@meantjs/consent 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 The five Candid Profile library packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`, `/reconcile`) release together under one version and pin each other exactly; a version appears here even when this package did not change. Release steps: `docs/releasing.md` in the repository.
 
+## 0.2.0 — 2026-10-28
+
+- A call takes the `intent` and `effect` of the deepest tagged variant case its arguments hold, else the method's
+  (spec §5.2, D-053): the title, template and provenance of the message, the model's `effect` and the effect line
+  of the SNS rendering. A resolved form without case tags renders as before. The Rust version does the same.
+- EVM contracts, experimental (spec §15, D-054), in two new subpaths; the main entry is unchanged and refuses an EVM
+  resolved form (`E_RESOLVED_FORM`).
+  - `@meantjs/consent/evm`: `decodeCalldata` (strict) and `evmConsent`, the consent text of a call in the generic or
+    fields form, ending with the contract's address and chain. A call to a contract its profiles do not list is
+    `E_DEPLOYMENT`; a payable function is refused until its native value has a position.
+  - `@meantjs/consent/erc7730`: `erc7730Descriptor`, the ERC-7730 clear-signing file of a contract (schema 2.1.0,
+    deterministic) with its ERC-8176 `descriptorHash`; `descriptorHash`; `erc8176Attestation`, the unsigned EAS
+    offchain attestation a reviewer signs, with its EIP-712 digest. What a file cannot say is refused (`E_EXPORT`).
+  - New codes `E_DEPLOYMENT` and `E_EXPORT`. The Rust version does not cover EVM.
+
 ## 0.1.0 — 2026-10-28
 
 First published version.

package/README.md

@@ -6,8 +6,8 @@ ICRC-21 consent messages, and the text an SNS proposal's validator returns, from
 npm install @meantjs/consent
 ```
 
-- **Runs on:** Node 22 or later and browsers for the main entry (no Node built-in, no `Buffer`; checked with esbuild).
-  `@meantjs/consent/sns` hashes with `node:crypto` and is Node only.
+- **Runs on:** Node 22 or later and browsers for the main entry and the EVM subpaths (no Node built-in, no `Buffer`;
+  checked with esbuild). `@meantjs/consent/sns` hashes with `node:crypto` and is Node only.
 - **Module format:** ES modules only, with hand-written TypeScript declarations for every entry.
 - **Spec:** [Candid Profile v0](https://github.com/B3Pay/Meant/blob/main/profile/docs/profile-v0.md). **Licence:** Apache-2.0.
 - **Versions:** the five Candid Profile packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`,
@@ -56,11 +56,41 @@ bundles it with esbuild for the browser platform). The three SNS rows below are
 ## What happens, in order
 
 1. **Decode** (`src/decode.mjs`). The argument bytes are decoded against the method's resolved-form tree into a value tree aligned with its positions: integers as decimal strings, floats as numbers, `blob` as `Uint8Array`, absent `opt` as `null`, records as objects keyed like `fields`, variants as `{ tag, value }`, vectors as arrays. Nothing is rounded or truncated.
-2. **Intent** (`src/template.mjs`, `src/model.mjs`). The method's `intent.template`: placeholders rendered through `formatterFor` of `@meantjs/format` (so `amount`, `timestamp`, `duration`, `account`, `subaccount`, `bytes` mean exactly what arm C means), `[ ... ]` dropped when a placeholder inside is absent, escapes `{{ }} [[ ]]`. Untagged positions render as Candid text. A method without `intent` gets a generic intent (title from `describe.label` of the method or `Call <method>`, one row per argument leaf). The renderer has no network access and never states anything about ledger state; dynamic refs come in through `refs`. A ref you did not supply stops the message (`E_REF_UNRESOLVED`), a number is never shown without its decimals.
+2. **Intent** (`src/template.mjs`, `src/model.mjs`). The call's `intent.template`: that of the deepest variant case with an `intent` that the decoded arguments hold, else the method's (spec §5.2, D-053; the call's effect, shown in the SNS rendering, is chosen the same way). A resolved form whose tagged cases one call holds side by side is not one a resolver writes; the method's tag is used for it. placeholders rendered through `formatterFor` of `@meantjs/format` (so `amount`, `timestamp`, `duration`, `account`, `subaccount`, `bytes` mean exactly what arm C means), `[ ... ]` dropped when a placeholder inside is absent, escapes `{{ }} [[ ]]`. Untagged positions render as Candid text. A method without `intent` gets a generic intent (title from `describe.label` of the method or `Call <method>`, one row per argument leaf). The renderer has no network access and never states anything about ledger state; dynamic refs come in through `refs`. A ref you did not supply stops the message (`E_REF_UNRESOLVED`), a number is never shown without its decimals.
 3. **Forms** (`src/render.mjs`, `src/icrc21.mjs`), section 12:
    - `FieldsDisplayMessage`: `intent` = title, `": "`, rendered template; one `(label, Value)` row per placeholder, label from `describe.label` else the field name; `amount` is a `TokenAmount` when it fits `nat64` and has a symbol, else `Text`; `timestamp` is `TimestampSeconds` after an exact ns-to-s conversion (the library throws `E_INEXACT` otherwise and the row is `Text` in RFC 3339 UTC); `duration` is `DurationSeconds`; everything else is `Text`. UTC only, never zone-sensitive.
