {
+    readonly literal: bigint;
+} | {
+    readonly local: string;
+};
+/** `transfer(to, amount)`, checked the way `SafeERC20.safeTransfer` checks it. */
+export declare function safeTransferStatements(prefix: string, token: string, to: WordArg, amount: WordArg): readonly string[];
+/**
+ * `approve(spender, amount)`, checked like `SafeERC20` and reset like `forceApprove`.
+ *
+ * Emits, in order: read the current allowance from this contract to `spender`; if it is non-zero,
+ * `approve(spender, 0)` and check that; then `approve(spender, amount)` and check that. A token
+ * that refuses either call still reverts the whole execution.
+ */
+export declare function safeApproveStatements(prefix: string, token: string, spender: WordArg, amount: WordArg): readonly string[];
+//# sourceMappingURL=safe.d.ts.map

package/sdk/dist/token/safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../../src/token/safe.ts"],"names":[],"mappings":"AAqDA,0FAA0F;AAC1F,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAoJhF,kFAAkF;AAClF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,OAAO,GACd,SAAS,MAAM,EAAE,CAEnB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,OAAO,GACd,SAAS,MAAM,EAAE,CAgCnB"}

package/sdk/dist/token/safe.js

@@ -0,0 +1,211 @@
+/**
+ * ERC-20 writes with OpenZeppelin `SafeERC20` semantics, in SauceScript.
+ *
+ * WHY NOT THE OBVIOUS THING. The vendored `IERC20` declares `transfer`/`approve` as returning
+ * `bool`, and compiler 2.3.0 lowers a declared output to call-THEN-DECODE even when the program
+ * discards it. Decoding from empty returndata reverts on this engine, so `IERC20.at(usdt).approve(…)`
+ * reverts on any token that returns nothing — USDT among them.
+ *
+ * The first fix here skipped the decode entirely. That cured the revert and bought two silent
+ * failures with it, both of which `SafeERC20` exists to prevent:
+ *
+ *  - a token that returns `false` instead of reverting was treated as success — value lost, quietly;
+ *  - a call to an address with no code "succeeded", because a call to an EOA always does.
+ *
+ * WHAT THIS EMITS is `SafeERC20`'s check: issue the call as raw bytes so nothing is decoded on the
+ * way out, then look at what came back. Empty returndata is accepted only if the target HAS code;
+ * anything else must be an ABI word equal to `1`. A callee that reverts still reverts, because
+ * `evm.call` bubbles it.
+ *
+ * ```
+ * const r = evm.call(token, 0n, calldata);
+ * if (r.length == 0) { require(ctx.codeSize(token) > 0); }
+ * else { const [rok] = abi.decode(r, ["Uint256"]); require(rok == 1n); }
+ * ```
+ *
+ * The decode is load-bearing, not ceremony. It refuses fewer than 32 bytes and reads only the first
+ * word of a longer return, which is what OpenZeppelin does. `r.toBe()`, the obvious alternative,
+ * zero-pads a 1- or 31-byte return into a `1` and accepts it, and refuses a 64-byte return whose
+ * first word is `1` — wrong in both directions, and exactly what this file emitted until the
+ * execution matrix in `test/std/token/evm.e2e.test.ts` ran it beside OpenZeppelin.
+ *
+ * APPROVE ALSO HANDLES USDT'S RULE, which is `forceApprove`'s job. USDT reverts when a non-zero
+ * allowance is changed to another non-zero value, and that is not a theoretical hazard here: every
+ * intent on a chain shares ONE Executor-owned Pot, so a residual allowance left by an earlier
+ * fulfilment breaks the next one. OZ tries the approve and falls back on catching the revert; a
+ * reverting `evm.call` cannot be caught in a Sauce program, so this READS the allowance first — a
+ * `uint256`, always safe to decode — and emits a reset to zero only when it is non-zero. Same end
+ * state, decided before the call instead of after, at the cost of one STATICCALL.
+ *
+ * The calldata itself is built off-chain by the same viem encoder every other ERC-20 call in this
+ * SDK goes through, cut at the words only known at run time, and reassembled by the program with
+ * `.concat` — the mechanism `routes/template.ts` uses to splice an intent.
+ *
+ * `@sauce/token`'s EVM writes have the same semantics, as library functions. This file does not call
+ * them, and stays INLINE on purpose: the settle recipe is compiled by partners whose resolver serves
+ * only `./artifacts/IERC20.json`, so an emitted program cannot assume the library resolves.
