@keelcodes/conformance 0.1.0

package/dist/redteam.js

@@ -0,0 +1,190 @@
+/** The threat catalogue, mapped test-by-test to `docs/THREAT_MODEL.md` §4. */
+export const REDTEAM_CASES = [
+    {
+        threat: 'T-BYPASS-01',
+        test: 'test_T_BYPASS_01_delegatecallCannotReachThePolicy',
+        title: 'delegatecall cannot route execution around the policy',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-BYPASS-02',
+        test: 'test_T_BYPASS_02_unknownDispatchSelectorRefused',
+        title: 'an unknown dispatch selector is refused',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-BYPASS-03',
+        test: 'test_T_BYPASS_03_transferFromCannotDrain',
+        title: 'transferFrom cannot drain a token-limited rule',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-BYPASS-04',
+        test: 'test_T_BYPASS_04_shortCalldataCannotSpoofAmount',
+        title: 'short calldata cannot spoof the amount as zero',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-BYPASS-05',
+        test: 'test_T_BYPASS_05_selectorWhitelistCannotBeWidened',
+        title: 'a rule selector whitelist cannot be widened from the call site',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-BYPASS-06',
+        test: 'test_T_BYPASS_06_unauthorisedTargetRefused',
+        title: 'a target no rule authorises is refused',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-CEILING-01',
+        test: 'test_T_CEILING_01_batchCannotSplitAroundDailyCap',
+        title: 'a batch cannot split around the native daily cap',
+        severity: 'high',
+    },
+    {
+        threat: 'T-CEILING-02',
+        test: 'test_T_CEILING_02_batchCannotSplitAroundTokenDailyCap',
+        title: 'a batch cannot split around the token daily cap',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ACCRUAL-01',
+        test: 'test_T_ACCRUAL_01_reinstallCannotResetCounters',
+        title: 're-installing a session cannot reset its counters',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ACCRUAL-02',
+        test: 'test_T_ACCRUAL_02_foreignCallerCannotTouchAccrual',
+        title: 'a foreign caller cannot touch another account\'s accrual',
+        severity: 'high',
+    },
+    {
+        threat: 'T-WINDOW-01',
+        test: 'test_T_WINDOW_01_expiredSessionRefused',
+        title: 'a session cannot be used outside its validity window',
+        severity: 'high',
+    },
+    {
+        threat: 'T-LIFECYCLE-01',
+        test: 'test_T_LIFECYCLE_01_uninstalledSessionCannotBeUsed',
+        title: 'an uninstalled session cannot be used',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-ENVELOPE-01',
+        test: 'test_T_ENVELOPE_01_drawBeyondCapRefused',
+        title: 'a draw past the envelope cap is refused',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ENVELOPE-02',
+        test: 'test_T_ENVELOPE_02_attenuatedCannotRedelegate',
+        title: 'an attenuated envelope cannot delegate again',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ENVELOPE-03',
+        test: 'test_T_ENVELOPE_03_allocationsCannotExceedRootCap',
+        title: 'child allocations cannot sum past the root cap',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-ENVELOPE-04',
+        test: 'test_T_ENVELOPE_04_revokedOrExpiredAdvanceRefused',
+        title: 'a revoked or expired envelope cannot advance its cursor',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ENVELOPE-05',
+        test: 'test_T_ENVELOPE_05_unauthorizedAdvanceAndStatusRefused',
+        title: 'a stranger cannot advance a cursor or drive an unauthorized status change',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-ENVELOPE-06',
+        test: 'test_T_ENVELOPE_06_capabilityRootMismatchRefused',
+        title: 'a capability that does not hash to its capabilityRoot is refused',
+        severity: 'critical',
+    },
+    {
+        threat: 'T-ENVELOPE-07',
+        test: 'test_T_ENVELOPE_07_duplicateRegistrationRefused',
+        title: 're-registering the same (principal, capabilityRoot, salt) is refused',
+        severity: 'high',
+    },
+    {
+        threat: 'T-ENVELOPE-08',
+        test: 'test_T_ENVELOPE_08_foreignEnvelopeCannotBeBound',
+        title: "a session cannot be bound to a stranger's envelope",
+        severity: 'high',
+    },
+    {
+        threat: 'T-ENVELOPE-09',
+        test: 'test_T_ENVELOPE_09_childApproversMustBeSubset',
+        title: "an attenuated child cannot swap in its own approver set",
+        severity: 'high',
+    },
+];
+function redTeamPort(target) {
+    const port = target.redTeam;
+    if (port === undefined) {
+        throw new Error('the red-team suite needs a `redTeam` port on the target');
+    }
+    return port;
+}
+export const REDTEAM_CHECKS = REDTEAM_CASES.map((testCase) => ({
+    id: `redteam.${testCase.threat.toLowerCase()}`,
+    title: `${testCase.threat} — ${testCase.title}`,
+    spec: 'THREAT_MODEL.md §4',
+    severity: testCase.severity,
+    async run(target) {
+        const outcome = await redTeamPort(target).outcomeOf(testCase.test);
+        if (outcome === undefined) {
+            throw new Error(`not run — Foundry case ${testCase.test} (${testCase.threat}) was not executed`);
+        }
+        if (!outcome) {
+            throw new Error(`Foundry-verified ✗ ${testCase.test} FAILED — ${testCase.threat} may be exploitable`);
+        }
+        return `Foundry-verified ✓ ${testCase.test} refuses ${testCase.threat}`;
+    },
+}));
+/** Red-team suite: Foundry adversarial cases reported through the conformance runner. */
+export const REDTEAM_SUITE = {
+    name: 'Red-team',
+    spec: 'docs/THREAT_MODEL.md §4 (KeelPolicyHook + KeelBoundedActions adversarial cases)',
+    checks: REDTEAM_CHECKS,
+};
+/** Adapts a `testName → passed` table (e.g. from {@link parseForgeRedTeamReport}) to a {@link RedTeamPort}. */
+export function toRedTeamPort(results) {
+    return { outcomeOf: async (testName) => results[testName] };
+}
+/** Strips a Foundry function signature (`test_Foo()`, `test_Foo(uint256)`) back to its name. */
+function normalizeTestName(name) {
+    return name.replace(/\(.*\)$/, '');
+}
+/**
+ * Parses `forge test --match-path 'test/redteam/*' --json` output into a
+ * `testName → passed` table. Forge nests results by file → contract →
+ * `test_results`, so the walk is structural rather than depth-fixed; any leaf
+ * carrying a `status` is recorded.
+ */
+export function parseForgeRedTeamReport(value) {
+    const results = {};
+    const visit = (node, name) => {
+        if (typeof node !== 'object' || node === null)
+            return;
+        const record = node;
+        const status = record['status'];
+        if (typeof status === 'string' && name !== undefined) {
+            results[normalizeTestName(name)] = status === 'Success';
+            return;
+        }
+        for (const [key, child] of Object.entries(record))
+            visit(child, key);
+    };
+    visit(value);
+    return results;
+}
+//# sourceMappingURL=redteam.js.map

