@gol/sdk 0.3.0 → 0.5.0

package/dist/owner.js

@@ -1,6 +1,8 @@
 import { concatHex, encodeAbiParameters, encodeFunctionData, getAddress, hashTypedData, keccak256, numberToHex, padHex, parseAbi, size, stringToHex, } from "viem";
 import { BASE_SEPOLIA_CHAIN_ID, ownerUserOpNonceKey, packOwnerSignature, packOwnerUserOpSignature, } from "./account-dialects.js";
 import { hashGasMandate, hashOwnerGasPolicy, } from "./gas-approval.js";
+import { contractProjectId } from "./project-id.js";
+import { CHARGEABLE_OUTCOMES, CORE_DOMAIN_NAME, CORE_DOMAIN_VERSION, coreDomain, GAS_FORMULA_INLINE, HOSTED_TREE_LIMITS, NATIVE_FEE_ASSET, } from "./v3.js";
 /** Circle USDC on Base Sepolia, the only transfer asset in this candidate. */
 export const BASE_SEPOLIA_USDC = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
 export const ENTRY_POINT_V07 = "0x0000000071727De22E5E9d8BAf0edAc6f37da032";
@@ -53,7 +55,37 @@ export function encodeTransferPolicy(input) {
         ...rules,
     ]).toLowerCase();
 }
-/** EIP-712 domain separator of the version 2 core. */
+/** Owner safety actions of the core (encoding section 6.1). */
+export const SAFETY_ACTION_CODES = { pause: 1, resume: 2, revoke: 3 };
+export const GOL_OWNER_PAYLOAD_TYPES = {
+    CombinedGasApproval: [
+        { name: "mandateId", type: "bytes32" },
+        { name: "gasPolicyId", type: "bytes32" },
+    ],
+    GasRevocation: [
+        { name: "gasPolicyId", type: "bytes32" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint48" },
+    ],
+    SafetyAction: [
+        { name: "mandateId", type: "bytes32" },
+        { name: "action", type: "uint8" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint48" },
+    ],
+};
+/** EIP-712 struct hash of a GOL owner payload. */
+export function golOwnerPayloadStructHash(payload) {
+    if (payload.primaryType === "CombinedGasApproval")
+        return combinedApprovalStructHash(payload.message.mandateId, payload.message.gasPolicyId);
+    if (payload.primaryType === "GasRevocation")
+        return revocationStructHash(payload.message.gasPolicyId, BigInt(payload.message.nonce), Number(payload.message.deadline));
+    const action = Number(payload.message.action);
+    if (action !== 1 && action !== 2 && action !== 3)
+        throw new Error("invalid_safety_action");
+    return safetyActionStructHash(payload.message.mandateId, action, BigInt(payload.message.nonce), Number(payload.message.deadline));
+}
+/** EIP-712 domain separator of the version 3 core. */
 export function coreDomainSeparator(chainId, core) {
     return keccak256(encodeAbiParameters([
         { type: "bytes32" },
@@ -63,8 +95,8 @@ export function coreDomainSeparator(chainId, core) {
         { type: "address" },
     ], [
         DOMAIN_TYPEHASH,
-        keccak256(stringToHex("GOL Mandate")),
-        keccak256(stringToHex("2")),
+        keccak256(stringToHex(CORE_DOMAIN_NAME)),
+        keccak256(stringToHex(CORE_DOMAIN_VERSION)),
         BigInt(chainId),
         core,
     ]));
@@ -94,18 +126,33 @@ const FORMAT = {
     nexus: "nexus_k1",
     kernel: "kernel_root",
     alchemy: "alchemy_entity_zero",
+    nexus7702: "eoa",
 };
 /**
  * Build the exact `eth_signTypedData_v4` payload whose hash the selected
- * account's reviewed owner path checks for a core digest.
+ * account's reviewed owner path checks for a core digest. A delegated EOA
+ * (`nexus7702`) signs the GOL payload itself, so its hash is the digest.