    - `GenericDisplayMessage`: `# title`, the rendered template as a paragraph, then `- **label:** value` for the same fields. Times are shown in `utc_offset_minutes` (`2026-10-09 14:00:00 UTC+02:00`), UTC when absent, and the response metadata says which offset was applied.
 
+## EVM contracts (experimental: `src/evm.mjs`, `src/erc7730.mjs`)
+
+Spec section 15, D-054. An EVM contract's resolved form (`"chain": "evm"`, from `resolveService({ abi })` of
+`@meantjs/profile`) is read by two subpaths; the main entry refuses it with `E_RESOLVED_FORM`, and `evmConsent` refuses
+a Candid one.
+
+| Function | Does |
+|---|---|
+| `decodeCalldata(resolved, calldata, limits)` (`/evm`) | The function a selector names and its arguments, keyed by parameter name. Strict: values read from anything but their canonical ABI encoding are `E_DECODE`. |
+| `evmConsent({ resolved, calldata, to, chainId, refs, form, utcOffsetMinutes, rawArguments, limits })` (`/evm`) | The consent text of a call: the same model and the same two forms as ICRC-21, without its envelope (`"generic"` Markdown, or `"fields"` as an intent line and `[label, text]` rows), ending with the contract's address and chain, which a person must see because a pack matches any contract with the right functions. A call to a contract its profiles do not list is `E_DEPLOYMENT`; a payable function is `E_UNSUPPORTED_TYPE` (its native value has no position yet). |
+| `erc7730Descriptor(resolved, { deployments, owner, contractName, info, token })` (`/erc7730`) | The contract's ERC-7730 clear-signing file and its ERC-8176 `descriptorHash`: deterministic, `$schema` pinned to the exact 2.1.0 file, one entry per function a transaction calls. What an ERC-7730 file cannot say (a time in ms, `utf8` bytes, an amount in another token, an unnamed parameter, a placeholder over an array) is `E_EXPORT`, never written as something near it; no deployment is `E_DEPLOYMENT`. The mapping is the table in spec §15.7. |
+| `descriptorHash(descriptor)` (`/erc7730`) | Keccak-256 of the RFC 8785 form: the hash of a file someone edited. |
+| `erc8176Attestation({ descriptorHash, time, expirationTime, salt, refUID })` (`/erc7730`) | The unsigned ERC-8176 attestation (EAS offchain v2 typed data) and its EIP-712 digest, for a reviewer to sign with their own key. Nothing is signed or sent. |
+
+```js
+import { evmConsent } from "@meantjs/consent/evm";
+import { erc7730Descriptor, erc8176Attestation } from "@meantjs/consent/erc7730";
+
+evmConsent({ resolved, calldata, to: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2", refs: { "query:decimals": 18, "query:symbol": "WETH" } }).message;
+// # Send tokens\n\nSend `1.5 WETH` to `0xfB69…d359`\n\n- **Amount:** `1.5 WETH`\n- **Recipient:** `0xfB69…d359`\n\n**Contract:** `0xC02a…6Cc2`
+const { descriptor, descriptorHash } = erc7730Descriptor(resolved, { deployments: [{ chainId: 1, address: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" }] });
+const { typedData, digest } = erc8176Attestation({ descriptorHash, time: 1777630591, expirationTime: 1785406591, salt });
+```
+
+Every exported file in the tests is checked against the ERC-7730 2.1.0 JSON Schema (vendored in
+`test/upstream/erc7730/`, CC0, sha256 in its `SOURCE.json`), and the hashes and digests they pin were computed by an
+independent implementation. **Fact** (ERC-7730): a wallet that finds no ticker for a `tokenAmount` "SHOULD display the
+raw value instead with an 'Unknown token' warning"; this package would produce no message there, and a file cannot make
+a wallet refuse. The Rust version does not cover EVM.
+
 ## SNS proposal validators (`src/sns.mjs`)
 
 The governance counterpart of ICRC-21. An SNS proposal that executes a generic nervous system function calls a dapp method with a payload. Apart from the proposer's own title and summary, the only description of that payload governance shows is the text the dapp's validator method returns. `snsValidatorRendering` is that validator, generated from the profile. Proposal for the spec text: `docs/proposals/w4-sns-validator-rendering.md`.
@@ -125,7 +155,7 @@ The relying party is not trusted, so every value that comes from the call is sho
 |---|---|
 | Unknown method, argument bytes that do not decode, arguments too large, malformed request, unsupported language with `languagePolicy: "error"` | `UnsupportedCanisterCall` (`description` starts with the code: `E_METHOD_UNKNOWN`, `E_DECODE`, `E_TOO_LARGE`, `E_REQUEST`, `E_LANGUAGE`) |
 | A value that reaches a position the resolved form cuts (`recursive: true`; a call whose value avoids every cut gets its message, D-042), or a method with a `func` or `service` position | `ConsentMessageUnavailable` (`E_UNSUPPORTED_TYPE`) |
-| Missing dynamic ref, invalid tag argument, malformed resolved form | `GenericError` with `error_code` 1100 (ref), 1101 (arg), 1102 (tag type), 1103 (tag conflict), 1000 (resolved form), 1999 (internal) |
+| Missing dynamic ref, invalid tag argument, malformed resolved form (an EVM one among them) | `GenericError` with `error_code` 1100 (ref), 1101 (arg), 1102 (tag type), 1103 (tag conflict), 1000 (resolved form), 1999 (internal) |
 
 A language other than English is **not** an error: ICRC-21 says a message "should be preferred over sending an icrc21_error" and "the metadata must match the consent_message provided", so the answer is English with `metadata.language: "en"` (`I_LANGUAGE_FALLBACK` in `diagnostics`). Limits are explicit and never truncate: 2 MiB of argument bytes, 64 fields, 256 list elements, 32 KiB of message text.