package/dist/redteam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redteam.js","sourceRoot":"","sources":["../src/redteam.ts"],"names":[],"mappings":"AA0BA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,mDAAmD;QACzD,KAAK,EAAE,uDAAuD;QAC9D,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,0CAA0C;QAChD,KAAK,EAAE,gDAAgD;QACvD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,gDAAgD;QACvD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,mDAAmD;QACzD,KAAK,EAAE,gEAAgE;QACvE,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,4CAA4C;QAClD,KAAK,EAAE,wCAAwC;QAC/C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,kDAAkD;QACxD,KAAK,EAAE,kDAAkD;QACzD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,uDAAuD;QAC7D,KAAK,EAAE,iDAAiD;QACxD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,gDAAgD;QACtD,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,mDAAmD;QACzD,KAAK,EAAE,0DAA0D;QACjE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,sDAAsD;QAC7D,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,oDAAoD;QAC1D,KAAK,EAAE,uCAAuC;QAC9C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,yCAAyC;QAC/C,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,+CAA+C;QACrD,KAAK,EAAE,8CAA8C;QACrD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,mDAAmD;QACzD,KAAK,EAAE,gDAAgD;QACvD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,mDAAmD;QACzD,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,wDAAwD;QAC9D,KAAK,EAAE,2EAA2E;QAClF,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,kDAAkD;QACxD,KAAK,EAAE,kEAAkE;QACzE,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,sEAAsE;QAC7E,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,oDAAoD;QAC3D,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,+CAA+C;QACrD,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAqB,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/E,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;IAC9C,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;IAC3B,KAAK,CAAC,GAAG,CAAC,MAAM;QACd,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,sBAAsB,QAAQ,CAAC,IAAI,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,iFAAiF;IACvF,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,IAAa,EAAQ,EAAE;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QACtD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,KAAK,SAAS,CAAC;YACxD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,4 @@
+import type { ConformanceReport } from './types.js';
+/** Renders a report as human-readable lines. */
+export declare function formatReport(report: ConformanceReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAY,MAAM,YAAY,CAAC;AAS9D,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAuB9D"}