  */
 export function buildWalletSigningPayload(input) {
     const chainId = input.chainId ?? BASE_SEPOLIA_CHAIN_ID;
     const account = getAddress(input.account);
+    const structHash = golOwnerPayloadStructHash(input.payload);
     const domainSeparator = coreDomainSeparator(chainId, input.core);
-    const digest = keccak256(concatHex(["0x1901", domainSeparator, input.structHash]));
+    const digest = keccak256(concatHex(["0x1901", domainSeparator, structHash]));
     let typedData;
-    if (input.family === "safe") {
+    if (input.family === "nexus7702") {
+        typedData = {
+            domain: coreDomain(chainId, getAddress(input.core)),
+            types: {
+                [input.payload.primaryType]: [
+                    ...GOL_OWNER_PAYLOAD_TYPES[input.payload.primaryType],
+                ],
+            },
+            primaryType: input.payload.primaryType,
+            message: { ...input.payload.message },
+        };
+    }
+    else if (input.family === "safe") {
         typedData = {
             domain: { chainId, verifyingContract: account },
             types: { SafeMessage: [{ name: "message", type: "bytes" }] },
@@ -126,7 +173,7 @@ export function buildWalletSigningPayload(input) {
             types: { PersonalSign: [{ name: "prefixed", type: "bytes" }] },
             primaryType: "PersonalSign",
             message: {
-                prefixed: concatHex(["0x1901", domainSeparator, input.structHash]),
+                prefixed: concatHex(["0x1901", domainSeparator, structHash]),
             },
         };
     }
@@ -155,11 +202,14 @@ export function buildWalletSigningPayload(input) {
             message: { hash: digest },
         };
     }
+    const expectedHash = hashWalletTypedData(typedData);
+    if (input.family === "nexus7702" && expectedHash !== digest)
+        throw new Error("wallet_payload_mismatch");
     return {
         family: input.family,
         method: "eth_signTypedData_v4",
         typedData,
-        expectedHash: hashWalletTypedData(typedData),
+        expectedHash,
         digest,
         signatureFormat: FORMAT[input.family],
     };
@@ -193,33 +243,41 @@ export async function signWalletSigningPayload(signer, payload) {
 // Core calls
 // ---------------------------------------------------------------------------
 const coreAbi = parseAbi([
-    "function createMandateWithGas((bytes32 parentId,address account,address agent,bytes32 accountProfileId,uint64 installEpoch,bytes32 projectId,uint8 mode,uint8 policyVersion,bytes32 policyHash,uint48 validFrom,uint48 expiresAt,uint32 maxDepth,uint32 maxActiveDescendants,uint48 approvalExpiresAt,bytes32 salt) terms,bytes policy,(bytes32 mandateId,address account,bytes32 projectId,bytes32 accountProfileId,uint64 installEpoch,address feeAsset,address recipient,address attester,uint128 maxPerAction,uint128 maxTotal,uint48 expiresAt,uint8 chargeableOutcomes,uint8 formulaVersion,uint256 nonce) gasPolicy,bytes ownerSignature) returns (bytes32 mandateId,bytes32 gasPolicyId)",
+    "function createMandateWithGas((bytes32 parentId,address account,address agent,bytes32 accountProfileId,uint64 installEpoch,bytes32 projectId,uint8 mode,uint8 policyVersion,bytes32 policyHash,uint48 validFrom,uint48 expiresAt,uint32 maxDepth,uint32 maxActiveDescendants,uint48 approvalExpiresAt,bytes32 salt) terms,bytes policy,(bytes32 mandateId,address account,bytes32 projectId,bytes32 accountProfileId,uint64 installEpoch,address feeAsset,address submitter,address recipient,address attester,uint128 maxPerAction,uint128 maxTotal,uint48 expiresAt,uint8 chargeableOutcomes,uint8 formulaVersion,uint256 nonce) gasPolicy,bytes ownerSignature) returns (bytes32 mandateId,bytes32 gasPolicyId)",
+    "function createChildMandate((bytes32 parentId,address account,address agent,bytes32 accountProfileId,uint64 installEpoch,bytes32 projectId,uint8 mode,uint8 policyVersion,bytes32 policyHash,uint48 validFrom,uint48 expiresAt,uint32 maxDepth,uint32 maxActiveDescendants,uint48 approvalExpiresAt,bytes32 salt) terms,bytes policy,bytes authorization) returns (bytes32 mandateId)",