+ * `test/std/token/evm.e2e.test.ts` holds the two to one behaviour, running both — and OpenZeppelin's
+ * own `SafeERC20` — over the same matrix of tokens.
+ */
+import { encodeFunctionData, getAbiItem } from "viem";
+import { ERC20ABI } from "../protocols/erc20/abis.js";
+/** Distinctive values with no chance of being a real spender or amount, planted in the run-time
+ *  positions so the cut points can be FOUND rather than assumed. Two of them because viem validates
+ *  an `address` argument as 20 bytes and will not accept a full word there. */
+const ADDRESS_SENTINEL = "0x5a0ce00000000000000000000000000000000ce5";
+const UINT_SENTINEL = (1n << 255n) + 0x5a0cen;
+function isLocal(arg) {
+    return "local" in arg;
+}
+/** The declared input types of `fn`, so an argument is encoded as whatever the ABI says it is
+ *  rather than as whatever this file assumed. */
+function inputTypes(fn) {
+    const item = getAbiItem({ abi: ERC20ABI, name: fn });
+    if (item === undefined)
+        throw new Error(`token/safe: ERC20ABI declares no ${fn}`);
+    return item.inputs.map((input) => input.type);
+}
+function encodeArg(type, arg) {
+    if (type === "address") {
+        return isLocal(arg)
+            ? ADDRESS_SENTINEL
+            : `0x${arg.literal.toString(16).padStart(40, "0")}`;
+    }
+    return isLocal(arg) ? UINT_SENTINEL : arg.literal;
+}
+/** The 32-byte word `encodeArg`'s sentinel occupies, as lowercase hex without `0x`. */
+function sentinelWord(type) {
+    return type === "address"
+        ? ADDRESS_SENTINEL.slice(2).padStart(64, "0")
+        : UINT_SENTINEL.toString(16).padStart(64, "0");
+}
+/**
+ * `<fn>(<args>)` calldata with every LITERAL argument already encoded, returned as the byte runs
+ * either side of the run-time words.
+ *
+ * Built by encoding the real call through viem with a sentinel in each run-time position and then
+ * cutting there, rather than by concatenating a hand-written selector with hand-padded words: the
+ * selector and the padding are then the encoder's, not this file's, and cannot drift from the ABI
+ * the rest of the SDK calls with. The sentinel is checked to land where expected, so a change in
+ * argument order fails here instead of shipping a mis-ordered call.
+ */
+function chunksFor(fn, args) {
+    const types = inputTypes(fn);
+    if (types.length !== args.length) {
+        throw new Error(`token/safe: ERC20ABI declares ${fn} with ${types.length} argument(s), got ${args.length}`);
+    }
+    const encoded = encodeFunctionData({
+        abi: ERC20ABI,
+        functionName: fn,
+        args: args.map((arg, i) => encodeArg(types[i], arg)),
+    }).toLowerCase();
+    const body = encoded.slice(10); // strip the 4-byte selector
+    const chunks = [];
+    let cursor = 0;
+    for (const [index, arg] of args.entries()) {
+        if (!isLocal(arg))
+            continue;
+        const at = body.indexOf(sentinelWord(types[index]), cursor);
+        if (at === -1 || at % 64 !== 0 || at / 64 !== index) {
+            throw new Error(`token/safe: ${fn} argument ${index} did not encode to word ${index} — the ERC20 ABI's ` +
+                "argument order has moved and this lowering would emit a mis-ordered call.");
+        }
+        chunks.push(`0x${body.slice(cursor, at)}`);
+        cursor = at + 64;
+    }
+    chunks.push(`0x${body.slice(cursor)}`);
+    // Only the FIRST run carries the selector; every later one is a pure byte run, and the run BETWEEN
+    // two adjacent run-time words is legitimately empty (`transfer(local, local)` has one).
+    chunks[0] = `0x${encoded.slice(2, 10)}${chunks[0].slice(2)}`;
+    return chunks;
+}
+/**
+ * The statements that issue one ERC-20 write with no output decode.
+ *
+ * `prefix` namespaces the locals this introduces, the same discipline `nest.ts` and
+ * `nest-dynamic.ts` already use so several of these merge into one program scope. Each literal byte
+ * run is bound to its own `const` before `.concat` is called on it — a method call directly on a
+ * `hex` literal is outside the compiler's M1 subset.
