@ensforge/core 0.0.0

package/dist/actions/permissions/registry-roles/index.js

@@ -0,0 +1,51 @@
+import { ContractError } from "../../../errors/contract-error.js";
+import { executeRead } from "../../../internal/read/execute-read.js";
+import { normalizeName } from "../../../names/normalize.js";
+import { readRegistryPermissionTarget } from "../../../internal/capabilities/registry-permissions.js";
+import { makeSingleWriteAction } from "../../../internal/write/single-write-action.js";
+import { AuthorizationError } from "../../../errors/authorization-error.js";
+import { decodePermissionAddress } from "../address.js";
+import { validateRoleBitmap } from "../roles.js";
+import { Effect } from "effect";
+import { encodeFunctionData } from "viem";
+import { permissionedRegistryV2RoleMutationAbi } from "@ensforge/contracts/v2";
+
+//#region src/actions/permissions/registry-roles/index.ts
+const makePreparer = (mutation) => Effect.fn(`ensforge.${mutation === "grantRoles" ? "grant" : "revoke"}RegistryRoles.prepare`)(function* (config, parameters) {
+	const name = yield* normalizeName.effect(parameters.name);
+	const account = yield* decodePermissionAddress(parameters.account, "role account");
+	const roles = yield* validateRoleBitmap(parameters.roles);
+	const target = yield* executeRead(config, {}, readRegistryPermissionTarget(name));
+	if (!target.supported) return yield* new AuthorizationError({
+		code: "WRITE_TARGET_UNAVAILABLE",
+		message: `Registry roles are unavailable for ${name}`
+	});
+	const data = yield* Effect.try({
+		try: () => encodeFunctionData({
+			abi: permissionedRegistryV2RoleMutationAbi,
+			functionName: mutation,
+			args: [
+				target.anyId,
+				roles,
+				account
+			]
+		}),
+		catch: (cause) => new ContractError({
+			code: "ENCODE_FAILED",
+			message: `Unable to encode ${mutation} for ${name}`,
+			cause
+		})
+	});
+	return {
+		to: target.registry,
+		data,
+		value: 0n,
+		protocol: "v2"
+	};
+});
+const grantRegistryRoles = makeSingleWriteAction("grantRegistryRoles", makePreparer("grantRoles"));
+const revokeRegistryRoles = makeSingleWriteAction("revokeRegistryRoles", makePreparer("revokeRoles"));
+
+//#endregion
+export { grantRegistryRoles, revokeRegistryRoles };
+//# sourceMappingURL=index.js.map

package/dist/actions/permissions/registry-roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/actions/permissions/registry-roles/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { permissionedRegistryV2RoleMutationAbi } from \"@ensforge/contracts/v2\";\nimport { encodeFunctionData } from \"viem\";\n\nimport type { EnsWriteIntentPreparer } from \"../../../action/write-intent.js\";\nimport type { EnsforgeConfig } from \"../../../config/config.js\";\nimport { AuthorizationError } from \"../../../errors/authorization-error.js\";\nimport { ContractError } from \"../../../errors/contract-error.js\";\nimport { readRegistryPermissionTarget } from \"../../../internal/capabilities/registry-permissions.js\";\nimport { executeRead } from \"../../../internal/read/execute-read.js\";\nimport { makeSingleWriteAction } from \"../../../internal/write/single-write-action.js\";\nimport { normalizeName } from \"../../../names/normalize.js\";\nimport type { WriteError } from \"../../../write/types.js\";\nimport { decodePermissionAddress } from \"../address.js\";\nimport { validateRoleBitmap } from \"../roles.js\";\nimport type { RegistryRolesMutationParameters } from \"./types.js\";\n\nconst makePreparer = (\n  mutation: \"grantRoles\" | \"revokeRoles\",\n): EnsWriteIntentPreparer<RegistryRolesMutationParameters, WriteError> =>\n  Effect.fn(`ensforge.${mutation === \"grantRoles\" ? \"grant\" : \"revoke\"}RegistryRoles.prepare`)(\n    function* (config: EnsforgeConfig, parameters) {\n      const name = yield* normalizeName.effect(parameters.name);\n      const account = yield* decodePermissionAddress(parameters.account, \"role account\");\n      const roles = yield* validateRoleBitmap(parameters.roles);\n      const target = yield* executeRead(config, {}, readRegistryPermissionTarget(name));\n      if (!target.supported) {\n        return yield* new AuthorizationError({\n          code: \"WRITE_TARGET_UNAVAILABLE\",\n          message: `Registry roles are unavailable for ${name}`,\n        });\n      }\n      const data = yield* Effect.try({\n        try: () =>\n          encodeFunctionData({\n            abi: permissionedRegistryV2RoleMutationAbi,\n            functionName: mutation,\n            args: [target.anyId, roles, account],\n          }),\n        catch: (cause) =>\n          new ContractError({\n            code: \"ENCODE_FAILED\",\n            message: `Unable to encode ${mutation} for ${name}`,\n            cause,\n          }),\n      });\n      return { to: target.registry, data, value: 0n, protocol: \"v2\" as const };\n    },\n  );\n\nexport const grantRegistryRoles = makeSingleWriteAction(\n  \"grantRegistryRoles\",\n  makePreparer(\"grantRoles\"),\n);\nexport const revokeRegistryRoles = makeSingleWriteAction(\n  \"revokeRegistryRoles\",\n  makePreparer(\"revokeRoles\"),\n);\n\nexport type {\n  GrantRegistryRolesError,\n  GrantRegistryRolesIntent,\n  GrantRegistryRolesParameters,\n  GrantRegistryRolesResult,\n  RegistryRolesMutationParameters,\n  RevokeRegistryRolesError,\n  RevokeRegistryRolesIntent,\n  RevokeRegistryRolesParameters,\n  RevokeRegistryRolesResult,\n} from \"./types.js\";\n"],"mappings":";;;;;;;;;;;;;AAkBA,MAAM,gBACJ,aAEA,OAAO,GAAG,YAAY,aAAa,eAAe,UAAU,SAAS,sBAAsB,CAAC,CAC1F,WAAW,QAAwB,YAAY;CAC7C,MAAM,OAAO,OAAO,cAAc,OAAO,WAAW,IAAI;CACxD,MAAM,UAAU,OAAO,wBAAwB,WAAW,SAAS,cAAc;CACjF,MAAM,QAAQ,OAAO,mBAAmB,WAAW,KAAK;CACxD,MAAM,SAAS,OAAO,YAAY,QAAQ,CAAC,GAAG,6BAA6B,IAAI,CAAC;CAChF,IAAI,CAAC,OAAO,WACV,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,sCAAsC;CACjD,CAAC;CAEH,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WACE,mBAAmB;GACjB,KAAK;GACL,cAAc;GACd,MAAM;IAAC,OAAO;IAAO;IAAO;GAAO;EACrC,CAAC;EACH,QAAQ,UACN,IAAI,cAAc;GAChB,MAAM;GACN,SAAS,oBAAoB,SAAS,OAAO;GAC7C;EACF,CAAC;CACL,CAAC;CACD,OAAO;EAAE,IAAI,OAAO;EAAU;EAAM,OAAO;EAAI,UAAU;CAAc;AACzE,CACF;AAEF,MAAa,qBAAqB,sBAChC,sBACA,aAAa,YAAY,CAC3B;AACA,MAAa,sBAAsB,sBACjC,uBACA,aAAa,aAAa,CAC5B"}

package/dist/actions/permissions/registry-roles/types.d.ts

@@ -0,0 +1,19 @@
+import { CallExecutionResult, WriteError } from "../../../write/types.js";
+import { EnsWriteIntent } from "../../../action/write-intent.js";
+//#region src/actions/permissions/registry-roles/types.d.ts
+interface RegistryRolesMutationParameters {
+  readonly name: string;
+  readonly account: string;
+  readonly roles: bigint;
+}
+type GrantRegistryRolesParameters = RegistryRolesMutationParameters;
+type RevokeRegistryRolesParameters = RegistryRolesMutationParameters;
+type GrantRegistryRolesResult = CallExecutionResult;
+type RevokeRegistryRolesResult = CallExecutionResult;
+type GrantRegistryRolesError = WriteError;
+type RevokeRegistryRolesError = WriteError;
+type GrantRegistryRolesIntent = EnsWriteIntent<GrantRegistryRolesResult, GrantRegistryRolesError>;
+type RevokeRegistryRolesIntent = EnsWriteIntent<RevokeRegistryRolesResult, RevokeRegistryRolesError>;
+//#endregion
+export { GrantRegistryRolesError, GrantRegistryRolesIntent, GrantRegistryRolesParameters, GrantRegistryRolesResult, RegistryRolesMutationParameters, RevokeRegistryRolesError, RevokeRegistryRolesIntent, RevokeRegistryRolesParameters, RevokeRegistryRolesResult };
+//# sourceMappingURL=types.d.ts.map