     "function revokeGasPolicy(bytes32 policyId,uint48 deadline,bytes signature)",
     "function safetyAction(bytes32 mandateId,uint8 action,uint48 deadline,bytes signature)",
 ]);
 /** Calldata for the core. Anyone may send it; authority comes only from the owner signature. */
+function termsArgument(terms) {
+    return {
+        parentId: terms.parentId,
+        account: terms.account,
+        agent: terms.agent,
+        accountProfileId: terms.accountProfileId,
+        installEpoch: BigInt(terms.installEpoch),
+        projectId: terms.projectId,
+        mode: Number(terms.mode),
+        policyVersion: Number(terms.policyVersion),
+        policyHash: terms.policyHash,
+        validFrom: Number(terms.validFrom),
+        expiresAt: Number(terms.expiresAt),
+        maxDepth: Number(terms.maxDepth),
+        maxActiveDescendants: Number(terms.maxActiveDescendants),
+        approvalExpiresAt: Number(terms.approvalExpiresAt),
+        salt: terms.salt,
+    };
+}
+/** Normalize API mandate terms into the typed form the encoders hash. */
+export function toGasMandateTerms(terms) {
+    return termsArgument(terms);
+}
 export function encodeCreateMandateWithGas(terms, mandatePolicy, gasPolicy, packedOwnerSignature) {
     return encodeFunctionData({
         abi: coreAbi,
         functionName: "createMandateWithGas",
         args: [
-            {
-                parentId: terms.parentId,
-                account: terms.account,
-                agent: terms.agent,
-                accountProfileId: terms.accountProfileId,
-                installEpoch: BigInt(terms.installEpoch),
-                projectId: terms.projectId,
-                mode: Number(terms.mode),
-                policyVersion: Number(terms.policyVersion),
-                policyHash: terms.policyHash,
-                validFrom: Number(terms.validFrom),
-                expiresAt: Number(terms.expiresAt),
-                maxDepth: Number(terms.maxDepth),
-                maxActiveDescendants: Number(terms.maxActiveDescendants),
-                approvalExpiresAt: Number(terms.approvalExpiresAt),
-                salt: terms.salt,
-            },
+            termsArgument(terms),
             mandatePolicy,
             {
                 mandateId: gasPolicy.mandateId,
@@ -228,6 +286,7 @@ export function encodeCreateMandateWithGas(terms, mandatePolicy, gasPolicy, pack
                 accountProfileId: gasPolicy.accountProfileId,
                 installEpoch: BigInt(gasPolicy.installEpoch),
                 feeAsset: gasPolicy.feeAsset,
+                submitter: gasPolicy.submitter,
                 recipient: gasPolicy.recipient,
                 attester: gasPolicy.attester,
                 maxPerAction: BigInt(gasPolicy.maxPerAction),
@@ -249,7 +308,18 @@ export function encodeRevokeGasPolicy(gasPolicyId, deadline, packedOwnerSignatur
         args: [gasPolicyId, deadline, packedOwnerSignature],
     });
 }
-/** Relayed owner pause or resume; a direct account call uses deadline 0 and no signature. */
+/**
+ * Child mandate creation. `authorization` is the parent agent's 65-byte
+ * signature over the child's `MandateTerms`; anyone may send the call.
+ */
+export function encodeCreateChildMandate(terms, mandatePolicy, authorization) {
+    return encodeFunctionData({
+        abi: coreAbi,
+        functionName: "createChildMandate",
+        args: [termsArgument(terms), mandatePolicy, authorization],
+    });
+}
+/** Relayed owner pause, resume, or revoke; a direct account call uses deadline 0 and no signature. */
 export function encodeSafetyAction(mandateId, actionCode, deadline, packedOwnerSignature) {
     return encodeFunctionData({
         abi: coreAbi,
@@ -262,7 +332,9 @@ export function encodeSafetyAction(mandateId, actionCode, deadline, packedOwnerS
 // ---------------------------------------------------------------------------
 /** Make the account call `target` through its own execution path. */
 export function accountExecuteCall(family, account, target, data) {
-    if (family === "safe")
+    // A Safe module transaction and a delegated EOA's own transaction both
+    // call the target directly.