+ */
+function statementsFor(fn, prefix, token, args) {
+    const chunks = chunksFor(fn, args);
+    const statements = [];
+    const names = chunks.map((chunk, i) => {
+        const name = `${prefix}${fn === "approve" ? "ap" : "tr"}${i}`;
+        statements.push(`const ${name} = hex\`${chunk.slice(2)}\`;`);
+        return name;
+    });
+    let expr = names[0];
+    let chunkIndex = 1;
+    for (const arg of args) {
+        if (!isLocal(arg))
+            continue;
+        expr += `.concat(${arg.local}.toBytesBe(32))`;
+        // The trailing run after the LAST run-time word is empty whenever that word is last; binding and
+        // concatenating it would cost bytecode for nothing.
+        if (chunks[chunkIndex] !== "0x")
+            expr += `.concat(${names[chunkIndex]})`;
+        chunkIndex++;
+    }
+    const resultVar = `${prefix}${fn === "approve" ? "ar" : "tr"}`;
+    statements.push(`const ${resultVar} = evm.call(${token}, 0n, ${expr});`);
+    statements.push(optionalReturnCheck(resultVar, token));
+    // Drop the byte-run consts that were skipped above, so the program declares nothing unused. Only
+    // the `hex` chunks are candidates: the result const is named in the check below the call, not in
+    // the concat expression, and filtering on that would delete the call itself.
+    const unused = new Set(names.filter((name) => name !== names[0] && !expr.includes(name)));
+    return statements.filter((line) => {
+        const declared = /^const (\w+) = hex`/.exec(line);
+        return declared === null || !unused.has(declared[1]);
+    });
+}
+/**
+ * The `SafeERC20` check over the result of a write already issued into `resultVar`: empty
+ * returndata is success only from an address that has code, and anything else must decode as a
+ * word equal to 1 — see the header for why it is a decode and not `toBe()`.
+ */
+function optionalReturnCheck(resultVar, token) {
+    return (`if (${resultVar}.length == 0) { require(ctx.codeSize(${token}) > 0); } ` +
+        `else { const [${resultVar}ok] = abi.decode(${resultVar}, ["Uint256"]); ` +
+        `require(${resultVar}ok == 1n); }`);
+}
+/** `transfer(to, amount)`, checked the way `SafeERC20.safeTransfer` checks it. */
+export function safeTransferStatements(prefix, token, to, amount) {
+    return statementsFor("transfer", prefix, token, [to, amount]);
+}
+/**
+ * `approve(spender, amount)`, checked like `SafeERC20` and reset like `forceApprove`.
+ *
+ * Emits, in order: read the current allowance from this contract to `spender`; if it is non-zero,
+ * `approve(spender, 0)` and check that; then `approve(spender, amount)` and check that. A token
+ * that refuses either call still reverts the whole execution.
+ */
+export function safeApproveStatements(prefix, token, spender, amount) {
+    const selfVar = `${prefix}self`;
+    const allowanceVar = `${prefix}cur`;
+    const statements = [`const ${selfVar} = ctx.self();`];
+    // `allowance(owner, spender)` — a `uint256` return, so this one is safe to decode normally. The
+    // owner is the executing contract, which is only known at run time, so it is spliced like any
+    // other run-time word.
+    const query = chunksFor("allowance", [{ local: selfVar }, spender]);
+    const queryVars = query.map((chunk, i) => {
+        statements.push(`const ${prefix}q${i} = hex\`${chunk.slice(2)}\`;`);
+        return `${prefix}q${i}`;
+    });
+    let queryExpr = `${queryVars[0]}.concat(${selfVar}.toBytesBe(32))`;
+    if (query[1] !== "0x")
+        queryExpr += `.concat(${queryVars[1]})`;
+    if (isLocal(spender)) {
+        queryExpr += `.concat(${spender.local}.toBytesBe(32))`;
+        if (query[2] !== undefined && query[2] !== "0x")
+            queryExpr += `.concat(${queryVars[2]})`;
+    }
+    statements.push(`const ${prefix}qd = ${queryExpr};`, `const ${prefix}qr = evm.static(${token}, ${prefix}qd);`, `const [${allowanceVar}] = abi.decode(${prefix}qr, ["Uint256"]);`);
+    // The reset, only when there is something to reset. USDT refuses a non-zero -> non-zero change,
+    // and a shared Pot is exactly where a stale allowance is waiting.
