@keelcodes/conformance 0.1.0

package/dist/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAe,GAAG,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE/F;;;;;;;;GAQG;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,EAAE,GAAkB,CAAC;AAYrD,eAAO,MAAM,cAAc,EAAE,SAAS,KAAK,EAwF1C,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,aAAa,EAAE,KAI3B,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,sEAAsE;AACtE,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,wBAAwB,GAChC,mBAAmB,CAwDrB"}

package/dist/agents.js

@@ -0,0 +1,161 @@
+import { erc8004IdentityAbi, erc8004ReputationAbi } from './abi.js';
+/**
+ * ERC-8004 conformance (Trustless Agents).
+ *
+ * The identity registry is an ERC-721 whose `tokenId` is the `agentId`, with
+ * agent-specific extensions (`getAgentWallet`, `agentURI`). The suite checks the
+ * registry is a real ERC-721 and that the agent under test is registered with a
+ * resolvable owner, URI and wallet; optionally that a reputation registry is
+ * bound to the same identity registry.
+ */
+/** `bytes4(keccak256("onERC721Received(address,address,uint256,bytes)"))`-style id for ERC-721. */
+export const ERC721_INTERFACE_ID = '0x80ac58cd';
+const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000';
+function agentReader(target) {
+    const reader = target.agentRegistry;
+    if (reader === undefined) {
+        throw new Error('the ERC-8004 suite needs an `agentRegistry` reader on the target');
+    }
+    return reader;
+}
+export const ERC8004_CHECKS = [
+    {
+        id: 'erc8004.identity.deployed',
+        title: 'Identity registry is deployed',
+        spec: 'ERC-8004 §Identity Registry',
+        severity: 'critical',
+        async run(target) {
+            const reader = agentReader(target);
+            if (!(await reader.hasCode(reader.identityRegistry))) {
+                throw new Error(`no bytecode at identity registry ${reader.identityRegistry}`);
+            }
+            return `identity registry ${reader.identityRegistry} has bytecode`;
+        },
+    },
+    {
+        id: 'erc8004.identity.erc721',
+        title: 'Identity registry implements ERC-721',
+        spec: 'ERC-8004 §Identity Registry',
+        severity: 'high',
+        async run(target) {
+            const reader = agentReader(target);
+            if (!(await reader.supportsInterface(ERC721_INTERFACE_ID))) {
+                throw new Error('supportsInterface(ERC-721) returned false');
+            }
+            return 'registry reports ERC-721 support';
+        },
+    },
+    {
+        id: 'erc8004.identity.agentRegistered',
+        title: 'Agent has a non-zero owner',
+        spec: 'ERC-8004 §register',
+        severity: 'critical',
+        async run(target) {
+            const reader = agentReader(target);
+            const owner = await reader.ownerOf();
+            if (owner.toLowerCase() === ZERO_ADDRESS) {
+                throw new Error(`agent ${reader.agentId} is not registered (ownerOf == address(0))`);
+            }
+            return `agent ${reader.agentId} owned by ${owner}`;
+        },
+    },
+    {
+        id: 'erc8004.identity.agentURI',
+        title: 'Agent exposes a resolvable URI',
+        spec: 'ERC-8004 §setAgentURI',
+        severity: 'medium',
+        async run(target) {
+            const reader = agentReader(target);
+            const uri = await reader.tokenURI();
+            if (typeof uri !== 'string' || uri.length === 0) {
+                throw new Error(`tokenURI(${reader.agentId}) is empty`);
+            }
+            return `agentURI set (${uri.length} chars)`;
+        },
+    },
+    {
+        id: 'erc8004.identity.agentWallet',
+        title: 'Agent has a bound wallet',
+        spec: 'ERC-8004 §getAgentWallet',
+        severity: 'high',
+        async run(target) {
+            const reader = agentReader(target);
+            const wallet = await reader.agentWallet();
+            if (wallet.toLowerCase() === ZERO_ADDRESS) {
+                throw new Error(`getAgentWallet(${reader.agentId}) is address(0)`);
+            }
+            return `agent wallet ${wallet}`;
+        },
+    },
+    {
+        id: 'erc8004.reputation.bound',
+        title: 'Reputation registry is bound to the identity registry',
+        spec: 'ERC-8004 §Reputation Registry',
+        severity: 'high',
+        async run(target) {
+            const reader = agentReader(target);
+            if (reader.reputationRegistry === undefined) {
+                throw new Error('no reputation registry configured on the reader');
+            }
+            const bound = await reader.reputationIdentityRegistry();