package/dist/report.js

@@ -0,0 +1,29 @@
+const SEVERITY_MARK = {
+    critical: '!!',
+    high: '! ',
+    medium: '· ',
+    low: '  ',
+};
+/** Renders a report as human-readable lines. */
+export function formatReport(report) {
+    const subject = [];
+    if (report.account !== undefined)
+        subject.push(`account ${report.account}`);
+    if (report.module !== undefined)
+        subject.push(`module ${report.module}`);
+    if (report.moduleTypeId !== undefined && report.moduleTypeId !== 0n) {
+        subject.push(`type ${report.moduleTypeId}`);
+    }
+    const suffix = subject.length > 0 ? ` · ${subject.join(' · ')}` : '';
+    const lines = [
+        `${report.summary.ok ? 'PASS' : 'FAIL'} · ${report.suite} · ${report.results.length} checks${suffix}`,
+    ];
+    for (const result of report.results) {
+        const mark = result.status === 'pass' ? '✓' : '✗';
+        lines.push(`  ${mark} ${SEVERITY_MARK[result.severity]} ${result.id} — ${result.message}`);
+    }
+    const { passed, failed, criticalFailures } = report.summary;
+    lines.push(`${passed} passed · ${failed} failed (${criticalFailures} critical) · ${report.durationMs}ms`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAA6B;IAC9C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,MAAM,KAAK,GAAa;QACtB,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,MAAM,EAAE;KACtG,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5D,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,aAAa,MAAM,YAAY,gBAAgB,gBAAgB,MAAM,CAAC,UAAU,IAAI,CAC9F,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runner.d.ts

@@ -0,0 +1,8 @@
+import type { Check, CheckResult, CheckTarget, ConformanceReport, ConformanceSummary, Suite } from './types.js';
+/** Runs every check, converting thrown errors into failures. Never throws. */
+export declare function runChecks(target: CheckTarget, checks: readonly Check[]): Promise<CheckResult[]>;
+/** Tallies results. `ok` is false on any failure (critical or not). */
+export declare function summarize(results: readonly CheckResult[]): ConformanceSummary;
+/** Runs a suite against a target and returns the full report. */
+export declare function runSuite(target: CheckTarget, suite: Suite): Promise<ConformanceReport>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,EACN,MAAM,YAAY,CAAC;AAqBpB,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,SAAS,KAAK,EAAE,GACvB,OAAO,CAAC,WAAW,EAAE,CAAC,CAMxB;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,kBAAkB,CAa7E;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAc5F"}

package/dist/runner.js

@@ -0,0 +1,62 @@
+async function runCheck(target, check) {
+    const startedAt = Date.now();
+    const base = {
+        id: check.id,
+        title: check.title,
+        spec: check.spec,
+        severity: check.severity,
+        durationMs: 0,
+    };
+    try {
+        const message = await check.run(target);
+        return { ...base, status: 'pass', message, durationMs: Date.now() - startedAt };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ...base, status: 'fail', message, durationMs: Date.now() - startedAt };
+    }
+}
+/** Runs every check, converting thrown errors into failures. Never throws. */
+export async function runChecks(target, checks) {
+    const results = [];
+    for (const check of checks) {
+        results.push(await runCheck(target, check));
+    }
+    return results;
+}
+/** Tallies results. `ok` is false on any failure (critical or not). */
+export function summarize(results) {
+    let passed = 0;
+    let failed = 0;
+    let criticalFailures = 0;
+    for (const result of results) {
+        if (result.status === 'pass') {
+            passed += 1;
+            continue;
+        }
+        failed += 1;
+        if (result.severity === 'critical')
+            criticalFailures += 1;
+    }
+    return { passed, failed, criticalFailures, ok: failed === 0 };
+}
+/** Runs a suite against a target and returns the full report. */
+export async function runSuite(target, suite) {
+    const startedAt = Date.now();
+    const results = await runChecks(target, suite.checks);
+    const report = {
+        suite: suite.name,
+        startedAt: new Date(startedAt).toISOString(),
+        durationMs: Date.now() - startedAt,
+        results,
+        summary: summarize(results),
+    };
+    if (target.account !== undefined)
+        report.account = target.account;
+    if (target.module !== undefined)
+        report.module = target.module;
+    if (target.moduleTypeId !== undefined)
+        report.moduleTypeId = target.moduleTypeId;
+    return report;
+}
+//# sourceMappingURL=runner.js.map