package/dist/actions/permissions/registry-roles/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../../src/actions/permissions/registry-roles/types.ts"],"mappings":";;;UAGiB;WACN;WACA;WACA;;KAGC,+BAA+B;KAC/B,gCAAgC;KAChC,2BAA2B;KAC3B,4BAA4B;KAC5B,0BAA0B;KAC1B,2BAA2B;KAC3B,2BAA2B,eACrC,0BACA;KAEU,4BAA4B,eACtC,2BACA"}

package/dist/actions/permissions/resolver-delegate-approval/index.d.ts

@@ -0,0 +1,9 @@
+import { CallExecutionResult, WriteError } from "../../../write/types.js";
+import { EnsWriteAction } from "../../../action/write-intent.js";
+import { SetResolverDelegateApprovalError, SetResolverDelegateApprovalIntent, SetResolverDelegateApprovalParameters, SetResolverDelegateApprovalResult } from "./types.js";
+import "../../../index.js";
+//#region src/actions/permissions/resolver-delegate-approval/index.d.ts
+declare const setResolverDelegateApproval: EnsWriteAction<SetResolverDelegateApprovalParameters, CallExecutionResult, WriteError>;
+//#endregion
+export { type SetResolverDelegateApprovalError, type SetResolverDelegateApprovalIntent, type SetResolverDelegateApprovalParameters, type SetResolverDelegateApprovalResult, setResolverDelegateApproval };
+//# sourceMappingURL=index.d.ts.map

package/dist/actions/permissions/resolver-delegate-approval/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/actions/permissions/resolver-delegate-approval/index.ts"],"mappings":";;;;;cAmEa,6BAA2B,eAAA,uCAAA,qBAAA"}

package/dist/actions/permissions/resolver-delegate-approval/index.js

@@ -0,0 +1,53 @@
+import { ContractError } from "../../../errors/contract-error.js";
+import { normalizeName } from "../../../names/normalize.js";
+import { namehash } from "../../../names/hashes.js";
+import { getManager } from "../../name/get-manager/index.js";
+import { getResolverCapabilities } from "../../capabilities/get-resolver-capabilities/index.js";
+import { makeSingleWriteAction } from "../../../internal/write/single-write-action.js";
+import { AuthorizationError } from "../../../errors/authorization-error.js";
+import { decodePermissionAddress } from "../address.js";
+import { Effect } from "effect";
+import { encodeFunctionData, isAddressEqual } from "viem";
+import { publicResolverV1ApproveAbi } from "@ensforge/contracts/v1";
+
+//#region src/actions/permissions/resolver-delegate-approval/index.ts
+const preparer = Effect.fn("ensforge.setResolverDelegateApproval.prepare")(function* (config, parameters, context) {
+	const name = yield* normalizeName.effect(parameters.name);
+	const delegate = yield* decodePermissionAddress(parameters.delegate, "resolver delegate");
+	const account = yield* decodePermissionAddress(typeof context.account === "string" ? context.account : context.account.address, "owner");
+	const [capabilities, manager] = yield* Effect.all([getResolverCapabilities.effect(config, { name }), getManager.effect(config, { name })], { concurrency: "unbounded" });
+	if (capabilities.address === null || capabilities.inherited || capabilities.authorization !== "owner-delegate") return yield* new AuthorizationError({
+		code: "WRITE_TARGET_UNAVAILABLE",
+		message: `A directly attached Public Resolver is required for ${name}`
+	});
+	if (manager === null || !isAddressEqual(manager, account)) return yield* new AuthorizationError({
+		code: "UNAUTHORIZED",
+		message: `${account} cannot administer resolver delegates for ${name}`
+	});
+	const data = yield* Effect.try({
+		try: () => encodeFunctionData({
+			abi: publicResolverV1ApproveAbi,
+			functionName: "approve",
+			args: [
+				namehash(name),
+				delegate,
+				parameters.approved
+			]
+		}),
+		catch: (cause) => new ContractError({
+			code: "ENCODE_FAILED",
+			message: `Unable to encode the resolver delegate approval for ${name}`,
+			cause
+		})
+	});
+	return {
+		to: capabilities.address,
+		data,
+		value: 0n
+	};
+});
+const setResolverDelegateApproval = makeSingleWriteAction("setResolverDelegateApproval", preparer);
+
+//#endregion
+export { setResolverDelegateApproval };
+//# sourceMappingURL=index.js.map

package/dist/actions/permissions/resolver-delegate-approval/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/actions/permissions/resolver-delegate-approval/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { publicResolverV1ApproveAbi } from \"@ensforge/contracts/v1\";\nimport { encodeFunctionData, isAddressEqual } from \"viem\";\n\nimport type { EnsWriteIntentPreparer } from \"../../../action/write-intent.js\";\nimport { AuthorizationError } from \"../../../errors/authorization-error.js\";\nimport { ContractError } from \"../../../errors/contract-error.js\";\nimport { makeSingleWriteAction } from \"../../../internal/write/single-write-action.js\";\nimport { namehash } from \"../../../names/hashes.js\";\nimport { normalizeName } from \"../../../names/normalize.js\";\nimport type { WriteError } from \"../../../write/types.js\";\nimport { getResolverCapabilities } from \"../../capabilities/get-resolver-capabilities/index.js\";\nimport { getManager } from \"../../name/get-manager/index.js\";\nimport { decodePermissionAddress } from \"../address.js\";\nimport type { SetResolverDelegateApprovalParameters } from \"./types.js\";\n\nconst preparer: EnsWriteIntentPreparer<SetResolverDelegateApprovalParameters, WriteError> =\n  Effect.fn(\"ensforge.setResolverDelegateApproval.prepare\")(\n    function* (config, parameters, context) {\n      const name = yield* normalizeName.effect(parameters.name);\n      const delegate = yield* decodePermissionAddress(parameters.delegate, \"resolver delegate\");\n      const account = yield* decodePermissionAddress(\n        typeof context.account === \"string\" ? context.account : context.account.address,\n        \"owner\",\n      );\n      const [capabilities, manager] = yield* Effect.all(\n        [\n          getResolverCapabilities.effect(config, { name }),\n          getManager.effect(config, { name }),\n        ] as const,\n        { concurrency: \"unbounded\" },\n      );\n      if (\n        capabilities.address === null ||\n        capabilities.inherited ||\n        capabilities.authorization !== \"owner-delegate\"\n      ) {\n        return yield* new AuthorizationError({\n          code: \"WRITE_TARGET_UNAVAILABLE\",\n          message: `A directly attached Public Resolver is required for ${name}`,\n        });\n      }\n      if (manager === null || !isAddressEqual(manager, account)) {\n        return yield* new AuthorizationError({\n          code: \"UNAUTHORIZED\",\n          message: `${account} cannot administer resolver delegates for ${name}`,\n        });\n      }\n      const data = yield* Effect.try({\n        try: () =>\n          encodeFunctionData({\n            abi: publicResolverV1ApproveAbi,\n            functionName: \"approve\",\n            args: [namehash(name), delegate, parameters.approved],\n          }),\n        catch: (cause) =>\n          new ContractError({\n            code: \"ENCODE_FAILED\",\n            message: `Unable to encode the resolver delegate approval for ${name}`,\n            cause,\n          }),\n      });\n      return { to: capabilities.address, data, value: 0n };\n    },\n  );\n\nexport const setResolverDelegateApproval = makeSingleWriteAction(\n  \"setResolverDelegateApproval\",\n  preparer,\n);\n\nexport type {\n  SetResolverDelegateApprovalError,\n  SetResolverDelegateApprovalIntent,\n  SetResolverDelegateApprovalParameters,\n  SetResolverDelegateApprovalResult,\n} from \"./types.js\";\n"],"mappings":";;;;;;;;;;;;;AAiBA,MAAM,WACJ,OAAO,GAAG,8CAA8C,CAAC,CACvD,WAAW,QAAQ,YAAY,SAAS;CACtC,MAAM,OAAO,OAAO,cAAc,OAAO,WAAW,IAAI;CACxD,MAAM,WAAW,OAAO,wBAAwB,WAAW,UAAU,mBAAmB;CACxF,MAAM,UAAU,OAAO,wBACrB,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,QAAQ,QAAQ,SACxE,OACF;CACA,MAAM,CAAC,cAAc,WAAW,OAAO,OAAO,IAC5C,CACE,wBAAwB,OAAO,QAAQ,EAAE,KAAK,CAAC,GAC/C,WAAW,OAAO,QAAQ,EAAE,KAAK,CAAC,CACpC,GACA,EAAE,aAAa,YAAY,CAC7B;CACA,IACE,aAAa,YAAY,QACzB,aAAa,aACb,aAAa,kBAAkB,kBAE/B,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,uDAAuD;CAClE,CAAC;CAEH,IAAI,YAAY,QAAQ,CAAC,eAAe,SAAS,OAAO,GACtD,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,GAAG,QAAQ,4CAA4C;CAClE,CAAC;CAEH,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WACE,mBAAmB;GACjB,KAAK;GACL,cAAc;GACd,MAAM;IAAC,SAAS,IAAI;IAAG;IAAU,WAAW;GAAQ;EACtD,CAAC;EACH,QAAQ,UACN,IAAI,cAAc;GAChB,MAAM;GACN,SAAS,uDAAuD;GAChE;EACF,CAAC;CACL,CAAC;CACD,OAAO;EAAE,IAAI,aAAa;EAAS;EAAM,OAAO;CAAG;AACrD,CACF;AAEF,MAAa,8BAA8B,sBACzC,+BACA,QACF"}