 
@@ -213,3 +243,5 @@ Untrusted third-party data lives in `test/upstream/icrc21/` (the standard, commi
 - The caller's account (`From`) and a fee line: see `docs/oisy-comparison.md` for why they are absent.
 - Other languages; `device_spec` hints beyond the two forms.
 - Recursive and `func`/`service` positions (need a richer resolved form, or the Contract).
+- EVM: payable functions in the consent text, EIP-712 messages, ERC-7730 import, checking attestations, and the Rust
+  version.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meantjs/consent",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "ICRC-21 consent messages and SNS proposal validator renderings generated from a Candid Profile resolved form: any method, both GenericDisplayMessage and FieldsDisplayMessage, values formatted and escaped, nothing rounded.",
   "license": "Apache-2.0",
   "repository": {
@@ -19,7 +19,11 @@
     "icrc-21",
     "consent-message",
     "sns",
-    "wallet"
+    "wallet",
+    "evm",
+    "erc-7730",
+    "erc-8176",
+    "clear-signing"
   ],
   "type": "module",
   "sideEffects": false,
@@ -34,6 +38,14 @@
       "types": "./src/sns.d.mts",
       "default": "./src/sns.mjs"
     },
+    "./evm": {
+      "types": "./src/evm.d.mts",
+      "default": "./src/evm.mjs"
+    },
+    "./erc7730": {
+      "types": "./src/erc7730.d.mts",
+      "default": "./src/erc7730.mjs"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -51,12 +63,13 @@
     "sns": "node scripts/sns-render.mjs"
   },
   "dependencies": {
-    "@meantjs/profile": "0.1.0",
-    "@meantjs/format": "0.1.0",
-    "@candid-core/schema": "0.5.0"
+    "@candid-core/schema": "0.5.0",
+    "@meantjs/format": "0.2.0",
+    "@meantjs/profile": "0.2.0"
   },
   "devDependencies": {
     "@dfinity/didc": "0.0.4",
+    "ajv": "8.18.0",
     "commonmark": "0.31.2",
     "esbuild": "0.28.2"
   }

package/src/display.mjs

@@ -77,6 +77,7 @@ export class Renderer {
 
   /** Candid text of a whole argument tuple (the "raw arguments" of spec section 11 item 1), tagged children formatted. */
   tupleText(nodes, values) {
+    if (isAbiParams(nodes)) return this.charge(this.#child(nodes[0], values[0], "arguments"));
     return this.charge(`(${nodes.map((n, i) => this.#child(n, values[i], `argument ${i}`)).join(", ")})`);
   }
 
@@ -87,6 +88,7 @@ export class Renderer {
   plainTupleText(nodes, values) {
     this.#plain = true;
     try {
+      if (isAbiParams(nodes)) return this.charge(this.#child(nodes[0], values[0], "arguments"));
       return this.charge(`(${nodes.map((n, i) => this.#child(n, values[i], `argument ${i}`)).join(", ")})`);
     } finally {
       this.#plain = false;
@@ -126,6 +128,7 @@ export class Renderer {
   }
 
   #raw(node, value, where) {
+    if (typeof node.abi === "string") return this.#abi(node, value, where);
     switch (node.candid) {
       case "null":
       case "reserved":
@@ -158,6 +161,30 @@ export class Renderer {
     }
   }
 
+  /**
+   * ABI text of an EVM value (spec section 15), as evm.mjs decodes it: an address in its EIP-55 form, bytes as 0x hex,
+   * a string quoted, an array in [ ], a tuple in ( ) with its component names.
+   */
+  #abi(node, value, where) {
+    switch (node.abi) {
+      case "address":
+        return value;
+      case "bool":
+        return value ? "true" : "false";
+      case "string":
+        return candidString(value);
+      case "array":
+        return `[${value.map((e, i) => this.#child(node.element, e, `${where}[${i}]`)).join(", ")}]`;
+      case "tuple":
+        return `(${entriesOf(node.fields)
+          .map(([key, child]) => `${key.startsWith("#") ? "" : `${key}: `}${this.#child(child, value[key], `${where}.${key}`)}`)
+          .join(", ")})`;
+      default:
+        if (value instanceof Uint8Array) return `0x${[...value].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+        return String(value); // integers (decimal strings)
+    }
+  }
+
   /**
    * The ICRC-21 `Value` of one value (spec section 12). Falls back to `Text` whenever the typed form cannot carry
    * the value exactly: an amount above nat64 or negative or without a symbol, a timestamp or duration that is not a
@@ -197,6 +224,9 @@ export class Renderer {
   }
 }
 
+/** An EVM function's arguments: its parameters as one tuple (spec section 15), written as the ABI writes them. */
+const isAbiParams = (nodes) => nodes.length === 1 && nodes[0]?.abi === "tuple";
+
 /** `UTC`, `UTC+02:00`, `UTC-05:30`. */
 export function zoneName(offsetMinutes) {
   if (offsetMinutes === 0) return "UTC";

package/src/erc7730.d.mts

@@ -0,0 +1,81 @@
+// Types for @meantjs/consent/erc7730: ERC-7730 clear-signing files from an EVM contract's resolved form, and the
+// ERC-8176 attestation a reviewer signs for one (spec section 15, D-054). Hand-written; the source is src/erc7730.mjs.