+    const reset = statementsFor("approve", `${prefix}z`, token, [spender, { literal: 0n }]);
+    statements.push(`if (${allowanceVar} > 0n) {`, ...reset.map((line) => `  ${line}`), `}`);
+    statements.push(...statementsFor("approve", prefix, token, [spender, amount]));
+    return statements;
+}
+//# sourceMappingURL=safe.js.map

package/sdk/dist/token/safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.js","sourceRoot":"","sources":["../../src/token/safe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAA8B,MAAM,MAAM,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAKtD;;+EAE+E;AAC/E,MAAM,gBAAgB,GAAG,4CAAqD,CAAC;AAC/E,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC;AAE9C,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,OAAO,IAAI,GAAG,CAAC;AACxB,CAAC;AAED;iDACiD;AACjD,SAAS,UAAU,CAAC,EAAwC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAA4B,CAAC;IAChF,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;IAElF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAY;IAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC;YACjB,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAE,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAU,CAAC;IACjE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,EAAwC,EACxC,IAAwB;IAExB,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,iCAAiC,EAAE,SAAS,KAAK,CAAC,MAAM,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,GAAG,EAAE,QAAQ;QACb,YAAY,EAAE,EAAE;QAChB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAU;KAC/D,CAAC,CAAC,WAAW,EAAS,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;IAE5D,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,aAAa,KAAK,2BAA2B,KAAK,qBAAqB;gBACtF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,EAAS,CAAC,CAAC;QAClD,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAS,CAAC,CAAC;IAE9C,mGAAmG;IACnG,wFAAwF;IACxF,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAS,CAAC;IAErE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,EAA0B,EAC1B,MAAc,EACd,KAAa,EACb,IAAwB;IAExB,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9D,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,WAAW,GAAG,CAAC,KAAK,iBAAiB,CAAC;QAC9C,iGAAiG;QACjG,oDAAoD;QACpD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,WAAW,KAAK,CAAC,UAAU,CAAE,GAAG,CAAC;QAC1E,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,MAAM,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,UAAU,CAAC,IAAI,CAAC,SAAS,SAAS,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC;IACzE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAEvD,iGAAiG;IACjG,iGAAiG;IACjG,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,KAAa;IAC3D,OAAO,CACL,OAAO,SAAS,wCAAwC,KAAK,YAAY;QACzE,iBAAiB,SAAS,oBAAoB,SAAS,kBAAkB;QACzE,WAAW,SAAS,cAAc,CACnC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,KAAa,EACb,EAAW,EACX,MAAe;IAEf,OAAO,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,KAAa,EACb,OAAgB,EAChB,MAAe;IAEf,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,CAAC;IAChC,MAAM,YAAY,GAAG,GAAG,MAAM,KAAK,CAAC;IACpC,MAAM,UAAU,GAAa,CAAC,SAAS,OAAO,gBAAgB,CAAC,CAAC;IAEhE,gGAAgG;IAChG,8FAA8F;IAC9F,uBAAuB;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,UAAU,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,GAAG,GAAG,SAAS,CAAC,CAAC,CAAE,WAAW,OAAO,iBAAiB,CAAC;IACpE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,SAAS,IAAI,WAAW,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC;IAChE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrB,SAAS,IAAI,WAAW,OAAO,CAAC,KAAK,iBAAiB,CAAC;QACvD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,SAAS,IAAI,WAAW,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC;IAC5F,CAAC;IACD,UAAU,CAAC,IAAI,CACb,SAAS,MAAM,QAAQ,SAAS,GAAG,EACnC,SAAS,MAAM,mBAAmB,KAAK,KAAK,MAAM,MAAM,EACxD,UAAU,YAAY,kBAAkB,MAAM,mBAAmB,CAClE,CAAC;IAEF,gGAAgG;IAChG,kEAAkE;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,UAAU,CAAC,IAAI,CAAC,OAAO,YAAY,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACzF,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/sdk/dist/token/source.d.ts

@@ -1,9 +1,5 @@
 import { type SvmEmitState } from "./svm.js";
 import type { TokenSpec, TokenTarget } from "./types.js";
-/** `baseDirs` for compiling any program `tokenSource`/`tokenCallStatement` produces — resolves the
- *  generated `import { IERC20 } from "./artifacts/IERC20.json"` against this installed package's
- *  dist root. Same value/pattern as `swap/source.ts`'s `SWAP_BASE_DIRS`. */
-export declare const TOKEN_BASE_DIRS: readonly string[];
 /** The import lines a `tokenSource(specs, target)` program needs. On an EVM target: `IERC20`, iff
  *  any spec is `transfer`/`approve`/`balanceOf` (always — every op needs the binding). On `svm`:
  *  none (SVM ops use only the built-in `svm.sload`/`svm.call` globals). */