package/dist/actions/permissions/resolver-delegate-approval/types.d.ts

@@ -0,0 +1,14 @@
+import { CallExecutionResult, WriteError } from "../../../write/types.js";
+import { EnsWriteIntent } from "../../../action/write-intent.js";
+//#region src/actions/permissions/resolver-delegate-approval/types.d.ts
+interface SetResolverDelegateApprovalParameters {
+  readonly name: string;
+  readonly delegate: string;
+  readonly approved: boolean;
+}
+type SetResolverDelegateApprovalResult = CallExecutionResult;
+type SetResolverDelegateApprovalError = WriteError;
+type SetResolverDelegateApprovalIntent = EnsWriteIntent<SetResolverDelegateApprovalResult, SetResolverDelegateApprovalError>;
+//#endregion
+export { SetResolverDelegateApprovalError, SetResolverDelegateApprovalIntent, SetResolverDelegateApprovalParameters, SetResolverDelegateApprovalResult };
+//# sourceMappingURL=types.d.ts.map

package/dist/actions/permissions/resolver-delegate-approval/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../../src/actions/permissions/resolver-delegate-approval/types.ts"],"mappings":";;;UAGiB;WACN;WACA;WACA;;KAGC,oCAAoC;KACpC,mCAAmC;KACnC,oCAAoC,eAC9C,mCACA"}

package/dist/actions/permissions/resolver-roles/index.d.ts

@@ -0,0 +1,12 @@
+import { CallExecutionResult, WriteError } from "../../../write/types.js";
+import { EnsWriteAction } from "../../../action/write-intent.js";
+import { GrantResolverRolesError, GrantResolverRolesIntent, GrantResolverRolesParameters, GrantResolverRolesResult, GrantResolverRootRolesError, GrantResolverRootRolesIntent, GrantResolverRootRolesParameters, GrantResolverRootRolesResult, ResolverRolesMutationParameters, ResolverRootRolesMutationParameters, RevokeResolverRolesError, RevokeResolverRolesIntent, RevokeResolverRolesParameters, RevokeResolverRolesResult, RevokeResolverRootRolesError, RevokeResolverRootRolesIntent, RevokeResolverRootRolesParameters, RevokeResolverRootRolesResult } from "./types.js";
+import "../../../index.js";
+//#region src/actions/permissions/resolver-roles/index.d.ts
+declare const grantResolverRoles: EnsWriteAction<ResolverRolesMutationParameters, CallExecutionResult, WriteError>;
+declare const revokeResolverRoles: EnsWriteAction<ResolverRolesMutationParameters, CallExecutionResult, WriteError>;
+declare const grantResolverRootRoles: EnsWriteAction<ResolverRootRolesMutationParameters, CallExecutionResult, WriteError>;
+declare const revokeResolverRootRoles: EnsWriteAction<ResolverRootRolesMutationParameters, CallExecutionResult, WriteError>;
+//#endregion
+export { type GrantResolverRolesError, type GrantResolverRolesIntent, type GrantResolverRolesParameters, type GrantResolverRolesResult, type GrantResolverRootRolesError, type GrantResolverRootRolesIntent, type GrantResolverRootRolesParameters, type GrantResolverRootRolesResult, type ResolverRolesMutationParameters, type ResolverRootRolesMutationParameters, type RevokeResolverRolesError, type RevokeResolverRolesIntent, type RevokeResolverRolesParameters, type RevokeResolverRolesResult, type RevokeResolverRootRolesError, type RevokeResolverRootRolesIntent, type RevokeResolverRootRolesParameters, type RevokeResolverRootRolesResult, grantResolverRoles, grantResolverRootRoles, revokeResolverRoles, revokeResolverRootRoles };
+//# sourceMappingURL=index.d.ts.map

package/dist/actions/permissions/resolver-roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/actions/permissions/resolver-roles/index.ts"],"mappings":";;;;;cAsIa,oBAAkB,eAAA,iCAAA,qBAAA;cAIlB,qBAAmB,eAAA,iCAAA,qBAAA;cAInB,wBAAsB,eAAA,qCAAA,qBAAA;cAItB,yBAAuB,eAAA,qCAAA,qBAAA"}