+// scripts/types.test.mjs keeps the declared names equal to the runtime exports.
+import type { ResolvedForm } from "./index.mjs";
+
+/** The exact-version ERC-7730 schema every exported file names in `$schema`. */
+export const ERC7730_SCHEMA_URL: "https://eips.ethereum.org/assets/eip-7730/erc7730-v2.1.0.schema.json";
+/** ERC-8176's canonical EAS schema UID (`bytes32 descriptorHash`). */
+export const ERC8176_SCHEMA_UID: "0xe023eef113c1670774801c34b377fdf612dd8a4d2fa92fe382e15bd91fafb5c2";
+/** The canonical EAS contract on Ethereum mainnet. */
+export const EAS_ADDRESS: "0xA1207F3BBa224E2c9c3c6D5aF63D0eb1582Ce587";
+
+export interface Erc7730Deployment {
+  chainId: number;
+  /** EIP-55 text. */
+  address: string;
+}
+export interface Erc7730Field {
+  path: string;
+  label: string;
+  format: "tokenAmount" | "amount" | "date" | "duration" | "addressName" | "raw";
+  params?: Record<string, unknown>;
+}
+export interface Erc7730Descriptor {
+  $schema: typeof ERC7730_SCHEMA_URL;
+  context: { contract: { deployments: Erc7730Deployment[] } };
+  metadata?: {
+    owner?: string;
+    contractName?: string;
+    info?: { url: string; deploymentDate?: string };
+    token?: { name: string; ticker: string; decimals: number };
+  };
+  display: { formats: Record<string, { intent: string; interpolatedIntent?: string; fields?: Erc7730Field[] }> };
+}
+export interface Erc7730Options {
+  /** Default: the deployments every profile that lists deployments lists. Given, each must be listed by those profiles. */
+  deployments?: Erc7730Deployment[];
+  owner?: string;
+  contractName?: string;
+  info?: { url: string; deploymentDate?: string };
+  /** Say that the contract is the token its literal amounts are in: written as `metadata.token`. */
+  token?: { name: string };
+}
+/**
+ * The ERC-7730 file of an EVM contract's resolved form and its ERC-8176 `descriptorHash`. What the profile says that an
+ * ERC-7730 file cannot say is refused (E_EXPORT); no deployments is E_DEPLOYMENT.
+ */
+export function erc7730Descriptor(resolved: ResolvedForm, options?: Erc7730Options): { descriptor: Erc7730Descriptor; descriptorHash: string };
+/** ERC-8176 `descriptorHash`: `0x` and the Keccak-256 of the RFC 8785 (JCS) form, for a descriptor without `includes`. */
+export function descriptorHash(descriptor: object): string;
+
+export interface Erc8176Input {
+  descriptorHash: string;
+  /** Unix seconds. */
+  time: bigint | number | string;
+  /** Unix seconds; 0 never expires (ERC-8176 advises a bound). */
+  expirationTime: bigint | number | string;
+  /** 32 random bytes as 0x hex, chosen by the caller. */
+  salt: string;
+  /** Default 32 zero bytes. */
+  refUID?: string;
+}
+export interface Erc8176TypedData {
+  domain: { name: "EAS Attestation"; version: "0.26"; chainId: 1; verifyingContract: typeof EAS_ADDRESS };
+  primaryType: "Attest";
+  types: { Attest: { name: string; type: string }[] };
+  message: {
+    version: 2;
+    schema: typeof ERC8176_SCHEMA_UID;
+    recipient: string;
+    time: string;
+    expirationTime: string;
+    revocable: true;
+    refUID: string;
+    /** abi.encode(descriptorHash): the 32 bytes. */
+    data: string;
+    salt: string;
+  };
+}
+/** The unsigned ERC-8176 offchain attestation (EAS offchain v2 typed data) and its EIP-712 digest. Nothing is signed. */
+export function erc8176Attestation(input: Erc8176Input): { typedData: Erc8176TypedData; digest: string };

package/src/erc7730.mjs

@@ -0,0 +1,304 @@
+// ERC-7730 clear-signing files from an EVM contract's resolved form, and the ERC-8176 attestation a reviewer signs for
+// one (spec section 15, D-054). `@meantjs/consent/erc7730`.