package/sdk/dist/token/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/token/source.ts"],"names":[],"mappings":"AAcA,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAQlB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIzD;;4EAE4E;AAC5E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA4B,CAAC;AAQ1E;;2EAE2E;AAC3E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,MAAM,EAAE,WAAW,GAClB,SAAS,MAAM,EAAE,CAGnB;AAED;;;oGAGoG;AACpG,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,WAAW,EACnB,KAAK,SAAI,EACT,QAAQ,CAAC,EAAE,YAAY,GACtB,MAAM,CAiBR;AAED;sEACsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAQ5E;AAED;;iFAEiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,MAAM,EAAE,CAOxF;AAED,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,SAAS,EAAE,EACtC,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,kBAAuB,GAC5B,MAAM,CAoCR"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/token/source.ts"],"names":[],"mappings":"AAYA,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAQlB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQzD;;2EAE2E;AAC3E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,SAAS,EAAE,EAC3B,MAAM,EAAE,WAAW,GAClB,SAAS,MAAM,EAAE,CAGnB;AAED;;;oGAGoG;AACpG,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,WAAW,EACnB,KAAK,SAAI,EACT,QAAQ,CAAC,EAAE,YAAY,GACtB,MAAM,CAsBR;AAED;sEACsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAQ5E;AAED;;iFAEiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,MAAM,EAAE,CAOxF;AAED,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,SAAS,EAAE,EACtC,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,kBAAuB,GAC5B,MAAM,CAoCR"}

package/sdk/dist/token/source.js

@@ -1,18 +1,12 @@
 /**
  * SauceScript SOURCE emission for the universal token interface — pure string templating, no
  * compiler import (matches `swap/source.ts`/`deposit/source.ts`'s posture: every compile option
- * stays explicit at the call site).
+ * stays explicit at the call site). The `IERC20` ABI an EVM program imports is served by the route
+ * compiler itself (`embedded/resolve.ts`), so compiling one needs no resolver option.
  */
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { evmApproveStatement, evmBalanceExpression, evmTransferStatement, ERC20_IMPORT_LINE, } from "./evm.js";
+import { evmApproveStatements, evmBalanceExpression, evmTransferStatements, ERC20_IMPORT_LINE, } from "./evm.js";
 import { accountRefsForApprove, accountRefsForTransfer, newSvmEmitState, svmAccountParamList, svmApproveLines, svmBalanceExpression, svmTransferLines, } from "./svm.js";
 import { assertNoDuplicateSvmRefs, isEvmTarget, validateApproveSpec, validateBalanceSpec, validateTransferSpec, } from "./params.js";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/** `baseDirs` for compiling any program `tokenSource`/`tokenCallStatement` produces — resolves the
- *  generated `import { IERC20 } from "./artifacts/IERC20.json"` against this installed package's
- *  dist root. Same value/pattern as `swap/source.ts`'s `SWAP_BASE_DIRS`. */
-export const TOKEN_BASE_DIRS = [join(__dirname, "..")];
 function validateSpec(spec, target) {
     if (spec.op === "transfer")
         validateTransferSpec(spec, target);
@@ -40,7 +34,10 @@ export function tokenCallStatement(spec, target, index = 0, svmState) {
         throw new Error("tokenCallStatement: Token.balanceOf has no statement form — use tokenExpression instead");
     }
     if (isEvmTarget(target)) {
-        return spec.op === "transfer" ? evmTransferStatement(spec) : evmApproveStatement(spec);
+        const prefix = `t${index}_`;
+        return (spec.op === "transfer"
+            ? evmTransferStatements(spec, prefix)
+            : evmApproveStatements(spec, prefix)).join("\n");
     }
     const lines = spec.op === "transfer"
         ? svmTransferLines(spec, index, state)

package/sdk/dist/token/source.js.map

@@ -1 +1 @@
-{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/token/source.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,IAAe,EAAE,MAAmB;IACxD,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU;QAAE,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;QAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;QAC7D,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,MAAmB;IAEnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,IAAe,EACf,MAAmB,EACnB,KAAK,GAAG,CAAC,EACT,QAAuB;IAEvB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,IAAI,eAAe,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GACT,IAAI,CAAC,EAAE,KAAK,UAAU;QACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,MAAmB;IAClE,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,EAAE,0DAA0D,CAC5F,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,MAAmB;IACnE,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAI,CAAC;IACvB,OAAO,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,IAAsC,EACtC,MAAmB,EACnB,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAiB,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI;SACD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CACd;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,2FAA2F;IAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACrE,+FAA+F;IAC/F,4FAA4F;IAC5F,MAAM,UAAU,GACd,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,EAAE,EAAE,EAAE,YAAY,MAAM,IAAI,MAAM,IAAI,UAAU,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/token/source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,SAAS,YAAY,CAAC,IAAe,EAAE,MAAmB;IACxD,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU;QAAE,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;QAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;QAC7D,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,MAAmB;IAEnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;oGAGoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,IAAe,EACf,MAAmB,EACnB,KAAK,GAAG,CAAC,EACT,QAAuB;IAEvB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,IAAI,eAAe,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC;QAC5B,OAAO,CACL,IAAI,CAAC,EAAE,KAAK,UAAU;YACpB,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC;YACrC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GACT,IAAI,CAAC,EAAE,KAAK,UAAU;QACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,MAAmB;IAClE,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,EAAE,0DAA0D,CAC5F,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,MAAmB;IACnE,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAI,CAAC;IACvB,OAAO,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,IAAsC,EACtC,MAAmB,EACnB,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAiB,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI;SACD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SACpB,IAAI,CAAC,IAAI,CAAC,CACd;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,2FAA2F;IAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACrE,+FAA+F;IAC/F,4FAA4F;IAC5F,MAAM,UAAU,GACd,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,EAAE,EAAE,EAAE,YAAY,MAAM,IAAI,MAAM,IAAI,UAAU,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/sdk/dist/verify/decode.d.ts

@@ -8,7 +8,7 @@
  *
  * ```
  * payload     := program , args
- * program     := 356 bytes                        ; SETTLE_WIRE.PROGRAM_BYTES — invariant
+ * program     := 435 bytes                        ; SETTLE_WIRE.PROGRAM_BYTES — invariant
  * args        := head , token_array
  * head        := tokens_ptr , minout , recipient  ; three 32-byte big-endian words
  * tokens_ptr  := word, value = 96                 ; byte offset WITHIN args of token_array
@@ -49,7 +49,7 @@
  *
  * WHAT THIS PROVES. `decodeSettleProgram` is STRUCTURAL: it pins the program's LENGTH and reads the
  * tail, so it tells you which `(tokens, minOut, recipient)` a payload carries and nothing about
- * what the 356 program bytes do. `validateSettleProgram` adds the authenticity half — one
+ * what the 435 program bytes do. `validateSettleProgram` adds the authenticity half — one
  * `keccak256` over the WHOLE program against `SETTLE_WIRE.PROGRAM_HASH` — and that is now a
  * complete answer rather than a partial one: because the arguments left the program, a matching
  * hash means the payload runs the audited `settle.sauce.ts` and nothing else — a statement about
@@ -163,18 +163,18 @@ export declare function bestEffortDecode(parse: SettleParse): DecodedSettleProgr
  * dirty upper bytes, and a zero recipient — see §4 for why. Throws `SettleDecodeError` (carrying a
  * stable `.code`) on any of the failures in `SettleFailureCode`.
  *
- * This is a STRUCTURAL decode: it proves the payload is `356 bytes || a canonical argument tail`.
- * It does NOT prove those 356 bytes are the settle program you audited — any 356-byte prefix
+ * This is a STRUCTURAL decode: it proves the payload is `435 bytes || a canonical argument tail`.
+ * It does NOT prove those 435 bytes are the settle program you audited — any 435-byte prefix
  * passes. Use `validateSettleProgram` when that matters, which is nearly always.
  */
 export declare function decodeSettleProgram(payload: Hex, programBytes?: number): DecodedSettleProgram;
 /**
- * `decodeSettleProgram` plus the authenticity pin: the payload's 356 program bytes must hash to
+ * `decodeSettleProgram` plus the authenticity pin: the payload's 435 program bytes must hash to
  * `SETTLE_WIRE.PROGRAM_HASH`. Because the arguments no longer live inside the program, a match
  * means the payload runs the audited `recipes/settle.sauce.ts` and nothing else — the whole
  * question, not the structural half.