+    if (family === "safe" || family === "nexus7702")
         return { to: target, data, operation: 0 };
     if (family === "alchemy")
         return {
@@ -331,6 +403,21 @@ export async function prepareOwnerOperation(client, family, account, call, optio
     if (chainId !== BASE_SEPOLIA_CHAIN_ID)
         throw new Error("wrong_chain");
     account = getAddress(account);
+    if (family === "nexus7702") {
+        if (call.operation !== 0)
+            throw new Error("eoa_call_must_be_direct");
+        return {
+            kind: "eoa_transaction",
+            family,
+            account,
+            transaction: {
+                from: account,
+                to: getAddress(call.to),
+                data: call.data,
+                value: 0n,
+            },
+        };
+    }
     if (family === "safe") {
         const nonce = await client.readContract({
             address: account,
@@ -456,6 +543,8 @@ export async function prepareOwnerOperation(client, family, account, call, optio
 }
 /** Sign a prepared owner operation with a caller-supplied owner wallet. */
 export async function signOwnerOperation(signer, operation) {
+    if (operation.kind === "eoa_transaction")
+        throw new Error("eoa_transaction_is_sent_by_owner_wallet");
     if (operation.kind === "safe_transaction")
         return signer.signTypedData(operation.typedData);
     if (!signer.signMessage)
@@ -476,29 +565,13 @@ export function verifyPreparedGasPolicy(prepared, expected = {}) {
     const { authority, review, signing } = prepared;
     const t = authority.mandateTerms;
     const g = authority.gasPolicy;
-    const r = review;
     const chainId = prepared.chainId;
     if (chainId !== BASE_SEPOLIA_CHAIN_ID)
         fail("chain");
-    if (expected.core && !eq(expected.core, prepared.core))
+    const core = getAddress(prepared.core);
+    if (expected.core && !eq(expected.core, core))
         fail("core");
-    const terms = {
-        parentId: t.parentId,
-        account: t.account,
-        agent: t.agent,
-        accountProfileId: t.accountProfileId,
-        installEpoch: BigInt(t.installEpoch),
-        projectId: t.projectId,
-        mode: Number(t.mode),
-        policyVersion: Number(t.policyVersion),
-        policyHash: t.policyHash,
-        validFrom: Number(t.validFrom),
-        expiresAt: Number(t.expiresAt),
-        maxDepth: Number(t.maxDepth),
-        maxActiveDescendants: Number(t.maxActiveDescendants),
-        approvalExpiresAt: Number(t.approvalExpiresAt),
-        salt: t.salt,
-    };
+    const terms = toGasMandateTerms(t);
     const policy = {
         mandateId: g.mandateId,
         account: g.account,
@@ -506,6 +579,7 @@ export function verifyPreparedGasPolicy(prepared, expected = {}) {
         accountProfileId: g.accountProfileId,
         installEpoch: BigInt(g.installEpoch),
         feeAsset: g.feeAsset,
+        submitter: g.submitter,
         recipient: g.recipient,
         attester: g.attester,
         maxPerAction: BigInt(g.maxPerAction),
@@ -517,42 +591,77 @@ export function verifyPreparedGasPolicy(prepared, expected = {}) {
     };
     if (terms.parentId !== `0x${"00".repeat(32)}` ||
         terms.mode !== 1 ||
-        terms.maxDepth !== 0 ||
-        terms.maxActiveDescendants !== 0)
+        terms.policyVersion !== 1 ||
+        terms.maxDepth !== review.maxDepth ||
+        terms.maxActiveDescendants !== review.maxActiveDescendants ||
+        terms.maxDepth > HOSTED_TREE_LIMITS.maxDepth ||
+        terms.maxActiveDescendants > HOSTED_TREE_LIMITS.maxActiveDescendants ||
+        terms.validFrom !== review.mandateValidFrom ||
+        terms.expiresAt !== review.mandateExpiresAt)