+//
+// The file is the display half of a profile: per function a transaction calls, its `intent` (the intent title), its
+// `interpolatedIntent` (the template) and one field per leaf of its parameters. The same resolved form always gives
+// the same file, so the same `descriptorHash`. What a profile says that an ERC-7730 file cannot say is refused
+// (E_EXPORT), never written as something near it:
+//
+//   amount      tokenAmount of the contract's own token (`tokenPath: "@.to"`): decimals and symbol read from the
+//               ERC-20 `decimals()` and `symbol()`, or given literally and carried as `metadata.token` when the
+//               caller says the contract is that token (`options.token`); `threshold` and `message` one to one.
+//               Refused otherwise (another method, a symbol missing, a token named by an argument).
+//   timestamp   `date` with `encoding: "timestamp"`, seconds only      duration   `duration`, seconds only
+//   bytes       `raw` (hex), hex only                                    address    `addressName`
+//   the rest    `raw`; `describe.label` is the label, else the parameter's name
+//   payable     one more field, `@.value` as `amount` (the native value, which ERC-7730 wallets know and a profile
+//               has no position for yet, O2)
+//
+// The descriptor binds to deployments (ERC-7730 `context.contract.deployments`): the profile's, or the caller's when
+// every profile that lists deployments lists them too. `effect`, `idempotency`, `outcome` and the other agent tags
+// have no ERC-7730 form and are left out: the file carries what a call says, not what it does.
+
+import { AbiError, jcs, keccak256Hex, parseSignature, readAddress, typedDataDigest } from "@meantjs/profile/evm";
+import { CODES, fail } from "./errors.mjs";
+import { resolvePath } from "./paths.mjs";
+import { abiView, entriesOf, labelOf, methodOf, tagArgs } from "./resolved.mjs";
+import { parseTemplate } from "./template.mjs";
+
+/** The exact-version schema every exported file names: an alias would move the hash when the alias moves. */
+export const ERC7730_SCHEMA_URL = "https://eips.ethereum.org/assets/eip-7730/erc7730-v2.1.0.schema.json";
+/** ERC-8176's canonical EAS schema, `bytes32 descriptorHash` (no resolver, revocable). */
+export const ERC8176_SCHEMA_UID = "0xe023eef113c1670774801c34b377fdf612dd8a4d2fa92fe382e15bd91fafb5c2";
+/** The canonical EAS contract on Ethereum mainnet: the verifying contract of an offchain attestation. */
+export const EAS_ADDRESS = "0xA1207F3BBa224E2c9c3c6D5aF63D0eb1582Ce587";
+
+const ZERO32 = `0x${"0".repeat(64)}`;
+const ZERO_ADDRESS = `0x${"0".repeat(40)}`;
+const OPTIONS = new Set(["deployments", "owner", "contractName", "info", "token"]);
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const nonEmpty = (v) => typeof v === "string" && v.trim() !== "";
+
+/** `{ chainId, address }` of the caller or `{ chain_id, address }` of a profile, checked; null when not one. */
+function deploymentOf(d) {
+  const chainId = d?.chainId ?? d?.chain_id;
+  if (!Number.isSafeInteger(chainId) || chainId < 1) return null;
+  try {
+    return { chainId, address: readAddress(d.address) };
+  } catch (e) {
+    if (e instanceof AbiError) return null;
+    throw e;
+  }
+}
+
+function deploymentsOf(resolved, given) {
+  const key = (d) => `${d.chainId}:${d.address}`;
+  const listing = (Array.isArray(resolved.profiles) ? resolved.profiles : []).filter((p) => Array.isArray(p?.deployments));
+  const sets = listing.map((p) => ({ name: p.name, keys: new Set(p.deployments.map(deploymentOf).filter(Boolean).map(key)) }));
+  let out;
+  if (given !== undefined) {
+    if (!Array.isArray(given) || given.length === 0) fail(CODES.REQUEST, "options.deployments must be a non-empty array of { chainId, address }");
+    out = given.map((d, i) => deploymentOf(d) ?? fail(CODES.REQUEST, `options.deployments[${i}] needs a positive integer chainId and an address (0x and 40 hex digits; mixed case must match EIP-55)`));
+    for (const d of out) for (const s of sets) if (!s.keys.has(key(d))) fail(CODES.DEPLOYMENT, `profile ${s.name} does not list ${d.address} on chain ${d.chainId}`);
+  } else {
+    if (listing.length === 0) fail(CODES.DEPLOYMENT, "an ERC-7730 file binds to deployments: give options.deployments, or bind them in a contract profile (binds.deployments)");
+    out = listing[0].deployments.map(deploymentOf).filter((d) => d && sets.every((s) => s.keys.has(key(d))));
+    if (out.length === 0) fail(CODES.DEPLOYMENT, `no deployment is listed by every profile that lists deployments (${listing.map((p) => p.name).join(", ")})`);
+  }
+  const seen = new Set();
+  return out.filter((d) => !seen.has(key(d)) && seen.add(key(d)));
+}
+
+function metadataOf(options) {
+  const metadata = {};
+  for (const k of ["owner", "contractName"]) {
+    if (options[k] === undefined) continue;
+    if (!nonEmpty(options[k])) fail(CODES.REQUEST, `options.${k} must be a non-empty string`);
+    metadata[k] = options[k];
+  }
+  if (options.info !== undefined) {
+    const { url, deploymentDate, ...rest } = isObject(options.info) ? options.info : {};
+    if (!nonEmpty(url) || (deploymentDate !== undefined && !nonEmpty(deploymentDate)) || Object.keys(rest).length) fail(CODES.REQUEST, "options.info must be { url, deploymentDate? } with strings");
+    metadata.info = deploymentDate === undefined ? { url } : { url, deploymentDate };
+  }
+  return metadata;
+}
+
+/** Whether the contract has the ERC-20 `decimals()` and `symbol()` an ERC-7730 wallet reads for `tokenPath: "@.to"`. */