  *
- * Throws `SettleDecodeError` with code `PROGRAM_HASH` when the program is a different 356 bytes,
+ * Throws `SettleDecodeError` with code `PROGRAM_HASH` when the program is a different 435 bytes,
  * and whatever `decodeSettleProgram` would throw otherwise.
  *
  * `accepted` overrides the pin. The dependency is a caret range and `SETTLE_WIRE` documents that a

package/sdk/dist/verify/decode.js

@@ -8,7 +8,7 @@
  *
  * ```
  * payload     := program , args
- * program     := 356 bytes                        ; SETTLE_WIRE.PROGRAM_BYTES — invariant
+ * program     := 435 bytes                        ; SETTLE_WIRE.PROGRAM_BYTES — invariant
  * args        := head , token_array
  * head        := tokens_ptr , minout , recipient  ; three 32-byte big-endian words
  * tokens_ptr  := word, value = 96                 ; byte offset WITHIN args of token_array
@@ -49,7 +49,7 @@
  *
  * WHAT THIS PROVES. `decodeSettleProgram` is STRUCTURAL: it pins the program's LENGTH and reads the
  * tail, so it tells you which `(tokens, minOut, recipient)` a payload carries and nothing about
- * what the 356 program bytes do. `validateSettleProgram` adds the authenticity half — one
+ * what the 435 program bytes do. `validateSettleProgram` adds the authenticity half — one
  * `keccak256` over the WHOLE program against `SETTLE_WIRE.PROGRAM_HASH` — and that is now a
  * complete answer rather than a partial one: because the arguments left the program, a matching
  * hash means the payload runs the audited `settle.sauce.ts` and nothing else — a statement about
@@ -290,8 +290,8 @@ export function bestEffortDecode(parse) {
  * dirty upper bytes, and a zero recipient — see §4 for why. Throws `SettleDecodeError` (carrying a
  * stable `.code`) on any of the failures in `SettleFailureCode`.
  *
- * This is a STRUCTURAL decode: it proves the payload is `356 bytes || a canonical argument tail`.
- * It does NOT prove those 356 bytes are the settle program you audited — any 356-byte prefix
+ * This is a STRUCTURAL decode: it proves the payload is `435 bytes || a canonical argument tail`.
+ * It does NOT prove those 435 bytes are the settle program you audited — any 435-byte prefix
  * passes. Use `validateSettleProgram` when that matters, which is nearly always.
  */
 export function decodeSettleProgram(payload, programBytes = SETTLE_WIRE.PROGRAM_BYTES) {
@@ -307,12 +307,12 @@ export function decodeSettleProgram(payload, programBytes = SETTLE_WIRE.PROGRAM_
     return decoded;
 }
 /**
- * `decodeSettleProgram` plus the authenticity pin: the payload's 356 program bytes must hash to
+ * `decodeSettleProgram` plus the authenticity pin: the payload's 435 program bytes must hash to
  * `SETTLE_WIRE.PROGRAM_HASH`. Because the arguments no longer live inside the program, a match
  * means the payload runs the audited `recipes/settle.sauce.ts` and nothing else — the whole
  * question, not the structural half.
  *
- * Throws `SettleDecodeError` with code `PROGRAM_HASH` when the program is a different 356 bytes,
+ * Throws `SettleDecodeError` with code `PROGRAM_HASH` when the program is a different 435 bytes,
  * and whatever `decodeSettleProgram` would throw otherwise.
  *
  * `accepted` overrides the pin. The dependency is a caret range and `SETTLE_WIRE` documents that a
@@ -347,7 +347,7 @@ export function validateSettleProgram(payload, accepted = [
     // That precedence is the guarantee, and it is the whole of it. Among parse errors there is no such
     // ordering: each is an artefact of the candidate that produced it, and the FIRST supplied pin's is
     // the one reported -- so with several pins and no match at all, the code can still differ by pin
-    // order (a 356-byte program read at 338 reports TOKENS_OFFSET where reading it at 356 reports
+    // order (measured on v1's 588-byte payload: a 410-byte pin reports TOKENS_OFFSET, a 461-byte pin
     // ARGS_TRUNCATED). Diagnostic only: through `intent.ts` every one of them collapses to `null`, and
     // with a single pin -- the default and common case -- there is no order to depend on.
     let hashMismatch = null;