+            if (bound.toLowerCase() !== reader.identityRegistry.toLowerCase()) {
+                throw new Error(`reputation registry points at ${bound}, expected identity registry ${reader.identityRegistry}`);
+            }
+            return 'reputation registry bound to the identity registry';
+        },
+    },
+];
+/** ERC-8004 agent registry suite. */
+export const ERC8004_SUITE = {
+    name: 'ERC-8004',
+    spec: 'ERC-8004 (Trustless Agents)',
+    checks: ERC8004_CHECKS,
+};
+/** Points the ERC-8004 suite at live registries via a viem client. */
+export function createViemAgentRegistryReader(client, options) {
+    const { identityRegistry, agentId, reputationRegistry } = options;
+    return {
+        identityRegistry,
+        agentId,
+        ...(reputationRegistry !== undefined ? { reputationRegistry } : {}),
+        async hasCode(address) {
+            const code = await client.getCode({ address });
+            return Boolean(code && code !== '0x');
+        },
+        ownerOf: () => client.readContract({
+            address: identityRegistry,
+            abi: erc8004IdentityAbi,
+            functionName: 'ownerOf',
+            args: [agentId],
+        }),
+        tokenURI: () => client.readContract({
+            address: identityRegistry,
+            abi: erc8004IdentityAbi,
+            functionName: 'tokenURI',
+            args: [agentId],
+        }),
+        agentWallet: () => client.readContract({
+            address: identityRegistry,
+            abi: erc8004IdentityAbi,
+            functionName: 'getAgentWallet',
+            args: [agentId],
+        }),
+        supportsInterface: (interfaceId) => client.readContract({
+            address: identityRegistry,
+            abi: erc8004IdentityAbi,
+            functionName: 'supportsInterface',
+            args: [interfaceId],
+        }),
+        reputationIdentityRegistry: () => {
+            if (reputationRegistry === undefined) {
+                return Promise.reject(new Error('no reputation registry configured'));
+            }
+            return client.readContract({
+                address: reputationRegistry,
+                abi: erc8004ReputationAbi,
+                functionName: 'getIdentityRegistry',
+            });
+        },
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAGpE;;;;;;;;GAQG;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAAQ,YAAY,CAAC;AAErD,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAqB;IAC9C;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,qBAAqB,MAAM,CAAC,gBAAgB,eAAe,CAAC;QACrE,CAAC;KACF;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,sCAAsC;QAC7C,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,kCAAkC,CAAC;QAC5C,CAAC;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,OAAO,4CAA4C,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,SAAS,MAAM,CAAC,OAAO,aAAa,KAAK,EAAE,CAAC;QACrD,CAAC;KACF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,iBAAiB,GAAG,CAAC,MAAM,SAAS,CAAC;QAC9C,CAAC;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,gBAAgB,MAAM,EAAE,CAAC;QAClC,CAAC;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,uDAAuD;QAC9D,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,0BAA0B,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,gCAAgC,MAAM,CAAC,gBAAgB,EAAE,CAChG,CAAC;YACJ,CAAC;YACD,OAAO,oDAAoD,CAAC;QAC9D,CAAC;KACF;CACF,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,cAAc;CACvB,CAAC;AAQF,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,MAAoB,EACpB,OAAiC;IAEjC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;IAElE,OAAO;QACL,gBAAgB;QAChB,OAAO;QACP,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,CACZ,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,kBAAkB;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC;QAEJ,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,kBAAkB;YACvB,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC;QAEJ,WAAW,EAAE,GAAG,EAAE,CAChB,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,kBAAkB;YACvB,YAAY,EAAE,gBAAgB;YAC9B,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC;QAEJ,iBAAiB,EAAE,CAAC,WAAW,EAAE,EAAE,CACjC,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,kBAAkB;YACvB,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC;QAEJ,0BAA0B,EAAE,GAAG,EAAE;YAC/B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC,YAAY,CAAC;gBACzB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,EAAE,oBAAoB;gBACzB,YAAY,EAAE,qBAAqB;aACpC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks.d.ts

@@ -0,0 +1,12 @@
+import { type Check, type Suite } from './types.js';
+/**
+ * ERC-7579 core conformance checks.