package/dist/actions/permissions/resolver-roles/index.js

@@ -0,0 +1,125 @@
+import { ContractError } from "../../../errors/contract-error.js";
+import { executeRead } from "../../../internal/read/execute-read.js";
+import { normalizeName } from "../../../names/normalize.js";
+import { resolverRecordRole } from "../../../internal/capabilities/resolver-resource.js";
+import { dnsEncodeName } from "../../../names/dns.js";
+import { readResolverPermissionTarget } from "../../../internal/capabilities/resolver-permissions.js";
+import { makeSingleWriteAction } from "../../../internal/write/single-write-action.js";
+import { AuthorizationError } from "../../../errors/authorization-error.js";
+import { decodePermissionAddress } from "../address.js";
+import { validateRoleBitmap } from "../roles.js";
+import { Effect } from "effect";
+import { encodeFunctionData } from "viem";
+import { permissionedResolverV2AuthorizeAddrRolesAbi, permissionedResolverV2AuthorizeDataRolesAbi, permissionedResolverV2AuthorizeNameRolesAbi, permissionedResolverV2AuthorizeTextRolesAbi, permissionedResolverV2RootRoleMutationAbi } from "@ensforge/contracts/v2";
+
+//#region src/actions/permissions/resolver-roles/index.ts
+const readTarget = Effect.fn("ensforge.resolverRoles.target")(function* (config, name) {
+	const normalized = yield* normalizeName.effect(name);
+	const target = yield* executeRead(config, {}, readResolverPermissionTarget(normalized));
+	if (!target.supported || target.inherited) return yield* new AuthorizationError({
+		code: "WRITE_TARGET_UNAVAILABLE",
+		message: `A directly attached Permissioned Resolver is required for ${normalized}`
+	});
+	return {
+		normalized,
+		target
+	};
+});
+const makeScopedPreparer = (mutation) => Effect.fn(`ensforge.${mutation === "grantRoles" ? "grant" : "revoke"}ResolverRoles.prepare`)(function* (config, parameters) {
+	const { normalized, target } = yield* readTarget(config, parameters.name);
+	const account = yield* decodePermissionAddress(parameters.account, "role account");
+	const roles = yield* validateRoleBitmap(parameters.roles ?? resolverRecordRole(parameters.record));
+	const expectedRole = resolverRecordRole(parameters.record);
+	if ((parameters.record.type === "address" || parameters.record.type === "text" || parameters.record.type === "data") && roles !== expectedRole) return yield* new AuthorizationError({
+		code: "RECORD_UNSUPPORTED",
+		message: `${parameters.record.type} authorization requires its exact resolver role`
+	});
+	const encodedName = yield* dnsEncodeName.effect(normalized);
+	const data = yield* Effect.try({
+		try: () => {
+			const grant = mutation === "grantRoles";
+			if (parameters.record.type === "address") return encodeFunctionData({
+				abi: permissionedResolverV2AuthorizeAddrRolesAbi,
+				functionName: "authorizeAddrRoles",
+				args: [
+					encodedName,
+					parameters.record.coinType,
+					account,
+					grant
+				]
+			});
+			if (parameters.record.type === "text") return encodeFunctionData({
+				abi: permissionedResolverV2AuthorizeTextRolesAbi,
+				functionName: "authorizeTextRoles",
+				args: [
+					encodedName,
+					parameters.record.key,
+					account,
+					grant
+				]
+			});
+			if (parameters.record.type === "data") return encodeFunctionData({
+				abi: permissionedResolverV2AuthorizeDataRolesAbi,
+				functionName: "authorizeDataRoles",
+				args: [
+					encodedName,
+					parameters.record.key,
+					account,
+					grant
+				]
+			});
+			return encodeFunctionData({
+				abi: permissionedResolverV2AuthorizeNameRolesAbi,
+				functionName: "authorizeNameRoles",
+				args: [
+					encodedName,
+					roles,
+					account,
+					grant
+				]
+			});
+		},
+		catch: (cause) => new ContractError({
+			code: "ENCODE_FAILED",
+			message: `Unable to encode ${mutation} for ${normalized}`,
+			cause
+		})
+	});
+	return {
+		to: target.resolver,
+		data,
+		value: 0n,
+		protocol: "v2"
+	};
+});
+const makeRootPreparer = (mutation) => Effect.fn(`ensforge.${mutation === "grantRootRoles" ? "grant" : "revoke"}ResolverRootRoles.prepare`)(function* (config, parameters) {
+	const { normalized, target } = yield* readTarget(config, parameters.name);
+	const account = yield* decodePermissionAddress(parameters.account, "root role account");
+	const roles = yield* validateRoleBitmap(parameters.roles);
+	const data = yield* Effect.try({
+		try: () => encodeFunctionData({
+			abi: permissionedResolverV2RootRoleMutationAbi,
+			functionName: mutation,
+			args: [roles, account]
+		}),
+		catch: (cause) => new ContractError({
+			code: "ENCODE_FAILED",
+			message: `Unable to encode ${mutation} for ${normalized}`,
+			cause
+		})
+	});
+	return {
+		to: target.resolver,
+		data,
+		value: 0n,
+		protocol: "v2"
+	};
+});
+const grantResolverRoles = makeSingleWriteAction("grantResolverRoles", makeScopedPreparer("grantRoles"));
+const revokeResolverRoles = makeSingleWriteAction("revokeResolverRoles", makeScopedPreparer("revokeRoles"));
+const grantResolverRootRoles = makeSingleWriteAction("grantResolverRootRoles", makeRootPreparer("grantRootRoles"));
+const revokeResolverRootRoles = makeSingleWriteAction("revokeResolverRootRoles", makeRootPreparer("revokeRootRoles"));
+
+//#endregion
+export { grantResolverRoles, grantResolverRootRoles, revokeResolverRoles, revokeResolverRootRoles };
+//# sourceMappingURL=index.js.map