         fail("mandate shape");
     if (!eq(terms.account, prepared.account) ||
         !eq(policy.account, prepared.account))
         fail("account");
-    if (policy.feeAsset !== "0x0000000000000000000000000000000000000000" ||
-        policy.formulaVersion !== 1)
-        fail("gas asset");
-    const recipients = r.recipients ?? [];
+    const projectBinding = contractProjectId(review.projectId);
+    if (!eq(review.contractProjectId, projectBinding) ||
+        !eq(terms.projectId, projectBinding) ||
+        !eq(policy.projectId, projectBinding) ||
+        (expected.projectId !== undefined &&
+            !eq(contractProjectId(expected.projectId), projectBinding)))
+        fail("project binding");
+    if (!eq(policy.accountProfileId, terms.accountProfileId) ||
+        policy.installEpoch !== terms.installEpoch)
+        fail("account profile");
+    if (!eq(policy.feeAsset, NATIVE_FEE_ASSET) ||
+        policy.formulaVersion !== GAS_FORMULA_INLINE)
+        fail("gas formula");
+    if (!eq(review.asset, BASE_SEPOLIA_USDC) || review.assetDecimals !== 6)
+        fail("asset");
+    const recipients = review.recipients;
     const compiled = encodeTransferPolicy({
-        asset: r.asset,
+        asset: review.asset,
         recipients,
-        maxPerActionBaseUnits: BigInt(r.maxPerActionBaseUnits),
-        maxTotalBaseUnits: BigInt(r.maxTotalBaseUnits),
+        maxPerActionBaseUnits: BigInt(review.maxPerActionBaseUnits),
+        maxTotalBaseUnits: BigInt(review.maxTotalBaseUnits),
     });
     if (!eq(compiled, authority.mandatePolicy) ||
         !eq(keccak256(authority.mandatePolicy), terms.policyHash))
         fail("policy bytes");
-    if (!eq(r.asset, BASE_SEPOLIA_USDC))
-        fail("asset");
-    const mandateId = hashGasMandate(terms, chainId, prepared.core);
+    const mandateId = hashGasMandate(terms, chainId, core);
     if (!eq(mandateId, authority.mandateId) || !eq(policy.mandateId, mandateId))
         fail("mandate id");
-    const gasPolicyId = hashOwnerGasPolicy(policy, chainId, prepared.core);
+    const gasPolicyId = hashOwnerGasPolicy(policy, chainId, core);
     if (!eq(gasPolicyId, authority.gasPolicyId))
         fail("gas policy id");
-    if (!eq(r.agent, terms.agent) ||
-        !eq(r.gasRecipient, policy.recipient) ||
-        !eq(r.attester, policy.attester) ||
-        BigInt(r.maxGasPerActionWei) !== policy.maxPerAction ||
-        BigInt(r.maxGasTotalWei) !== policy.maxTotal ||
-        Number(r.chargeableOutcomesMask) !== policy.chargeableOutcomes ||
-        Number(r.gasExpiresAt) !== policy.expiresAt ||
-        Number(r.mandateExpiresAt) !== terms.expiresAt)
+    if (!eq(review.agent, terms.agent) ||
+        !eq(review.submitter, policy.submitter) ||
+        !eq(review.gasRecipient, policy.recipient) ||
+        !eq(review.attester, policy.attester) ||
+        BigInt(review.maxGasPerActionWei) !== policy.maxPerAction ||
+        BigInt(review.maxGasTotalWei) !== policy.maxTotal ||
+        review.chargeableOutcomesMask !== policy.chargeableOutcomes ||
+        review.gasExpiresAt !== policy.expiresAt)
         fail("review summary");
+    if (policy.maxPerAction <= 0n ||
+        policy.maxPerAction > policy.maxTotal ||
+        policy.chargeableOutcomes < 1 ||
+        policy.chargeableOutcomes > 7 ||
+        policy.expiresAt > terms.expiresAt ||
+        eq(policy.submitter, NATIVE_FEE_ASSET) ||
+        eq(policy.recipient, NATIVE_FEE_ASSET))
+        fail("gas policy bounds");
+    const revert = (policy.chargeableOutcomes & CHARGEABLE_OUTCOMES.revert) !== 0;
+    if (review.relayerMode === "developer") {
+        // A developer relayer has no GOL attester, so no revert claim.