+ *
+ * Coverage in this slice is ERC-7579 (the account surface + the module install
+ * contract). ERC-7710 / 7715 / 8004 live in `delegation.ts`, `permissions.ts`
+ * and `agents.ts` — see `docs/CONFORMANCE.md` for the coverage matrix.
+ */
+export declare const ERC7579_CHECKS: readonly Check[];
+/** ERC-7579 core suite. */
+export declare const ERC7579_SUITE: Suite;
+//# sourceMappingURL=checks.d.ts.map

package/dist/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnH;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,KAAK,EAkK1C,CAAC;AAEF,2BAA2B;AAC3B,eAAO,MAAM,aAAa,EAAE,KAI3B,CAAC"}

package/dist/checks.js

@@ -0,0 +1,168 @@
+import { EXECUTION_MODE, MODULE_TYPE, accountTarget, moduleAdminTarget } from './types.js';
+/**
+ * ERC-7579 core conformance checks.
+ *
+ * Coverage in this slice is ERC-7579 (the account surface + the module install
+ * contract). ERC-7710 / 7715 / 8004 live in `delegation.ts`, `permissions.ts`
+ * and `agents.ts` — see `docs/CONFORMANCE.md` for the coverage matrix.
+ */
+export const ERC7579_CHECKS = [
+    {
+        id: 'erc7579.account.deployed',
+        title: 'Account is deployed',
+        spec: 'ERC-7579 §Account',
+        severity: 'critical',
+        async run(target) {
+            const { reader, account } = accountTarget(target);
+            if (!(await reader.hasCode(account))) {
+                throw new Error(`no bytecode at ${account}`);
+            }
+            return 'account has bytecode';
+        },
+    },
+    {
+        id: 'erc7579.account.supportsSingleMode',
+        title: 'Account supports the single execution mode',
+        spec: 'ERC-7579 §3.1',
+        severity: 'high',
+        async run(target) {
+            const { reader, account } = accountTarget(target);
+            if (!(await reader.supportsExecutionMode(account, EXECUTION_MODE.SINGLE))) {
+                throw new Error('supportsExecutionMode(single default) returned false');
+            }
+            return 'single (callType 0x00) supported';
+        },
+    },
+    {
+        id: 'erc7579.account.supportsBatchMode',
+        title: 'Account supports the batch execution mode',
+        spec: 'ERC-7579 §3.1',
+        severity: 'high',
+        async run(target) {
+            const { reader, account } = accountTarget(target);
+            if (!(await reader.supportsExecutionMode(account, EXECUTION_MODE.BATCH))) {
+                throw new Error('supportsExecutionMode(batch default) returned false');
+            }
+            return 'batch (callType 0x01) supported';
+        },
+    },
+    {
+        id: 'erc7579.account.accountId',
+        title: 'Account reports a non-empty accountId()',
+        spec: 'ERC-7579 §Account',
+        severity: 'medium',
+        async run(target) {
+            const { reader, account } = accountTarget(target);
+            const id = await reader.accountId(account);
+            if (typeof id !== 'string' || id.length === 0) {
+                throw new Error(`accountId() returned ${JSON.stringify(id)}`);
+            }
+            return `accountId() = ${id}`;
+        },
+    },
+    {
+        id: 'erc7579.module.installed',
+        title: 'Module is reported installed by the account',
+        spec: 'ERC-7579 §ModuleManager',
+        severity: 'critical',
+        async run(target) {
+            const { reader, account, module, moduleTypeId } = accountTarget(target);
+            const installed = await reader.isModuleInstalled({ account, module, moduleTypeId });
+            if (!installed) {
+                throw new Error(`isModuleInstalled(${moduleTypeId}, ${module}) returned false — the module is not installed`);
+            }
+            return `module ${module} installed as type ${moduleTypeId}`;
+        },
+    },
+    {
+        id: 'erc7579.module.initialized',
+        title: 'Installed module reports isInitialized(account)',
+        spec: 'ERC-7579 §IModule',
+        severity: 'critical',
+        async run(target) {
+            const { reader, account, module } = accountTarget(target);
+            // The second half of the migration probe: a module can be *registered* on
+            // the account while its own `onInstall` silently no-op'd (a layout or
+            // value mismatch that does not revert). The account then looks configured
+            // but the module enforces nothing — an AA24-class silent failure.