package/dist/actions/permissions/resolver-roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/actions/permissions/resolver-roles/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport {\n  permissionedResolverV2AuthorizeAddrRolesAbi,\n  permissionedResolverV2AuthorizeDataRolesAbi,\n  permissionedResolverV2AuthorizeNameRolesAbi,\n  permissionedResolverV2AuthorizeTextRolesAbi,\n  permissionedResolverV2RootRoleMutationAbi,\n} from \"@ensforge/contracts/v2\";\nimport { encodeFunctionData } from \"viem\";\n\nimport type { EnsWriteIntentPreparer } from \"../../../action/write-intent.js\";\nimport type { EnsforgeConfig } from \"../../../config/config.js\";\nimport { AuthorizationError } from \"../../../errors/authorization-error.js\";\nimport { ContractError } from \"../../../errors/contract-error.js\";\nimport { readResolverPermissionTarget } from \"../../../internal/capabilities/resolver-permissions.js\";\nimport { resolverRecordRole } from \"../../../internal/capabilities/resolver-resource.js\";\nimport { executeRead } from \"../../../internal/read/execute-read.js\";\nimport { makeSingleWriteAction } from \"../../../internal/write/single-write-action.js\";\nimport { dnsEncodeName } from \"../../../names/dns.js\";\nimport { normalizeName } from \"../../../names/normalize.js\";\nimport type { WriteError } from \"../../../write/types.js\";\nimport { decodePermissionAddress } from \"../address.js\";\nimport { validateRoleBitmap } from \"../roles.js\";\nimport type {\n  ResolverRolesMutationParameters,\n  ResolverRootRolesMutationParameters,\n} from \"./types.js\";\n\nconst readTarget = Effect.fn(\"ensforge.resolverRoles.target\")(function* (\n  config: EnsforgeConfig,\n  name: string,\n) {\n  const normalized = yield* normalizeName.effect(name);\n  const target = yield* executeRead(config, {}, readResolverPermissionTarget(normalized));\n  if (!target.supported || target.inherited) {\n    return yield* new AuthorizationError({\n      code: \"WRITE_TARGET_UNAVAILABLE\",\n      message: `A directly attached Permissioned Resolver is required for ${normalized}`,\n    });\n  }\n  return { normalized, target } as const;\n});\n\nconst makeScopedPreparer = (\n  mutation: \"grantRoles\" | \"revokeRoles\",\n): EnsWriteIntentPreparer<ResolverRolesMutationParameters, WriteError> =>\n  Effect.fn(`ensforge.${mutation === \"grantRoles\" ? \"grant\" : \"revoke\"}ResolverRoles.prepare`)(\n    function* (config: EnsforgeConfig, parameters) {\n      const { normalized, target } = yield* readTarget(config, parameters.name);\n      const account = yield* decodePermissionAddress(parameters.account, \"role account\");\n      const roles = yield* validateRoleBitmap(\n        parameters.roles ?? resolverRecordRole(parameters.record),\n      );\n      const expectedRole = resolverRecordRole(parameters.record);\n      if (\n        (parameters.record.type === \"address\" ||\n          parameters.record.type === \"text\" ||\n          parameters.record.type === \"data\") &&\n        roles !== expectedRole\n      ) {\n        return yield* new AuthorizationError({\n          code: \"RECORD_UNSUPPORTED\",\n          message: `${parameters.record.type} authorization requires its exact resolver role`,\n        });\n      }\n      const encodedName = yield* dnsEncodeName.effect(normalized);\n      const data = yield* Effect.try({\n        try: () => {\n          const grant = mutation === \"grantRoles\";\n          if (parameters.record.type === \"address\") {\n            return encodeFunctionData({\n              abi: permissionedResolverV2AuthorizeAddrRolesAbi,\n              functionName: \"authorizeAddrRoles\",\n              args: [encodedName, parameters.record.coinType, account, grant],\n            });\n          }\n          if (parameters.record.type === \"text\") {\n            return encodeFunctionData({\n              abi: permissionedResolverV2AuthorizeTextRolesAbi,\n              functionName: \"authorizeTextRoles\",\n              args: [encodedName, parameters.record.key, account, grant],\n            });\n          }\n          if (parameters.record.type === \"data\") {\n            return encodeFunctionData({\n              abi: permissionedResolverV2AuthorizeDataRolesAbi,\n              functionName: \"authorizeDataRoles\",\n              args: [encodedName, parameters.record.key, account, grant],\n            });\n          }\n          return encodeFunctionData({\n            abi: permissionedResolverV2AuthorizeNameRolesAbi,\n            functionName: \"authorizeNameRoles\",\n            args: [encodedName, roles, account, grant],\n          });\n        },\n        catch: (cause) =>\n          new ContractError({\n            code: \"ENCODE_FAILED\",\n            message: `Unable to encode ${mutation} for ${normalized}`,\n            cause,\n          }),\n      });\n      return { to: target.resolver, data, value: 0n, protocol: \"v2\" as const };\n    },\n  );\n\nconst makeRootPreparer = (\n  mutation: \"grantRootRoles\" | \"revokeRootRoles\",\n): EnsWriteIntentPreparer<ResolverRootRolesMutationParameters, WriteError> =>\n  Effect.fn(\n    `ensforge.${mutation === \"grantRootRoles\" ? \"grant\" : \"revoke\"}ResolverRootRoles.prepare`,\n  )(function* (config: EnsforgeConfig, parameters) {\n    const { normalized, target } = yield* readTarget(config, parameters.name);\n    const account = yield* decodePermissionAddress(parameters.account, \"root role account\");\n    const roles = yield* validateRoleBitmap(parameters.roles);\n    const data = yield* Effect.try({\n      try: () =>\n        encodeFunctionData({\n          abi: permissionedResolverV2RootRoleMutationAbi,\n          functionName: mutation,\n          args: [roles, account],\n        }),\n      catch: (cause) =>\n        new ContractError({\n          code: \"ENCODE_FAILED\",\n          message: `Unable to encode ${mutation} for ${normalized}`,\n          cause,\n        }),\n    });\n    return { to: target.resolver, data, value: 0n, protocol: \"v2\" as const };\n  });\n\nexport const grantResolverRoles = makeSingleWriteAction(\n  \"grantResolverRoles\",\n  makeScopedPreparer(\"grantRoles\"),\n);\nexport const revokeResolverRoles = makeSingleWriteAction(\n  \"revokeResolverRoles\",\n  makeScopedPreparer(\"revokeRoles\"),\n);\nexport const grantResolverRootRoles = makeSingleWriteAction(\n  \"grantResolverRootRoles\",\n  makeRootPreparer(\"grantRootRoles\"),\n);\nexport const revokeResolverRootRoles = makeSingleWriteAction(\n  \"revokeResolverRootRoles\",\n  makeRootPreparer(\"revokeRootRoles\"),\n);\n\nexport type {\n  GrantResolverRolesError,\n  GrantResolverRolesIntent,\n  GrantResolverRolesParameters,\n  GrantResolverRolesResult,\n  GrantResolverRootRolesError,\n  GrantResolverRootRolesIntent,\n  GrantResolverRootRolesParameters,\n  GrantResolverRootRolesResult,\n  ResolverRolesMutationParameters,\n  ResolverRootRolesMutationParameters,\n  RevokeResolverRolesError,\n  RevokeResolverRolesIntent,\n  RevokeResolverRolesParameters,\n  RevokeResolverRolesResult,\n  RevokeResolverRootRolesError,\n  RevokeResolverRootRolesIntent,\n  RevokeResolverRootRolesParameters,\n  RevokeResolverRootRolesResult,\n} from \"./types.js\";\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,aAAa,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC5D,QACA,MACA;CACA,MAAM,aAAa,OAAO,cAAc,OAAO,IAAI;CACnD,MAAM,SAAS,OAAO,YAAY,QAAQ,CAAC,GAAG,6BAA6B,UAAU,CAAC;CACtF,IAAI,CAAC,OAAO,aAAa,OAAO,WAC9B,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,6DAA6D;CACxE,CAAC;CAEH,OAAO;EAAE;EAAY;CAAO;AAC9B,CAAC;AAED,MAAM,sBACJ,aAEA,OAAO,GAAG,YAAY,aAAa,eAAe,UAAU,SAAS,sBAAsB,CAAC,CAC1F,WAAW,QAAwB,YAAY;CAC7C,MAAM,EAAE,YAAY,WAAW,OAAO,WAAW,QAAQ,WAAW,IAAI;CACxE,MAAM,UAAU,OAAO,wBAAwB,WAAW,SAAS,cAAc;CACjF,MAAM,QAAQ,OAAO,mBACnB,WAAW,SAAS,mBAAmB,WAAW,MAAM,CAC1D;CACA,MAAM,eAAe,mBAAmB,WAAW,MAAM;CACzD,KACG,WAAW,OAAO,SAAS,aAC1B,WAAW,OAAO,SAAS,UAC3B,WAAW,OAAO,SAAS,WAC7B,UAAU,cAEV,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,GAAG,WAAW,OAAO,KAAK;CACrC,CAAC;CAEH,MAAM,cAAc,OAAO,cAAc,OAAO,UAAU;CAC1D,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WAAW;GACT,MAAM,QAAQ,aAAa;GAC3B,IAAI,WAAW,OAAO,SAAS,WAC7B,OAAO,mBAAmB;IACxB,KAAK;IACL,cAAc;IACd,MAAM;KAAC;KAAa,WAAW,OAAO;KAAU;KAAS;IAAK;GAChE,CAAC;GAEH,IAAI,WAAW,OAAO,SAAS,QAC7B,OAAO,mBAAmB;IACxB,KAAK;IACL,cAAc;IACd,MAAM;KAAC;KAAa,WAAW,OAAO;KAAK;KAAS;IAAK;GAC3D,CAAC;GAEH,IAAI,WAAW,OAAO,SAAS,QAC7B,OAAO,mBAAmB;IACxB,KAAK;IACL,cAAc;IACd,MAAM;KAAC;KAAa,WAAW,OAAO;KAAK;KAAS;IAAK;GAC3D,CAAC;GAEH,OAAO,mBAAmB;IACxB,KAAK;IACL,cAAc;IACd,MAAM;KAAC;KAAa;KAAO;KAAS;IAAK;GAC3C,CAAC;EACH;EACA,QAAQ,UACN,IAAI,cAAc;GAChB,MAAM;GACN,SAAS,oBAAoB,SAAS,OAAO;GAC7C;EACF,CAAC;CACL,CAAC;CACD,OAAO;EAAE,IAAI,OAAO;EAAU;EAAM,OAAO;EAAI,UAAU;CAAc;AACzE,CACF;AAEF,MAAM,oBACJ,aAEA,OAAO,GACL,YAAY,aAAa,mBAAmB,UAAU,SAAS,0BACjE,CAAC,CAAC,WAAW,QAAwB,YAAY;CAC/C,MAAM,EAAE,YAAY,WAAW,OAAO,WAAW,QAAQ,WAAW,IAAI;CACxE,MAAM,UAAU,OAAO,wBAAwB,WAAW,SAAS,mBAAmB;CACtF,MAAM,QAAQ,OAAO,mBAAmB,WAAW,KAAK;CACxD,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WACE,mBAAmB;GACjB,KAAK;GACL,cAAc;GACd,MAAM,CAAC,OAAO,OAAO;EACvB,CAAC;EACH,QAAQ,UACN,IAAI,cAAc;GAChB,MAAM;GACN,SAAS,oBAAoB,SAAS,OAAO;GAC7C;EACF,CAAC;CACL,CAAC;CACD,OAAO;EAAE,IAAI,OAAO;EAAU;EAAM,OAAO;EAAI,UAAU;CAAc;AACzE,CAAC;AAEH,MAAa,qBAAqB,sBAChC,sBACA,mBAAmB,YAAY,CACjC;AACA,MAAa,sBAAsB,sBACjC,uBACA,mBAAmB,aAAa,CAClC;AACA,MAAa,yBAAyB,sBACpC,0BACA,iBAAiB,gBAAgB,CACnC;AACA,MAAa,0BAA0B,sBACrC,2BACA,iBAAiB,iBAAiB,CACpC"}