+function erc20Metadata(resolved) {
+  const d = resolved.methods.decimals;
+  const s = resolved.methods.symbol;
+  return isObject(d) && isObject(s) && d.mode === "query" && s.mode === "query" && d.signature === "decimals()" && s.signature === "symbol()" && /^uint\d+$/.test(d.results?.[0]?.abi ?? "") && s.results?.[0]?.abi === "string" && d.results.length === 1 && s.results.length === 1;
+}
+
+/** One ERC-7730 field for a leaf of a function's parameters. */
+function fieldOf(node, path, label, ctx, where) {
+  const field = { path, label };
+  const amount = tagArgs(node, "amount");
+  if (amount !== undefined) {
+    const dynamic = amount.decimals?.from === "query:decimals" && amount.symbol?.from === "query:symbol";
+    const literal = Number.isInteger(amount.decimals) && typeof amount.symbol === "string";
+    if (dynamic) {
+      if (!ctx.erc20) return ctx.problem(where, "amount reads query:decimals and query:symbol, but the contract has no ERC-20 decimals() and symbol() an ERC-7730 wallet reads");
+      ctx.dynamic = true;
+    } else if (literal) {
+      if (!ctx.tokenName) return ctx.problem(where, "amount with literal decimals and symbol: an ERC-7730 file carries them only as the contract's own token (metadata.token); pass options.token = { name } if this contract is that token");
+      const token = { decimals: amount.decimals, ticker: amount.symbol };
+      if (ctx.token && (ctx.token.decimals !== token.decimals || ctx.token.ticker !== token.ticker)) return ctx.problem(where, `amount in ${token.ticker} with ${token.decimals} decimals, where another is in ${ctx.token.ticker} with ${ctx.token.decimals}: an ERC-7730 file has one metadata.token`);
+      ctx.token = token;
+    } else {
+      return ctx.problem(where, "amount without the contract's own decimals and symbol (both read from decimals() and symbol(), or both literal) has no ERC-7730 form");
+    }
+    const params = { tokenPath: "@.to" };
+    if (amount.threshold !== undefined) {
+      params.threshold = `0x${BigInt(amount.threshold).toString(16)}`;
+      params.message = amount.message ?? "Unlimited";
+    }
+    return { ...field, format: "tokenAmount", params };
+  }
+  const time = tagArgs(node, "timestamp") ?? tagArgs(node, "duration");
+  if (time !== undefined) {
+    const kind = tagArgs(node, "timestamp") !== undefined ? "timestamp" : "duration";
+    if (time.unit !== "s") return ctx.problem(where, `${kind} in ${time.unit}: ERC-7730 ${kind === "timestamp" ? "dates" : "durations"} are in seconds`);
+    return kind === "timestamp" ? { ...field, format: "date", params: { encoding: "timestamp" } } : { ...field, format: "duration" };
+  }
+  const bytes = tagArgs(node, "bytes");
+  if (bytes !== undefined && bytes.encoding !== "hex") return ctx.problem(where, `bytes as ${bytes.encoding}: ERC-7730 shows bytes as hex only`);
+  return { ...field, format: node.abi === "address" ? "addressName" : "raw" };
+}
+
+/** Every leaf of a viewed parameter tree, depth first in ABI order: its ERC-7730 path and its label. */
+function leaves(node, keys, out) {
+  if (node.candid === "record") for (const [k, child] of entriesOf(node.fields)) leaves(child, [...keys, k], out);
+  else if (node.candid === "vec") leaves(node.element, [...keys, "[]"], out);
+  else out.push({ node, path: keys.join("."), label: labelOf(node) ?? [...keys].reverse().find((k) => k !== "[]") });
+  return out;
+}
+
+/** A parameter or tuple component without a name: an ERC-7730 key names every one, and paths need the names. */
+function unnamed(params, at = "") {
+  for (const [i, p] of params.entries()) {
+    const here = `${at}${p.name ?? `#${i}`}`;
+    if (p.name === null) return here;
+    let t = p.type;
+    while (t.kind === "array") t = t.element;
+    if (t.kind === "tuple") {
+      const hit = unnamed(t.components, `${here}.`);
+      if (hit) return hit;
+    }
+  }
+  return null;
+}
+
+/** The template as an ERC-7730 interpolatedIntent: `{(0).to}` reads `{to}`, `[[` and `]]` are plain brackets. */
+function interpolated(template, method, ctx, where) {
+  let parts;
+  try {
+    parts = parseTemplate(template);
+  } catch (e) {
+    return ctx.problem(where, e.message);
+  }
+  let out = "";
+  for (const p of parts) {
+    if (p.t === "lit") out += p.text.replaceAll("{", "{{").replaceAll("}", "}}");
+    else if (p.t === "opt") return ctx.problem(where, "an optional [ ] segment has no ERC-7730 form");
+    else {
+      const rp = resolvePath(method, p.path);
+      if (rp.error) return ctx.problem(where, `{${p.path}}: ${rp.error}`);
+      if (rp.steps.some((s) => s.kind === "elem")) return ctx.problem(where, `{${p.path}} reads every element of an array; an ERC-7730 interpolation shows one value`);
+      if (rp.node.candid === "record" || rp.node.candid === "vec") return ctx.problem(where, `{${p.path}} is a whole ${rp.node.abi}; an ERC-7730 interpolation shows one formatted field`);
+      out += `{${rp.steps.map((s) => s.key).join(".")}}`;
+    }
+  }
+  return out;
+}
+
+/** Every string of the file must be well-formed Unicode: RFC 8785 (JCS) serializes no lone surrogate. */
+function checkText(v, where) {
+  if (typeof v === "string" && !v.isWellFormed()) fail(CODES.EXPORT, `${where}: the text has a lone surrogate, which RFC 8785 cannot serialize`);
+  if (Array.isArray(v)) v.forEach((x, i) => checkText(x, `${where}[${i}]`));
+  else if (isObject(v)) for (const [k, x] of Object.entries(v)) checkText(k, where), checkText(x, `${where}.${k}`);
+}
+
+/**
+ * The ERC-7730 file of an EVM contract's resolved form, and its ERC-8176 `descriptorHash`.