+            if (!(await reader.isModuleInitialized(module, account))) {
+                throw new Error('module is installed but reports isInitialized == false — silent no-op install (AA24-class)');
+            }
+            return 'module reports initialized';
+        },
+    },
+    {
+        id: 'erc7579.module.installUninstallFlow',
+        title: 'Module can be installed and uninstalled by type',
+        spec: 'ERC-7579 §ModuleManager',
+        severity: 'critical',
+        async run(target) {
+            const { reader, moduleAdmin, account, module, moduleTypeId } = moduleAdminTarget(target);
+            // A round trip, so start from a clean account: a pre-existing install
+            // would make `installModule` revert or could mask a broken uninstall.
+            if (await reader.isModuleInstalled({ account, module, moduleTypeId })) {
+                await moduleAdmin.uninstallModule({ account, module, moduleTypeId });
+            }
+            await moduleAdmin.installModule({ account, module, moduleTypeId });
+            if (!(await reader.isModuleInstalled({ account, module, moduleTypeId }))) {
+                throw new Error(`installModule(${moduleTypeId}, ${module}) did not register the module on ${account}`);
+            }
+            await moduleAdmin.uninstallModule({ account, module, moduleTypeId });
+            if (await reader.isModuleInstalled({ account, module, moduleTypeId })) {
+                throw new Error(`uninstallModule(${moduleTypeId}, ${module}) left the module installed on ${account}`);
+            }
+            return `module ${module} installed and uninstalled as type ${moduleTypeId}`;
+        },
+    },
+    {
+        id: 'erc7579.module.onInstallOnUninstall',
+        title: 'onInstall / onUninstall take effect on the module',
+        spec: 'ERC-7579 §IModule',
+        severity: 'high',
+        async run(target) {
+            const { reader, moduleAdmin, account, module, moduleTypeId } = moduleAdminTarget(target);
+            // The lifecycle callbacks are only observable through their effect on the
+            // module's own state: initialized after install, cleared after uninstall.
+            // A silent no-op on either side is exactly the failure this catches.
+            if (await reader.isModuleInstalled({ account, module, moduleTypeId })) {
+                await moduleAdmin.uninstallModule({ account, module, moduleTypeId });
+            }
+            await moduleAdmin.installModule({ account, module, moduleTypeId });
+            if (!(await reader.isModuleInitialized(module, account))) {
+                throw new Error('module reports isInitialized == false after install — onInstall silently no-op\'d');
+            }
+            await moduleAdmin.uninstallModule({ account, module, moduleTypeId });
+            if (await reader.isModuleInitialized(module, account)) {
+                throw new Error('module reports isInitialized == true after uninstall — onUninstall silently no-op\'d');
+            }
+            return 'isInitialized tracks install and uninstall';
+        },
+    },
+    {
+        id: 'erc7579.module.isModuleType',
+        title: 'Module reports true for exactly its own ERC-7579 type',
+        spec: 'ERC-7579 §IModule',
+        severity: 'high',
+        async run(target) {
+            const { reader, module, moduleTypeId } = accountTarget(target);
+            // Exercises all four MODULE_TYPE ids: the module must claim its own type
+            // and disclaim the other three — a module that answers true to everything
+            // (or to the wrong type) would be dispatched as the wrong kind.