package/dist/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AASA,KAAK,UAAU,QAAQ,CAAC,MAAmB,EAAE,KAAY;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAmB,EACnB,MAAwB;IAExB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU;YAAE,gBAAgB,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAmB,EAAE,KAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAsB;QAChC,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,OAAO;QACP,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;KAC5B,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,227 @@
+/** `0x`-prefixed hex string. */
+export type Hex = `0x${string}`;
+/** `0x`-prefixed 20-byte address. */
+export type Address = `0x${string}`;
+/**
+ * ERC-7579 module type ids. Declared here on purpose: a conformance suite must
+ * depend on the *standards*, not on any particular project's adapter package, so
+ * it can be pointed at any ERC-7579 account or module.
+ */
+export declare const MODULE_TYPE: {
+    readonly VALIDATOR: 1n;
+    readonly EXECUTOR: 2n;
+    readonly FALLBACK: 3n;
+    readonly HOOK: 4n;
+};
+export type ModuleTypeId = (typeof MODULE_TYPE)[keyof typeof MODULE_TYPE];
+/**
+ * Default ERC-7579 execution modes a conformant account must support: callType
+ * `0x00` (single) and `0x01` (batch), execType `0x00` (default), default mode
+ * selector, empty payload.
+ */
+export declare const EXECUTION_MODE: {
+    readonly SINGLE: Hex;
+    readonly BATCH: Hex;
+};
+/** How much a failure matters. `critical` failures gate the suite. */
+export type Severity = 'critical' | 'high' | 'medium' | 'low';
+/**
+ * Everything a check may query. Deliberately a small port rather than a viem
+ * client, so a suite can run against an in-memory fake (tests) or a live chain
+ * ({@link createViemReader}).
+ */
+export interface AccountReader {
+    /** Whether `account` currently has bytecode (i.e. is deployed). */
+    hasCode(account: Address): Promise<boolean>;
+    /** ERC-7579 `isModuleInstalled(moduleTypeId, module, additionalContext)`. */
+    isModuleInstalled(args: {
+        account: Address;
+        module: Address;
+        moduleTypeId: bigint;
+    }): Promise<boolean>;
+    /** ERC-7579 `supportsExecutionMode(bytes32 mode)`. */
+    supportsExecutionMode(account: Address, mode: Hex): Promise<boolean>;
+    /** ERC-7579 `accountId()`. */
+    accountId(account: Address): Promise<string>;
+    /** ERC-7579 `IModule.isInitialized(smartAccount)` on the module. */
+    isModuleInitialized(module: Address, account: Address): Promise<boolean>;
+    /** ERC-7579 `IModule.isModuleType(moduleTypeId)` on the module. */
+    isModuleType(module: Address, moduleTypeId: bigint): Promise<boolean>;
+}
+/**
+ * The write half of ERC-7579's module-manager surface, as a deliberate second
+ * port. Kept separate from {@link AccountReader} so a read-only conformance run
+ * can never mutate an account: install/uninstall only happen when the caller
+ * injects this port explicitly. A live adapter would bind it to a wallet client
+ * (it sends transactions); tests bind it to an in-memory fake.
+ */
+export interface ModuleAdminPort {
+    /** ERC-7579 `installModule(moduleTypeId, module, initData)`. */
+    installModule(args: {
+        account: Address;
+        module: Address;
+        moduleTypeId: bigint;
+        initData?: Hex;
+    }): Promise<void>;
+    /** ERC-7579 `uninstallModule(moduleTypeId, module, deInitData)`. */
+    uninstallModule(args: {
+        account: Address;
+        module: Address;
+        moduleTypeId: bigint;
+        deInitData?: Hex;
+    }): Promise<void>;
+}
+/** A caveat as defined by the ERC-7710 reference implementation. */
+export interface DelegationCaveat {
+    enforcer: Address;
+    terms: Hex;
+    /** Ignored when hashing, so it may change after signing. */
+    args?: Hex;
+}
+/** A delegation as defined by the ERC-7710 reference implementation. */
+export interface Delegation {
+    delegate: Address;
+    delegator: Address;
+    authority: Hex;
+    caveats: readonly DelegationCaveat[];
+    salt: bigint;
+    /** Ignored when hashing, so it may change after signing. */
+    signature?: Hex;
+}
+/**
+ * ERC-7710 delegation reads, bound to the `DelegationManager` under test.
+ *
+ * The EIP itself fixes only `redeemDelegations`; the getters below come from the
+ * MetaMask delegation-framework reference implementation that the EIP names.
+ * The reader is bound to one manager so checks need no extra arguments.
+ */
+export interface DelegationReader {
+    manager: Address;
+    hasCode(address: Address): Promise<boolean>;
+    chainId(): Promise<number>;
+    domainHash(): Promise<Hex>;
+    delegationHash(delegation: Delegation): Promise<Hex>;
+    isDelegationDisabled(delegationHash: Hex): Promise<boolean>;
+    name(): Promise<string>;
+    version(): Promise<string>;
+    rootAuthority(): Promise<Hex>;
+    anyDelegate(): Promise<Address>;
+}
+/**
+ * ERC-7715 wallet surface — a JSON-RPC (EIP-1193) `request`, not an on-chain
+ * interface. The suite discovers capabilities and inspects granted permissions.
+ */
+export interface PermissionsProvider {
+    request(args: {
+        method: string;
+        params?: readonly unknown[];
+    }): Promise<unknown>;
+}
+/** ERC-8004 registry reads, bound to one agent. */