+ *
+ * @param {object} resolved  an EVM contract's resolved form (`chain: "evm"`)
+ * @param {object} [options]
+ * @param {{ chainId: number, address: string }[]} [options.deployments]  default: the deployments every profile lists
+ * @param {string} [options.owner]  ERC-7730 `metadata.owner`
+ * @param {string} [options.contractName]  `metadata.contractName`
+ * @param {{ url: string, deploymentDate?: string }} [options.info]  `metadata.info`
+ * @param {{ name: string }} [options.token]  the contract is the token its literal amounts are in: `metadata.token`
+ * @returns {{ descriptor: object, descriptorHash: string }}
+ */
+export function erc7730Descriptor(resolved, options = {}) {
+  if (!isObject(resolved) || resolved.format !== "candid-profile-resolved" || !isObject(resolved.methods) || resolved.chain !== "evm") methodOf(resolved, "", "evm"); // throws the right error
+  if (!isObject(options)) fail(CODES.REQUEST, "options must be an object");
+  for (const k of Object.keys(options)) if (!OPTIONS.has(k)) fail(CODES.REQUEST, `unknown option ${JSON.stringify(k)}; expected one of ${[...OPTIONS].join(", ")}`);
+  if (options.token !== undefined && !(isObject(options.token) && nonEmpty(options.token.name) && Object.keys(options.token).length === 1)) fail(CODES.REQUEST, "options.token must be { name } with a non-empty string");
+
+  const problems = [];
+  const ctx = { erc20: erc20Metadata(resolved), tokenName: options.token?.name, token: null, dynamic: false, problem: (at, message) => void problems.push(`${at}: ${message}`) };
+  const deployments = deploymentsOf(resolved, options.deployments);
+  const metadata = metadataOf(options);
+
+  const formats = {};
+  for (const [name, m] of entriesOf(resolved.methods)) {
+    if (!isObject(m) || m.mode !== "update") continue;
+    const method = methodOf(resolved, name, "evm");
+    let f;
+    try {
+      f = parseSignature(String(method.signature), `methods.${name}.signature`);
+    } catch (e) {
+      if (e instanceof AbiError) fail(CODES.RESOLVED_FORM, e.message);
+      throw e;
+    }
+    if (f.name !== name || f.selector !== method.selector) fail(CODES.RESOLVED_FORM, `methods.${name}: the signature ${method.signature} does not hash to ${method.selector}`);
+    const missing = unnamed(f.inputs);
+    if (missing !== null) {
+      ctx.problem(name, `parameter ${missing} has no name; an ERC-7730 key names every parameter`);
+      continue;
+    }
+    const viewed = { ...method, args: method.args.map((n, i) => abiView(n, `${name}(${i})`)) };
+    const intent = method.tags?.intent?.args;
+    const entry = { intent: nonEmpty(intent?.title) ? intent.title : (labelOf(method) ?? `Call ${name}`) };
+    if (typeof intent?.template === "string") {
+      const text = interpolated(intent.template, viewed, ctx, `${name}: intent template`);
+      if (text !== undefined) entry.interpolatedIntent = text;
+    }
+    const fields = viewed.args.length ? leaves(viewed.args[0], [], []).map((l) => fieldOf(l.node, l.path, l.label, ctx, `${name}(0).${l.path.replaceAll(".[]", "[]")}`)) : [];
+    if (method.state_mutability === "payable") fields.push({ path: "@.value", label: "Value sent", format: "amount" });
+    if (fields.length) entry.fields = fields;
+    formats[method.signature] = entry;
+  }
+  if (ctx.dynamic && ctx.token) problems.push("amounts: some read decimals() and symbol(), others are literal; an ERC-7730 wallet reads one token for @.to");
+  if (problems.length) fail(CODES.EXPORT, `no ERC-7730 file: ${problems.join("; ")}`);
+  if (Object.keys(formats).length === 0) fail(CODES.EXPORT, "no ERC-7730 file: the contract has no function a transaction calls (every function is view or pure)");
+
+  if (ctx.token) metadata.token = { name: ctx.tokenName, ticker: ctx.token.ticker, decimals: ctx.token.decimals };
+  const descriptor = { $schema: ERC7730_SCHEMA_URL, context: { contract: { deployments } } };
+  if (Object.keys(metadata).length) descriptor.metadata = metadata;
+  descriptor.display = { formats };