package/dist/actions/permissions/resolver-roles/types.d.ts

@@ -0,0 +1,34 @@
+import { CallExecutionResult, WriteError } from "../../../write/types.js";
+import { EnsWriteIntent } from "../../../action/write-intent.js";
+import { ResolverRecord } from "../../../internal/capabilities/resolver-resource.js";
+//#region src/actions/permissions/resolver-roles/types.d.ts
+interface ResolverRolesMutationParameters {
+  readonly name: string;
+  readonly account: string;
+  readonly record: ResolverRecord;
+  readonly roles?: bigint;
+}
+interface ResolverRootRolesMutationParameters {
+  readonly name: string;
+  readonly account: string;
+  readonly roles: bigint;
+}
+type GrantResolverRolesParameters = ResolverRolesMutationParameters;
+type RevokeResolverRolesParameters = ResolverRolesMutationParameters;
+type GrantResolverRootRolesParameters = ResolverRootRolesMutationParameters;
+type RevokeResolverRootRolesParameters = ResolverRootRolesMutationParameters;
+type GrantResolverRolesResult = CallExecutionResult;
+type RevokeResolverRolesResult = CallExecutionResult;
+type GrantResolverRootRolesResult = CallExecutionResult;
+type RevokeResolverRootRolesResult = CallExecutionResult;
+type GrantResolverRolesError = WriteError;
+type RevokeResolverRolesError = WriteError;
+type GrantResolverRootRolesError = WriteError;
+type RevokeResolverRootRolesError = WriteError;
+type GrantResolverRolesIntent = EnsWriteIntent<GrantResolverRolesResult, GrantResolverRolesError>;
+type RevokeResolverRolesIntent = EnsWriteIntent<RevokeResolverRolesResult, RevokeResolverRolesError>;
+type GrantResolverRootRolesIntent = EnsWriteIntent<GrantResolverRootRolesResult, GrantResolverRootRolesError>;
+type RevokeResolverRootRolesIntent = EnsWriteIntent<RevokeResolverRootRolesResult, RevokeResolverRootRolesError>;
+//#endregion
+export { GrantResolverRolesError, GrantResolverRolesIntent, GrantResolverRolesParameters, GrantResolverRolesResult, GrantResolverRootRolesError, GrantResolverRootRolesIntent, GrantResolverRootRolesParameters, GrantResolverRootRolesResult, ResolverRolesMutationParameters, ResolverRootRolesMutationParameters, RevokeResolverRolesError, RevokeResolverRolesIntent, RevokeResolverRolesParameters, RevokeResolverRolesResult, RevokeResolverRootRolesError, RevokeResolverRootRolesIntent, RevokeResolverRootRolesParameters, RevokeResolverRootRolesResult };
+//# sourceMappingURL=types.d.ts.map

package/dist/actions/permissions/resolver-roles/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../../src/actions/permissions/resolver-roles/types.ts"],"mappings":";;;;UAIiB;WACN;WACA;WACA,QAAQ;WACR;;UAGM;WACN;WACA;WACA;;KAGC,+BAA+B;KAC/B,gCAAgC;KAChC,mCAAmC;KACnC,oCAAoC;KACpC,2BAA2B;KAC3B,4BAA4B;KAC5B,+BAA+B;KAC/B,gCAAgC;KAChC,0BAA0B;KAC1B,2BAA2B;KAC3B,8BAA8B;KAC9B,+BAA+B;KAC/B,2BAA2B,eACrC,0BACA;KAEU,4BAA4B,eACtC,2BACA;KAEU,+BAA+B,eACzC,8BACA;KAEU,gCAAgC,eAC1C,+BACA"}

package/dist/actions/permissions/roles.js

@@ -0,0 +1,13 @@
+import { WritePlanError } from "../../errors/write-plan-error.js";
+import { Effect } from "effect";
+
+//#region src/actions/permissions/roles.ts
+const validateRoleBitmap = (roles) => roles > 0n && roles < 1n << 256n ? Effect.succeed(roles) : Effect.fail(new WritePlanError({
+	code: "INVALID_CALL_PLAN",
+	message: "Role bitmap must be a non-zero uint256",
+	cause: roles
+}));
+
+//#endregion
+export { validateRoleBitmap };
+//# sourceMappingURL=roles.js.map

package/dist/actions/permissions/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","names":[],"sources":["../../../src/actions/permissions/roles.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { WritePlanError } from \"../../errors/write-plan-error.js\";\n\nexport const validateRoleBitmap = (roles: bigint) =>\n  roles > 0n && roles < 1n << 256n\n    ? Effect.succeed(roles)\n    : Effect.fail(\n        new WritePlanError({\n          code: \"INVALID_CALL_PLAN\",\n          message: \"Role bitmap must be a non-zero uint256\",\n          cause: roles,\n        }),\n      );\n"],"mappings":";;;;AAIA,MAAa,sBAAsB,UACjC,QAAQ,MAAM,QAAQ,MAAM,OACxB,OAAO,QAAQ,KAAK,IACpB,OAAO,KACL,IAAI,eAAe;CACjB,MAAM;CACN,SAAS;CACT,OAAO;AACT,CAAC,CACH"}

package/dist/actions/permissions/set-record-permissions/index.d.ts

@@ -0,0 +1,9 @@
+import { EnsAction } from "../../../action/action.js";
+import { WriteError } from "../../../write/types.js";
+import { AppliedRecordPermission, SetRecordPermissionsError, SetRecordPermissionsParameters, SetRecordPermissionsResult } from "./types.js";
+import "../../../index.js";
+//#region src/actions/permissions/set-record-permissions/index.d.ts
+declare const setRecordPermissions: EnsAction<SetRecordPermissionsParameters, SetRecordPermissionsResult, WriteError>;
+//#endregion
+export { type AppliedRecordPermission, type SetRecordPermissionsError, type SetRecordPermissionsParameters, type SetRecordPermissionsResult, setRecordPermissions };
+//# sourceMappingURL=index.d.ts.map

package/dist/actions/permissions/set-record-permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/actions/permissions/set-record-permissions/index.ts"],"mappings":";;;;;cAwJa,sBAAoB,UAAA,gCAAA,4BAAA"}

package/dist/actions/permissions/set-record-permissions/index.js

@@ -0,0 +1,122 @@
+import { defineAction } from "../../../action/action.js";
+import { WritePlanError } from "../../../errors/write-plan-error.js";
+import { sendCalls } from "../../batch/send-calls.js";
+import { resolverRecordRole } from "../../../internal/capabilities/resolver-resource.js";
+import { getResolverCapabilities } from "../../capabilities/get-resolver-capabilities/index.js";
+import { getRecordPermissions } from "../../capabilities/get-record-permissions/index.js";
+import { AuthorizationError } from "../../../errors/authorization-error.js";
+import { getProtocol } from "../../name/get-protocol/index.js";
+import { decodePermissionAddress } from "../address.js";
+import { setResolverDelegateApproval } from "../resolver-delegate-approval/index.js";
+import { grantResolverRoles, revokeResolverRoles } from "../resolver-roles/index.js";
+import { Effect } from "effect";
+
+//#region src/actions/permissions/set-record-permissions/index.ts
+const implementation = Effect.fn("ensforge.setRecordPermissions")(function* (config, parameters) {
+	if (parameters.records.length === 0) return yield* new WritePlanError({
+		code: "INVALID_CALL_PLAN",
+		message: "setRecordPermissions requires at least one record permission",
+		cause: parameters.records
+	});
+	const account = yield* decodePermissionAddress(parameters.account, "permission account");
+	const [protocol, resolver, permissions] = yield* Effect.all([
+		getProtocol.effect(config, { name: parameters.name }),
+		getResolverCapabilities.effect(config, { name: parameters.name }),
+		getRecordPermissions.effect(config, {
+			name: parameters.name,
+			account,
+			records: parameters.records
+		})
+	], { concurrency: "unbounded" });
+	if (resolver.address === null || resolver.inherited) return yield* new AuthorizationError({
+		code: "WRITE_TARGET_UNAVAILABLE",
+		message: `A directly attached resolver is required for ${parameters.name}`
+	});
+	const unsupported = permissions.records.find((permission) => !permission.supported);
+	if (unsupported !== void 0) return yield* new AuthorizationError({
+		code: "RECORD_UNSUPPORTED",
+		message: `The resolver for ${parameters.name} does not support ${unsupported.record.type} permissions`
+	});
+	if (resolver.authorization === "owner-delegate") {
+		if (parameters.allowScopeWidening !== true) return yield* new AuthorizationError({
+			code: "SCOPE_WIDENING_REQUIRED",
+			message: `Public Resolver delegation widens the requested permissions to every record for ${parameters.name}`
+		});
+		const execution = yield* sendCalls.effect(config, {
+			calls: [setResolverDelegateApproval.call({
+				name: parameters.name,
+				delegate: account,
+				approved: parameters.approved
+			})],
+			...parameters.walletClient === void 0 ? {} : { walletClient: parameters.walletClient },
+			...parameters.walletAccount === void 0 ? {} : { account: parameters.walletAccount },
+			mode: "sequential",
+			atomicity: "none",
+			...parameters.confirmation === void 0 ? {} : { confirmation: parameters.confirmation }
+		});
+		return {
+			model: "public-resolver-delegate",
+			protocol,
+			resolver: resolver.address,
+			account,
+			approved: parameters.approved,
+			scope: "node",
+			widened: true,
+			execution
+		};
+	}
+	if (resolver.authorization !== "role" || protocol !== "v2") return yield* new AuthorizationError({
+		code: "WRITE_TARGET_UNAVAILABLE",
+		message: `The resolver permission model for ${parameters.name} is not supported`
+	});
+	const exact = permissions.records.map((permission) => ({
+		record: permission.record,
+		resource: permission.resource,
+		roles: resolverRecordRole(permission.record)
+	}));
+	const invalid = exact.find((permission) => permission.resource === null || permission.roles === 0n);
+	if (invalid !== void 0) return yield* new AuthorizationError({
+		code: "RECORD_UNSUPPORTED",
+		message: `Exact ${invalid.record.type} permissions are unavailable for ${parameters.name}`
+	});
+	const calls = exact.map((permission) => parameters.approved ? grantResolverRoles.call({
+		name: parameters.name,
+		account,
+		record: permission.record,
+		roles: permission.roles
+	}) : revokeResolverRoles.call({
+		name: parameters.name,
+		account,
+		record: permission.record,
+		roles: permission.roles
+	}));
+	const execution = yield* sendCalls.effect(config, {
+		calls,
+		...parameters.walletClient === void 0 ? {} : { walletClient: parameters.walletClient },
+		...parameters.walletAccount === void 0 ? {} : { account: parameters.walletAccount },
+		...parameters.mode === void 0 ? {} : { mode: parameters.mode },
+		...parameters.atomicity === void 0 ? {} : { atomicity: parameters.atomicity },
+		...parameters.confirmation === void 0 ? {} : { confirmation: parameters.confirmation },
+		...parameters.capabilities === void 0 ? {} : { capabilities: parameters.capabilities }
+	});
+	return {
+		model: "permissioned-resolver-roles",
+		protocol: "v2",
+		resolver: resolver.address,
+		account,
+		approved: parameters.approved,
+		scope: "exact",
+		widened: false,
+		permissions: exact.map((permission) => ({
+			record: permission.record,
+			resource: permission.resource,
+			roles: permission.roles
+		})),
+		execution
+	};
+});
+const setRecordPermissions = defineAction(implementation);
+
+//#endregion
+export { setRecordPermissions };
+//# sourceMappingURL=index.js.map