+        if (revert || !eq(policy.attester, NATIVE_FEE_ASSET))
+            fail("developer relayer policy");
+    }
+    else if (review.relayerMode === "gol") {
+        if (revert && eq(policy.attester, NATIVE_FEE_ASSET))
+            fail("revert claim attester");
+    }
+    else
+        fail("relayer mode");
     if (expected.account && !eq(expected.account, terms.account))
         fail("expected account");
     if (expected.agent && !eq(expected.agent, terms.agent))
@@ -562,10 +671,10 @@ export function verifyPreparedGasPolicy(prepared, expected = {}) {
             !expected.recipients.every((a) => recipients.some((b) => eq(a, b)))))
         fail("expected recipients");
     if (expected.maxPerActionBaseUnits !== undefined &&
-        BigInt(r.maxPerActionBaseUnits) !== expected.maxPerActionBaseUnits)
+        BigInt(review.maxPerActionBaseUnits) !== expected.maxPerActionBaseUnits)
         fail("expected per-action cap");
     if (expected.maxTotalBaseUnits !== undefined &&
-        BigInt(r.maxTotalBaseUnits) !== expected.maxTotalBaseUnits)
+        BigInt(review.maxTotalBaseUnits) !== expected.maxTotalBaseUnits)
         fail("expected total cap");
     if (expected.maxGasPerActionWei !== undefined &&
         policy.maxPerAction !== expected.maxGasPerActionWei)
@@ -573,11 +682,36 @@ export function verifyPreparedGasPolicy(prepared, expected = {}) {
     if (expected.maxGasTotalWei !== undefined &&
         policy.maxTotal !== expected.maxGasTotalWei)
         fail("expected gas total cap");
+    if (expected.chargeableOutcomesMask !== undefined &&
+        policy.chargeableOutcomes !== expected.chargeableOutcomesMask)
+        fail("expected chargeable outcomes");
+    if (expected.relayer) {
+        if (expected.relayer.mode !== review.relayerMode)
+            fail("expected relayer");
+        if (expected.relayer.submitter &&
+            !eq(expected.relayer.submitter, policy.submitter))
+            fail("expected submitter");
+        if (expected.relayer.recipient &&
+            !eq(expected.relayer.recipient, policy.recipient))
+            fail("expected gas recipient");
+    }
+    if (expected.attester && !eq(expected.attester, policy.attester))
+        fail("expected attester");
+    if (expected.tree &&
+        (expected.tree.maxDepth !== terms.maxDepth ||
+            expected.tree.maxActiveDescendants !== terms.maxActiveDescendants))
+        fail("expected tree limits");
+    if (!eq(prepared.submission.to, core) ||
+        prepared.submission.functionName !== "createMandateWithGas")
+        fail("submission");
     verifyWalletSigningPayload(signing, {
         family: prepared.family,
         account: prepared.account,
-        core: prepared.core,
-        structHash: combinedApprovalStructHash(mandateId, gasPolicyId),
+        core,
+        payload: {
+            primaryType: "CombinedGasApproval",
+            message: { mandateId, gasPolicyId },
+        },
         chainId,
     });
     if (!eq(signing.digest, authority.combinedDigest))
@@ -588,48 +722,79 @@ export async function signPreparedGasPolicy(signer, prepared, expected = {}) {
     verifyPreparedGasPolicy(prepared, expected);
     const signature = await signWalletSigningPayload(signer, prepared.signing);
     return {
-        to: prepared.core,
+        to: getAddress(prepared.core),
         data: encodeCreateMandateWithGas(prepared.authority.mandateTerms, prepared.authority.mandatePolicy, prepared.authority.gasPolicy, signature),
     };
 }
 /** Verify a prepared relayed revocation, sign it with the owner wallet, and return the core call. */
 export async function signPreparedRevocation(signer, prepared) {
-    verifyWalletSigningPayload(prepared.relayed.signing, {
+    const core = getAddress(prepared.core);
+    if (prepared.chainId !== BASE_SEPOLIA_CHAIN_ID ||