+            for (const [name, typeId] of Object.entries(MODULE_TYPE)) {
+                const expected = typeId === moduleTypeId;
+                const actual = await reader.isModuleType(module, typeId);
+                if (actual !== expected) {
+                    throw new Error(`isModuleType(${name}=${typeId}) = ${actual}, expected ${expected} for a type-${moduleTypeId} module`);
+                }
+            }
+            return `module ${module} claims only its type ${moduleTypeId}`;
+        },
+    },
+];
+/** ERC-7579 core suite. */
+export const ERC7579_SUITE = {
+    name: 'ERC-7579',
+    spec: 'ERC-7579 (Modular Smart Accounts)',
+    checks: ERC7579_CHECKS,
+};
+//# sourceMappingURL=checks.js.map

package/dist/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,YAAY,CAAC;AAEnH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAqB;IAC9C;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,sBAAsB,CAAC;QAChC,CAAC;KACF;IACD;QACE,EAAE,EAAE,oCAAoC;QACxC,KAAK,EAAE,4CAA4C;QACnD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,kCAAkC,CAAC;QAC5C,CAAC;KACF;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,iCAAiC,CAAC;QAC3C,CAAC;KACF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,iBAAiB,EAAE,EAAE,CAAC;QAC/B,CAAC;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,6CAA6C;QACpD,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,qBAAqB,YAAY,KAAK,MAAM,gDAAgD,CAC7F,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,MAAM,sBAAsB,YAAY,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAC1D,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;YACJ,CAAC;YACD,OAAO,4BAA4B,CAAC;QACtC,CAAC;KACF;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzF,sEAAsE;YACtE,sEAAsE;YACtE,IAAI,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBACtE,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,KAAK,MAAM,oCAAoC,OAAO,EAAE,CACtF,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,IAAI,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,mBAAmB,YAAY,KAAK,MAAM,kCAAkC,OAAO,EAAE,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,MAAM,sCAAsC,YAAY,EAAE,CAAC;QAC9E,CAAC;KACF;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,KAAK,EAAE,mDAAmD;QAC1D,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzF,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBACtE,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,WAAW,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,IAAI,MAAM,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;YAC1G,CAAC;YACD,OAAO,4CAA4C,CAAC;QACtD,CAAC;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,KAAK,EAAE,uDAAuD;QAC9D,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/D,yEAAyE;YACzE,0EAA0E;YAC1E,gEAAgE;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,YAAY,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,IAAI,MAAM,OAAO,MAAM,cAAc,QAAQ,eAAe,YAAY,SAAS,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,MAAM,yBAAyB,YAAY,EAAE,CAAC;QACjE,CAAC;KACF;CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,mCAAmC;IACzC,MAAM,EAAE,cAAc;CACvB,CAAC"}

package/dist/delegation.d.ts

@@ -0,0 +1,40 @@
+import { type PublicClient } from 'viem';
+import type { Address, Check, Delegation, DelegationCaveat, DelegationReader, Hex, Suite } from './types.js';
+/**
+ * ERC-7710 conformance (Smart Contract Delegation).
+ *
+ * The EIP body fixes only `redeemDelegations(bytes[],bytes32[],bytes[])`; the
+ * getters probed here are the MetaMask delegation-framework reference that the
+ * EIP names. The suite's core assertion is **off-chain / on-chain agreement**:
+ * the delegation hash we derive from the EIP-712 preimage must equal what the
+ * manager returns, and the domain separator must be bound to this chain and
+ * manager — a mismatch is a replay vector across chains or deployments.
+ */
+/** `keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)")`. */
+export declare const EIP712_DOMAIN_TYPEHASH: `0x${string}`;
+/** `ROOT_AUTHORITY` — the sentinel authority for a root delegation. */
+export declare const ROOT_AUTHORITY: Hex;
+/** `ANY_DELEGATE` — the reference's wildcard delegate sentinel. */
+export declare const ANY_DELEGATE: Address;
+/**
+ * `keccak256(abi.encode(CAVEAT_TYPEHASH, enforcer, keccak256(terms)))` — the
+ * caveat's `args` are deliberately excluded, matching the reference.