package/dist/actions/permissions/set-record-permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/actions/permissions/set-record-permissions/index.ts"],"sourcesContent":["import { Effect } from \"effect\";\n\nimport { defineAction } from \"../../../action/action.js\";\nimport type { EnsforgeConfig } from \"../../../config/config.js\";\nimport { AuthorizationError } from \"../../../errors/authorization-error.js\";\nimport { WritePlanError } from \"../../../errors/write-plan-error.js\";\nimport { resolverRecordRole } from \"../../../internal/capabilities/resolver-resource.js\";\nimport { sendCalls } from \"../../batch/send-calls.js\";\nimport { getRecordPermissions } from \"../../capabilities/get-record-permissions/index.js\";\nimport { getResolverCapabilities } from \"../../capabilities/get-resolver-capabilities/index.js\";\nimport { getProtocol } from \"../../name/get-protocol/index.js\";\nimport { decodePermissionAddress } from \"../address.js\";\nimport { setResolverDelegateApproval } from \"../resolver-delegate-approval/index.js\";\nimport { grantResolverRoles, revokeResolverRoles } from \"../resolver-roles/index.js\";\nimport type {\n  SetRecordPermissionsError,\n  SetRecordPermissionsParameters,\n  SetRecordPermissionsResult,\n} from \"./types.js\";\n\nconst implementation = Effect.fn(\"ensforge.setRecordPermissions\")(function* (\n  config: EnsforgeConfig,\n  parameters: SetRecordPermissionsParameters,\n): Effect.fn.Return<SetRecordPermissionsResult, SetRecordPermissionsError> {\n  if (parameters.records.length === 0) {\n    return yield* new WritePlanError({\n      code: \"INVALID_CALL_PLAN\",\n      message: \"setRecordPermissions requires at least one record permission\",\n      cause: parameters.records,\n    });\n  }\n  const account = yield* decodePermissionAddress(parameters.account, \"permission account\");\n  const [protocol, resolver, permissions] = yield* Effect.all(\n    [\n      getProtocol.effect(config, { name: parameters.name }),\n      getResolverCapabilities.effect(config, { name: parameters.name }),\n      getRecordPermissions.effect(config, {\n        name: parameters.name,\n        account,\n        records: parameters.records,\n      }),\n    ] as const,\n    { concurrency: \"unbounded\" },\n  );\n  if (resolver.address === null || resolver.inherited) {\n    return yield* new AuthorizationError({\n      code: \"WRITE_TARGET_UNAVAILABLE\",\n      message: `A directly attached resolver is required for ${parameters.name}`,\n    });\n  }\n  const unsupported = permissions.records.find((permission) => !permission.supported);\n  if (unsupported !== undefined) {\n    return yield* new AuthorizationError({\n      code: \"RECORD_UNSUPPORTED\",\n      message: `The resolver for ${parameters.name} does not support ${unsupported.record.type} permissions`,\n    });\n  }\n\n  if (resolver.authorization === \"owner-delegate\") {\n    if (parameters.allowScopeWidening !== true) {\n      return yield* new AuthorizationError({\n        code: \"SCOPE_WIDENING_REQUIRED\",\n        message: `Public Resolver delegation widens the requested permissions to every record for ${parameters.name}`,\n      });\n    }\n    const execution = yield* sendCalls.effect(config, {\n      calls: [\n        setResolverDelegateApproval.call({\n          name: parameters.name,\n          delegate: account,\n          approved: parameters.approved,\n        }),\n      ],\n      ...(parameters.walletClient === undefined ? {} : { walletClient: parameters.walletClient }),\n      ...(parameters.walletAccount === undefined ? {} : { account: parameters.walletAccount }),\n      mode: \"sequential\",\n      atomicity: \"none\",\n      ...(parameters.confirmation === undefined ? {} : { confirmation: parameters.confirmation }),\n    });\n    return {\n      model: \"public-resolver-delegate\",\n      protocol,\n      resolver: resolver.address,\n      account,\n      approved: parameters.approved,\n      scope: \"node\",\n      widened: true,\n      execution,\n    };\n  }\n\n  if (resolver.authorization !== \"role\" || protocol !== \"v2\") {\n    return yield* new AuthorizationError({\n      code: \"WRITE_TARGET_UNAVAILABLE\",\n      message: `The resolver permission model for ${parameters.name} is not supported`,\n    });\n  }\n  const exact = permissions.records.map((permission) => ({\n    record: permission.record,\n    resource: permission.resource,\n    roles: resolverRecordRole(permission.record),\n  }));\n  const invalid = exact.find(\n    (permission) => permission.resource === null || permission.roles === 0n,\n  );\n  if (invalid !== undefined) {\n    return yield* new AuthorizationError({\n      code: \"RECORD_UNSUPPORTED\",\n      message: `Exact ${invalid.record.type} permissions are unavailable for ${parameters.name}`,\n    });\n  }\n  const calls = exact.map((permission) =>\n    parameters.approved\n      ? grantResolverRoles.call({\n          name: parameters.name,\n          account,\n          record: permission.record,\n          roles: permission.roles,\n        })\n      : revokeResolverRoles.call({\n          name: parameters.name,\n          account,\n          record: permission.record,\n          roles: permission.roles,\n        }),\n  );\n  const execution = yield* sendCalls.effect(config, {\n    calls,\n    ...(parameters.walletClient === undefined ? {} : { walletClient: parameters.walletClient }),\n    ...(parameters.walletAccount === undefined ? {} : { account: parameters.walletAccount }),\n    ...(parameters.mode === undefined ? {} : { mode: parameters.mode }),\n    ...(parameters.atomicity === undefined ? {} : { atomicity: parameters.atomicity }),\n    ...(parameters.confirmation === undefined ? {} : { confirmation: parameters.confirmation }),\n    ...(parameters.capabilities === undefined ? {} : { capabilities: parameters.capabilities }),\n  });\n  return {\n    model: \"permissioned-resolver-roles\",\n    protocol: \"v2\",\n    resolver: resolver.address,\n    account,\n    approved: parameters.approved,\n    scope: \"exact\",\n    widened: false,\n    permissions: exact.map((permission) => ({\n      record: permission.record,\n      resource: permission.resource as bigint,\n      roles: permission.roles,\n    })),\n    execution,\n  };\n});\n\nexport const setRecordPermissions = defineAction<\n  SetRecordPermissionsParameters,\n  SetRecordPermissionsResult,\n  SetRecordPermissionsError\n>(implementation);\n\nexport type {\n  AppliedRecordPermission,\n  SetRecordPermissionsError,\n  SetRecordPermissionsParameters,\n  SetRecordPermissionsResult,\n} from \"./types.js\";\n"],"mappings":";;;;;;;;;;;;;;AAoBA,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,QACA,YACyE;CACzE,IAAI,WAAW,QAAQ,WAAW,GAChC,OAAO,OAAO,IAAI,eAAe;EAC/B,MAAM;EACN,SAAS;EACT,OAAO,WAAW;CACpB,CAAC;CAEH,MAAM,UAAU,OAAO,wBAAwB,WAAW,SAAS,oBAAoB;CACvF,MAAM,CAAC,UAAU,UAAU,eAAe,OAAO,OAAO,IACtD;EACE,YAAY,OAAO,QAAQ,EAAE,MAAM,WAAW,KAAK,CAAC;EACpD,wBAAwB,OAAO,QAAQ,EAAE,MAAM,WAAW,KAAK,CAAC;EAChE,qBAAqB,OAAO,QAAQ;GAClC,MAAM,WAAW;GACjB;GACA,SAAS,WAAW;EACtB,CAAC;CACH,GACA,EAAE,aAAa,YAAY,CAC7B;CACA,IAAI,SAAS,YAAY,QAAQ,SAAS,WACxC,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,gDAAgD,WAAW;CACtE,CAAC;CAEH,MAAM,cAAc,YAAY,QAAQ,MAAM,eAAe,CAAC,WAAW,SAAS;CAClF,IAAI,gBAAgB,QAClB,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,oBAAoB,WAAW,KAAK,oBAAoB,YAAY,OAAO,KAAK;CAC3F,CAAC;CAGH,IAAI,SAAS,kBAAkB,kBAAkB;EAC/C,IAAI,WAAW,uBAAuB,MACpC,OAAO,OAAO,IAAI,mBAAmB;GACnC,MAAM;GACN,SAAS,mFAAmF,WAAW;EACzG,CAAC;EAEH,MAAM,YAAY,OAAO,UAAU,OAAO,QAAQ;GAChD,OAAO,CACL,4BAA4B,KAAK;IAC/B,MAAM,WAAW;IACjB,UAAU;IACV,UAAU,WAAW;GACvB,CAAC,CACH;GACA,GAAI,WAAW,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,WAAW,aAAa;GACzF,GAAI,WAAW,kBAAkB,SAAY,CAAC,IAAI,EAAE,SAAS,WAAW,cAAc;GACtF,MAAM;GACN,WAAW;GACX,GAAI,WAAW,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,WAAW,aAAa;EAC3F,CAAC;EACD,OAAO;GACL,OAAO;GACP;GACA,UAAU,SAAS;GACnB;GACA,UAAU,WAAW;GACrB,OAAO;GACP,SAAS;GACT;EACF;CACF;CAEA,IAAI,SAAS,kBAAkB,UAAU,aAAa,MACpD,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,qCAAqC,WAAW,KAAK;CAChE,CAAC;CAEH,MAAM,QAAQ,YAAY,QAAQ,KAAK,gBAAgB;EACrD,QAAQ,WAAW;EACnB,UAAU,WAAW;EACrB,OAAO,mBAAmB,WAAW,MAAM;CAC7C,EAAE;CACF,MAAM,UAAU,MAAM,MACnB,eAAe,WAAW,aAAa,QAAQ,WAAW,UAAU,EACvE;CACA,IAAI,YAAY,QACd,OAAO,OAAO,IAAI,mBAAmB;EACnC,MAAM;EACN,SAAS,SAAS,QAAQ,OAAO,KAAK,mCAAmC,WAAW;CACtF,CAAC;CAEH,MAAM,QAAQ,MAAM,KAAK,eACvB,WAAW,WACP,mBAAmB,KAAK;EACtB,MAAM,WAAW;EACjB;EACA,QAAQ,WAAW;EACnB,OAAO,WAAW;CACpB,CAAC,IACD,oBAAoB,KAAK;EACvB,MAAM,WAAW;EACjB;EACA,QAAQ,WAAW;EACnB,OAAO,WAAW;CACpB,CAAC,CACP;CACA,MAAM,YAAY,OAAO,UAAU,OAAO,QAAQ;EAChD;EACA,GAAI,WAAW,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,WAAW,aAAa;EACzF,GAAI,WAAW,kBAAkB,SAAY,CAAC,IAAI,EAAE,SAAS,WAAW,cAAc;EACtF,GAAI,WAAW,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,WAAW,KAAK;EACjE,GAAI,WAAW,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;EAChF,GAAI,WAAW,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,WAAW,aAAa;EACzF,GAAI,WAAW,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,WAAW,aAAa;CAC3F,CAAC;CACD,OAAO;EACL,OAAO;EACP,UAAU;EACV,UAAU,SAAS;EACnB;EACA,UAAU,WAAW;EACrB,OAAO;EACP,SAAS;EACT,aAAa,MAAM,KAAK,gBAAgB;GACtC,QAAQ,WAAW;GACnB,UAAU,WAAW;GACrB,OAAO,WAAW;EACpB,EAAE;EACF;CACF;AACF,CAAC;AAED,MAAa,uBAAuB,aAIlC,cAAc"}