+export interface AgentRegistryReader {
+    identityRegistry: Address;
+    /** Optional; enables the reputation-binding check when present. */
+    reputationRegistry?: Address;
+    agentId: bigint;
+    hasCode(address: Address): Promise<boolean>;
+    ownerOf(): Promise<Address>;
+    tokenURI(): Promise<string>;
+    agentWallet(): Promise<Address>;
+    supportsInterface(interfaceId: Hex): Promise<boolean>;
+    reputationIdentityRegistry(): Promise<Address>;
+}
+/**
+ * Red-team results port. Each `Check` in the red-team suite corresponds to one
+ * Foundry case; the port reports whether that case passed, or `undefined` when
+ * it was not executed — so a report can distinguish "Foundry-verified" from
+ * "not run" instead of silently omitting unverified threats.
+ */
+export interface RedTeamPort {
+    /** Whether the named Foundry test passed; `undefined` when it was not run. */
+    outcomeOf(testName: string): Promise<boolean | undefined>;
+}
+/**
+ * The subject of a conformance run. ERC-7579 needs the account fields; every
+ * other suite carries its own bound port, so those fields are optional and only
+ * the relevant suite reads them.
+ */
+export interface CheckTarget {
+    reader?: AccountReader;
+    /** Write half of the ERC-7579 module-manager surface; enables lifecycle checks. */
+    moduleAdmin?: ModuleAdminPort;
+    /** The smart account under test (ERC-7579). */
+    account?: Address;
+    /** The module under test (ERC-7579), typically installed on `account`. */
+    module?: Address;
+    /** ERC-7579 module type of `module` on `account`. */
+    moduleTypeId?: bigint;
+    delegation?: DelegationReader;
+    permissions?: PermissionsProvider;
+    agentRegistry?: AgentRegistryReader;
+    redTeam?: RedTeamPort;
+}
+/** Narrows a target to the ERC-7579 account fields, or throws. */
+export declare function accountTarget(target: CheckTarget): {
+    reader: AccountReader;
+    account: Address;
+    module: Address;
+    moduleTypeId: bigint;
+};
+/**
+ * Narrows a target to the ERC-7579 module-lifecycle fields, or throws. The
+ * mutation checks need both the read port and the explicit write port, so a
+ * plain read-only run fails them loudly instead of silently skipping.
+ */
+export declare function moduleAdminTarget(target: CheckTarget): {
+    reader: AccountReader;
+    moduleAdmin: ModuleAdminPort;
+    account: Address;
+    module: Address;
+    moduleTypeId: bigint;
+};
+/**
+ * A single conformance assertion. `run` returns a short pass message, or throws
+ * to fail — throwing keeps checks readable and lets the runner attach context.
+ */
+export interface Check {
+    id: string;
+    title: string;
+    /** Spec anchor, e.g. `ERC-7579 §3.1`. */
+    spec: string;
+    severity: Severity;
+    run(target: CheckTarget): Promise<string>;
+}
+export interface CheckResult {
+    id: string;
+    title: string;
+    spec: string;
+    severity: Severity;
+    status: 'pass' | 'fail';
+    message: string;
+    durationMs: number;
+}
+export interface ConformanceSummary {
+    passed: number;
+    failed: number;
+    criticalFailures: number;
+    /** `true` only when nothing failed and no `critical` check failed. */
+    ok: boolean;
+}
+export interface ConformanceReport {
+    /** Name of the suite that produced the report. */
+    suite: string;
+    account?: Address;
+    module?: Address;
+    moduleTypeId?: bigint;
+    startedAt: string;
+    durationMs: number;
+    results: CheckResult[];
+    summary: ConformanceSummary;
+}
+/** A named, ordered bundle of checks for one standard. */
+export interface Suite {
+    name: string;
+    spec: string;
+    checks: readonly Check[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAChC,qCAAqC;AACrC,MAAM,MAAM,OAAO,GAAG,KAAK,MAAM,EAAE,CAAC;AAEpC;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;;CAKd,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,cAAc;qBACS,GAAG;oBACF,GAAG;CAC9B,CAAC;AAEX,sEAAsE;AACtE,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,6EAA6E;IAC7E,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvG,sDAAsD;IACtD,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,8BAA8B;IAC9B,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,oEAAoE;IACpE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,mEAAmE;IACnE,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,aAAa,CAAC,IAAI,EAAE;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,GAAG,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,oEAAoE;IACpE,eAAe,CAAC,IAAI,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,GAAG,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,GAAG,CAAC;IACX,4DAA4D;IAC5D,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,GAAG,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,oBAAoB,CAAC,cAAc,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClF;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,iBAAiB,CAAC,WAAW,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mFAAmF;IACnF,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG;IAClD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,CAMA;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG;IACtD,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,eAAe,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,CAcA;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;CAC1B"}