+ */
+export declare function caveatHash(caveat: DelegationCaveat): Hex;
+/** The EIP-712 delegation hash, derived off-chain. */
+export declare function computeDelegationHash(delegation: Delegation): Hex;
+/** The EIP-712 domain separator for a manager on a chain. */
+export declare function computeDomainHash(args: {
+    manager: Address;
+    chainId: number;
+    name?: string;
+    version?: string;
+}): Hex;
+/** A delegation fixture used to exercise the hash derivation. */
+export declare const SAMPLE_DELEGATION: Delegation;
+export declare const ERC7710_CHECKS: readonly Check[];
+/** ERC-7710 delegation suite. */
+export declare const ERC7710_SUITE: Suite;
+/** Points the ERC-7710 suite at a live `DelegationManager` via a viem client. */
+export declare function createViemDelegationReader(client: PublicClient, manager: Address): DelegationReader;
+//# sourceMappingURL=delegation.d.ts.map

package/dist/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAE9F,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAe,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE1H;;;;;;;;;GASG;AAEH,yGAAyG;AACzG,eAAO,MAAM,sBAAsB,eAElC,CAAC;AAUF,uEAAuE;AACvE,eAAO,MAAM,cAAc,EAAE,GAA4B,CAAC;AAC1D,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,OAAsD,CAAC;AAKlF;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,GAAG,CAOxD;AASD,sDAAsD;AACtD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,GAAG,CAqBjE;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,GAAG,CAmBN;AAED,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,EAAE,UAM/B,CAAC;AAcF,eAAO,MAAM,cAAc,EAAE,SAAS,KAAK,EA6G1C,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,aAAa,EAAE,KAI3B,CAAC;AAiBF,iFAAiF;AACjF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAyCnG"}

package/dist/delegation.js

@@ -0,0 +1,245 @@
+import { encodeAbiParameters, encodePacked, keccak256, toHex } from 'viem';
+import { erc7710ManagerAbi } from './abi.js';
+/**
+ * ERC-7710 conformance (Smart Contract Delegation).
+ *
+ * The EIP body fixes only `redeemDelegations(bytes[],bytes32[],bytes[])`; the
+ * getters probed here are the MetaMask delegation-framework reference that the
+ * EIP names. The suite's core assertion is **off-chain / on-chain agreement**:
+ * the delegation hash we derive from the EIP-712 preimage must equal what the
+ * manager returns, and the domain separator must be bound to this chain and
+ * manager — a mismatch is a replay vector across chains or deployments.
+ */
+/** `keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)")`. */
+export const EIP712_DOMAIN_TYPEHASH = keccak256(toHex('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)'));
+const CAVEAT_TYPEHASH = keccak256(toHex('Caveat(address enforcer,bytes terms)'));
+const DELEGATION_TYPEHASH = keccak256(toHex('Delegation(address delegate,address delegator,bytes32 authority,Caveat[] caveats,uint256 salt)Caveat(address enforcer,bytes terms)'));
+/** `ROOT_AUTHORITY` — the sentinel authority for a root delegation. */
+export const ROOT_AUTHORITY = `0x${'ff'.repeat(32)}`;
+/** `ANY_DELEGATE` — the reference's wildcard delegate sentinel. */
+export const ANY_DELEGATE = '0x0000000000000000000000000000000000000a11';
+const DEFAULT_DOMAIN_NAME = 'DelegationManager';
+const DEFAULT_DOMAIN_VERSION = '1';
+/**
+ * `keccak256(abi.encode(CAVEAT_TYPEHASH, enforcer, keccak256(terms)))` — the
+ * caveat's `args` are deliberately excluded, matching the reference.