package/dist/actions/permissions/set-record-permissions/types.d.ts

@@ -0,0 +1,48 @@
+import { ConfirmationPolicy } from "../../../config/write-options.js";
+import { SendCallsResult, WriteAtomicity, WriteError, WriteMode } from "../../../write/types.js";
+import { EthereumAddress } from "../../../schemas/identity.js";
+import { RecordOperation } from "../../capabilities/types.js";
+import { Account, Address, WalletClient } from "viem";
+//#region src/actions/permissions/set-record-permissions/types.d.ts
+interface SetRecordPermissionsParameters {
+  readonly name: string;
+  readonly account: string;
+  readonly records: ReadonlyArray<RecordOperation>;
+  readonly approved: boolean;
+  readonly allowScopeWidening?: boolean;
+  readonly walletClient?: WalletClient;
+  readonly walletAccount?: Account | Address;
+  readonly mode?: WriteMode;
+  readonly atomicity?: WriteAtomicity;
+  readonly confirmation?: ConfirmationPolicy;
+  readonly capabilities?: Readonly<Record<string, unknown>>;
+}
+interface AppliedRecordPermission {
+  readonly record: RecordOperation;
+  readonly resource: bigint;
+  readonly roles: bigint;
+}
+type SetRecordPermissionsResult = {
+  readonly model: "public-resolver-delegate";
+  readonly protocol: "v1" | "v2";
+  readonly resolver: EthereumAddress;
+  readonly account: EthereumAddress;
+  readonly approved: boolean;
+  readonly scope: "node";
+  readonly widened: true;
+  readonly execution: SendCallsResult;
+} | {
+  readonly model: "permissioned-resolver-roles";
+  readonly protocol: "v2";
+  readonly resolver: EthereumAddress;
+  readonly account: EthereumAddress;
+  readonly approved: boolean;
+  readonly scope: "exact";
+  readonly widened: false;
+  readonly permissions: ReadonlyArray<AppliedRecordPermission>;
+  readonly execution: SendCallsResult;
+};
+type SetRecordPermissionsError = WriteError;
+//#endregion
+export { AppliedRecordPermission, SetRecordPermissionsError, SetRecordPermissionsParameters, SetRecordPermissionsResult };
+//# sourceMappingURL=types.d.ts.map

package/dist/actions/permissions/set-record-permissions/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../../src/actions/permissions/set-record-permissions/types.ts"],"mappings":";;;;;;UAYiB;WACN;WACA;WACA,SAAS,cAAc;WACvB;WACA;WACA,eAAe;WACf,gBAAgB,UAAU;WAC1B,OAAO;WACP,YAAY;WACZ,eAAe;WACf,eAAe,SAAS;;UAGlB;WACN,QAAQ;WACR;WACA;;KAGC;WAEG;WACA;WACA,UAAU;WACV,SAAS;WACT;WACA;WACA;WACA,WAAW;;WAGX;WACA;WACA,UAAU;WACV,SAAS;WACT;WACA;WACA;WACA,aAAa,cAAc;WAC3B,WAAW;;KAGd,4BAA4B"}