package/dist/types.js

@@ -0,0 +1,45 @@
+/**
+ * ERC-7579 module type ids. Declared here on purpose: a conformance suite must
+ * depend on the *standards*, not on any particular project's adapter package, so
+ * it can be pointed at any ERC-7579 account or module.
+ */
+export const MODULE_TYPE = {
+    VALIDATOR: 1n,
+    EXECUTOR: 2n,
+    FALLBACK: 3n,
+    HOOK: 4n,
+};
+/**
+ * Default ERC-7579 execution modes a conformant account must support: callType
+ * `0x00` (single) and `0x01` (batch), execType `0x00` (default), default mode
+ * selector, empty payload.
+ */
+export const EXECUTION_MODE = {
+    SINGLE: `0x${'00'.repeat(32)}`,
+    BATCH: `0x01${'00'.repeat(31)}`,
+};
+/** Narrows a target to the ERC-7579 account fields, or throws. */
+export function accountTarget(target) {
+    const { reader, account, module, moduleTypeId } = target;
+    if (reader === undefined || account === undefined || module === undefined || moduleTypeId === undefined) {
+        throw new Error('the ERC-7579 suite needs reader, account, module and moduleTypeId on the target');
+    }
+    return { reader, account, module, moduleTypeId };
+}
+/**
+ * Narrows a target to the ERC-7579 module-lifecycle fields, or throws. The
+ * mutation checks need both the read port and the explicit write port, so a
+ * plain read-only run fails them loudly instead of silently skipping.
+ */
+export function moduleAdminTarget(target) {
+    const { reader, moduleAdmin, account, module, moduleTypeId } = target;
+    if (reader === undefined ||
+        moduleAdmin === undefined ||
+        account === undefined ||
+        module === undefined ||
+        moduleTypeId === undefined) {
+        throw new Error('the ERC-7579 module lifecycle checks need reader, moduleAdmin, account, module and moduleTypeId on the target');
+    }
+    return { reader, moduleAdmin, account, module, moduleTypeId };
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;CACA,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAS;IACrC,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAS;CAC9B,CAAC;AA8IX,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,MAAmB;IAM/C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IAOnD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACtE,IACE,MAAM,KAAK,SAAS;QACpB,WAAW,KAAK,SAAS;QACzB,OAAO,KAAK,SAAS;QACrB,MAAM,KAAK,SAAS;QACpB,YAAY,KAAK,SAAS,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAChE,CAAC"}