+ */
+export function caveatHash(caveat) {
+    return keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'address' }, { type: 'bytes32' }], [CAVEAT_TYPEHASH, caveat.enforcer, keccak256(caveat.terms)]));
+}
+function caveatArrayHash(caveats) {
+    if (caveats.length === 0)
+        return keccak256('0x');
+    const types = caveats.map(() => 'bytes32');
+    const values = caveats.map((caveat) => caveatHash(caveat));
+    return keccak256(encodePacked(types, values));
+}
+/** The EIP-712 delegation hash, derived off-chain. */
+export function computeDelegationHash(delegation) {
+    return keccak256(encodeAbiParameters([
+        { type: 'bytes32' },
+        { type: 'address' },
+        { type: 'address' },
+        { type: 'bytes32' },
+        { type: 'bytes32' },
+        { type: 'uint256' },
+    ], [
+        DELEGATION_TYPEHASH,
+        delegation.delegate,
+        delegation.delegator,
+        delegation.authority,
+        caveatArrayHash(delegation.caveats),
+        delegation.salt,
+    ]));
+}
+/** The EIP-712 domain separator for a manager on a chain. */
+export function computeDomainHash(args) {
+    return keccak256(encodeAbiParameters([
+        { type: 'bytes32' },
+        { type: 'bytes32' },
+        { type: 'bytes32' },
+        { type: 'uint256' },
+        { type: 'address' },
+    ], [
+        EIP712_DOMAIN_TYPEHASH,
+        keccak256(toHex(args.name ?? DEFAULT_DOMAIN_NAME)),
+        keccak256(toHex(args.version ?? DEFAULT_DOMAIN_VERSION)),
+        BigInt(args.chainId),
+        args.manager,
+    ]));
+}
+/** A delegation fixture used to exercise the hash derivation. */
+export const SAMPLE_DELEGATION = {
+    delegate: ANY_DELEGATE,
+    delegator: '0x1111111111111111111111111111111111111111',
+    authority: ROOT_AUTHORITY,
+    caveats: [{ enforcer: '0x2222222222222222222222222222222222222222', terms: '0xdeadbeef' }],
+    salt: 0n,
+};
+function delegationReader(target) {
+    const reader = target.delegation;
+    if (reader === undefined) {
+        throw new Error('the ERC-7710 suite needs a `delegation` reader on the target');
+    }
+    return reader;
+}
+function toHex32(value) {
+    return value.toLowerCase();
+}
+export const ERC7710_CHECKS = [
+    {
+        id: 'erc7710.manager.deployed',
+        title: 'DelegationManager is deployed',
+        spec: 'ERC-7710 §ERC7710Manager',
+        severity: 'critical',
+        async run(target) {
+            const reader = delegationReader(target);
+            if (!(await reader.hasCode(reader.manager))) {
+                throw new Error(`no bytecode at DelegationManager ${reader.manager}`);
+            }
+            return `DelegationManager ${reader.manager} has bytecode`;
+        },
+    },
+    {
+        id: 'erc7710.manager.domainBinding',
+        title: 'Domain separator is bound to this chain and manager',
+        spec: 'ERC-7710 + EIP-712',
+        severity: 'high',
+        async run(target) {
+            const reader = delegationReader(target);
+            const expected = computeDomainHash({
+                manager: reader.manager,
+                chainId: await reader.chainId(),
+                name: await reader.name(),
+                version: await reader.version(),
+            });
+            const actual = await reader.domainHash();
+            if (toHex32(expected) !== toHex32(actual)) {
+                throw new Error(`getDomainHash() = ${actual}, expected ${expected} — a cross-chain/cross-contract replay vector`);
+            }
+            return 'domain separator matches the EIP-712 preimage';
+        },
+    },
+    {
+        id: 'erc7710.manager.delegationHash',
+        title: 'On-chain delegation hash matches the off-chain derivation',
+        spec: 'ERC-7710 + MetaMask delegation-framework',
+        severity: 'critical',
+        async run(target) {
+            const reader = delegationReader(target);
+            const expected = computeDelegationHash(SAMPLE_DELEGATION);
+            const actual = await reader.delegationHash(SAMPLE_DELEGATION);
+            if (toHex32(expected) !== toHex32(actual)) {
+                throw new Error(`getDelegationHash() = ${actual}, off-chain derivation = ${expected}`);
+            }
+            return 'delegation hash derivation agrees with the manager';
+        },
+    },
+    {
+        id: 'erc7710.manager.signatureIgnored',
+        title: 'Delegation hash ignores the signature field',
+        spec: 'ERC-7710 + MetaMask delegation-framework',
+        severity: 'high',