+        prepared.relayed.functionName !== "revokeGasPolicy" ||
+        !eq(prepared.directOwnerCall.to, core) ||
+        !eq(prepared.directOwnerCall.data, encodeRevokeGasPolicy(prepared.gasPolicyId, 0, "0x")))
+        throw new Error("revocation_mismatch");
+    const signing = prepared.relayed.signing;
+    verifyWalletSigningPayload(signing, {
         family: prepared.family,
         account: prepared.account,
-        core: prepared.core,
-        structHash: revocationStructHash(prepared.gasPolicyId, BigInt(prepared.nonce), prepared.deadline),
+        core,
+        payload: {
+            primaryType: "GasRevocation",
+            message: {
+                gasPolicyId: prepared.gasPolicyId,
+                nonce: prepared.nonce,
+                deadline: prepared.deadline,
+            },
+        },
         chainId: prepared.chainId,
     });
-    const signature = await signWalletSigningPayload(signer, prepared.relayed.signing);
+    if (!eq(prepared.digest, signing.digest))
+        throw new Error("revocation_mismatch");
+    const signature = await signWalletSigningPayload(signer, signing);
     return {
-        to: prepared.core,
+        to: core,
         data: encodeRevokeGasPolicy(prepared.gasPolicyId, prepared.deadline, signature),
     };
 }
-/** Recompute the core digest and wallet payload before signing an owner pause or resume. */
-export async function signPreparedSafetyAction(signer, prepared) {
-    if (prepared.action !== "pause" && prepared.action !== "resume")
-        throw new Error("safety_action_mismatch");
-    const actionCode = prepared.action === "pause" ? 1 : 2;
-    if (prepared.chainId !== BASE_SEPOLIA_CHAIN_ID ||
+/**
+ * Recompute the core digest and wallet payload before signing an owner pause,
+ * resume, or revoke of any mandate in the policy's tree.
+ */
+export async function signPreparedSafetyAction(signer, prepared, expected = {}) {
+    const actionCode = SAFETY_ACTION_CODES[prepared.action];
+    const core = getAddress(prepared.core);
+    if (actionCode === undefined ||
+        prepared.chainId !== BASE_SEPOLIA_CHAIN_ID ||
         prepared.actionCode !== actionCode ||
-        prepared.relayed.functionName !== "safetyAction")
+        prepared.relayed.functionName !== "safetyAction" ||
+        (expected.action !== undefined && expected.action !== prepared.action) ||
+        (expected.mandateId !== undefined &&
+            !eq(expected.mandateId, prepared.mandateId)) ||
+        !eq(prepared.directOwnerCall.to, core) ||
+        !eq(prepared.directOwnerCall.data, encodeSafetyAction(prepared.mandateId, actionCode, 0, "0x")))
         throw new Error("safety_action_mismatch");
     const signing = prepared.relayed.signing;
-    const expected = {
+    verifyWalletSigningPayload(signing, {
         family: prepared.family,
         account: prepared.account,
-        core: prepared.core,
-        structHash: safetyActionStructHash(prepared.mandateId, actionCode, BigInt(prepared.nonce), prepared.deadline),
+        core,
+        payload: {
+            primaryType: "SafetyAction",
+            message: {
+                mandateId: prepared.mandateId,
+                action: actionCode,
+                nonce: prepared.nonce,
+                deadline: prepared.deadline,
+            },
+        },
         chainId: prepared.chainId,
-    };
-    verifyWalletSigningPayload(signing, expected);
-    if (prepared.digest.toLowerCase() !== signing.digest.toLowerCase())
+    });
+    if (!eq(prepared.digest, signing.digest))
         throw new Error("safety_action_mismatch");
     const signature = await signWalletSigningPayload(signer, signing);
     return {
-        to: prepared.core,
+        to: core,
         data: encodeSafetyAction(prepared.mandateId, actionCode, prepared.deadline, signature),
     };
 }