+        async run(target) {
+            const reader = delegationReader(target);
+            const withSignature = { ...SAMPLE_DELEGATION, signature: '0xdeadbeef' };
+            const plain = await reader.delegationHash(SAMPLE_DELEGATION);
+            const signed = await reader.delegationHash(withSignature);
+            if (toHex32(plain) !== toHex32(signed)) {
+                throw new Error('a signature change altered the delegation hash — signing would invalidate it');
+            }
+            return 'signature is excluded from the hash';
+        },
+    },
+    {
+        id: 'erc7710.manager.rootAuthority',
+        title: 'ROOT_AUTHORITY matches the reference sentinel',
+        spec: 'ERC-7710 + MetaMask delegation-framework',
+        severity: 'medium',
+        async run(target) {
+            const reader = delegationReader(target);
+            const actual = await reader.rootAuthority();
+            if (toHex32(actual) !== toHex32(ROOT_AUTHORITY)) {
+                throw new Error(`ROOT_AUTHORITY() = ${actual}, expected ${ROOT_AUTHORITY}`);
+            }
+            return 'ROOT_AUTHORITY is the all-ones sentinel';
+        },
+    },
+    {
+        id: 'erc7710.manager.anyDelegate',
+        title: 'ANY_DELEGATE matches the reference sentinel',
+        spec: 'ERC-7710 + MetaMask delegation-framework',
+        severity: 'medium',
+        async run(target) {
+            const reader = delegationReader(target);
+            const actual = await reader.anyDelegate();
+            if (actual.toLowerCase() !== ANY_DELEGATE.toLowerCase()) {
+                throw new Error(`ANY_DELEGATE() = ${actual}, expected ${ANY_DELEGATE}`);
+            }
+            return 'ANY_DELEGATE is the reference wildcard';
+        },
+    },
+    {
+        id: 'erc7710.manager.notDisabledByDefault',
+        title: 'An unspent delegation hash is not disabled',
+        spec: 'ERC-7710 + MetaMask delegation-framework',
+        severity: 'high',
+        async run(target) {
+            const reader = delegationReader(target);
+            const hash = computeDelegationHash({ ...SAMPLE_DELEGATION, salt: 999n });
+            if (await reader.isDelegationDisabled(hash)) {
+                throw new Error(`disabledDelegations(${hash}) = true for a fresh delegation`);
+            }
+            return 'fresh delegation hashes read as enabled';
+        },
+    },
+];
+/** ERC-7710 delegation suite. */
+export const ERC7710_SUITE = {
+    name: 'ERC-7710',
+    spec: 'ERC-7710 (Smart Contract Delegation)',
+    checks: ERC7710_CHECKS,
+};
+function toAbiDelegation(delegation) {
+    return {
+        delegate: delegation.delegate,
+        delegator: delegation.delegator,
+        authority: delegation.authority,
+        caveats: delegation.caveats.map((caveat) => ({
+            enforcer: caveat.enforcer,
+            terms: caveat.terms,
+            args: caveat.args ?? '0x',
+        })),
+        salt: delegation.salt,
+        signature: delegation.signature ?? '0x',
+    };
+}
+/** Points the ERC-7710 suite at a live `DelegationManager` via a viem client. */
+export function createViemDelegationReader(client, manager) {
+    return {
+        manager,
+        async hasCode(address) {
+            const code = await client.getCode({ address });
+            return Boolean(code && code !== '0x');
+        },
+        chainId: () => client.getChainId(),
+        domainHash: () => client.readContract({ address: manager, abi: erc7710ManagerAbi, functionName: 'getDomainHash' }),
+        delegationHash: (delegation) => client.readContract({
+            address: manager,
+            abi: erc7710ManagerAbi,
+            functionName: 'getDelegationHash',
+            args: [toAbiDelegation(delegation)],
+        }),
+        isDelegationDisabled: (delegationHash) => client.readContract({
+            address: manager,
+            abi: erc7710ManagerAbi,
+            functionName: 'disabledDelegations',
+            args: [delegationHash],
+        }),
+        name: () => client.readContract({ address: manager, abi: erc7710ManagerAbi, functionName: 'NAME' }),
+        version: () => client.readContract({ address: manager, abi: erc7710ManagerAbi, functionName: 'VERSION' }),
+        rootAuthority: () => client.readContract({ address: manager, abi: erc7710ManagerAbi, functionName: 'ROOT_AUTHORITY' }),
+        anyDelegate: () => client.readContract({ address: manager, abi: erc7710ManagerAbi, functionName: 'ANY_DELEGATE' }),
+    };
+}
+//# sourceMappingURL=delegation.js.map