+  return { descriptor, descriptorHash: descriptorHash(descriptor) };
+}
+
+/** ERC-8176 `descriptorHash`: Keccak-256 of the RFC 8785 (JCS) form of a descriptor without `includes`. */
+export function descriptorHash(descriptor) {
+  if (!isObject(descriptor)) fail(CODES.REQUEST, "a descriptor is a JSON object");
+  if (Object.hasOwn(descriptor, "includes")) fail(CODES.REQUEST, "resolve the descriptor's includes first (ERC-8176 hashes the merged file)");
+  checkText(descriptor, "descriptor");
+  return `0x${keccak256Hex(jcs(descriptor))}`;
+}
+
+const ATTEST = [
+  { name: "version", type: "uint16" },
+  { name: "schema", type: "bytes32" },
+  { name: "recipient", type: "address" },
+  { name: "time", type: "uint64" },
+  { name: "expirationTime", type: "uint64" },
+  { name: "revocable", type: "bool" },
+  { name: "refUID", type: "bytes32" },
+  { name: "data", type: "bytes" },
+  { name: "salt", type: "bytes32" },
+];
+
+function uint64(v, name) {
+  const s = typeof v === "bigint" ? v.toString() : Number.isSafeInteger(v) ? String(v) : v;
+  if (typeof s !== "string" || !/^(0|[1-9][0-9]{0,19})$/.test(s) || BigInt(s) >= 2n ** 64n) fail(CODES.REQUEST, `${name} must be a uint64 (seconds since the Unix epoch), got ${String(v)}`);
+  return s;
+}
+
+function bytes32(v, name) {
+  if (typeof v !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(v)) fail(CODES.REQUEST, `${name} must be 0x and 64 hex digits`);
+  return v.toLowerCase();
+}
+
+/**
+ * The unsigned ERC-8176 offchain attestation of a descriptor: EAS offchain attestation v2 typed data for a reviewer to
+ * sign with their own key (EIP-712), and its digest. Nothing is signed or sent here.
+ *
+ * @param {object} input
+ * @param {string} input.descriptorHash  from erc7730Descriptor (or descriptorHash)
+ * @param {bigint | number | string} input.time  when the attestation is made, in Unix seconds
+ * @param {bigint | number | string} input.expirationTime  when it expires, in Unix seconds; 0 never (ERC-8176 advises a bound)
+ * @param {string} input.salt  32 random bytes, 0x hex: the caller's, so the same input gives the same output
+ * @param {string} [input.refUID]  an attestation this one refers to; default none (32 zero bytes)
+ * @returns {{ typedData: { domain: object, primaryType: "Attest", types: { Attest: { name: string, type: string }[] }, message: object }, digest: string }}
+ */
+export function erc8176Attestation({ descriptorHash: hash, time, expirationTime, salt, refUID = ZERO32 } = {}) {
+  const message = {
+    version: 2,
+    schema: ERC8176_SCHEMA_UID,
+    recipient: ZERO_ADDRESS,
+    time: uint64(time, "time"),
+    expirationTime: uint64(expirationTime, "expirationTime"),
+    revocable: true,
+    refUID: bytes32(refUID, "refUID"),
+    data: bytes32(hash, "descriptorHash"), // abi.encode(bytes32) is the 32 bytes themselves
+    salt: bytes32(salt, "salt"),
+  };
+  if (message.expirationTime !== "0" && BigInt(message.expirationTime) <= BigInt(message.time)) fail(CODES.REQUEST, "expirationTime must be 0 or after time");
+  const typedData = { domain: { name: "EAS Attestation", version: "0.26", chainId: 1, verifyingContract: EAS_ADDRESS }, primaryType: "Attest", types: { Attest: ATTEST.map((f) => ({ ...f })) }, message };
+  return { typedData, digest: typedDataDigest(typedData) };
+}

package/src/errors.mjs

@@ -21,6 +21,7 @@ export const CODES = Object.freeze({
   TOO_LARGE: "E_TOO_LARGE", // the arguments exceed the bounds of a consent message (never truncated)
   LANGUAGE: "E_LANGUAGE", // only with languagePolicy "error": the requested language is not supported
   REQUEST: "E_REQUEST", // the ICRC-21 request itself is malformed
+  DEPLOYMENT: "E_DEPLOYMENT", // an EVM call's target is not a deployment its profile lists (spec section 15)
   // this generator cannot describe the call (ICRC-21 ConsentMessageUnavailable)
   UNSUPPORTED_TYPE: "E_UNSUPPORTED_TYPE", // a position the resolved form cannot type (recursive cut, func, service)
   // the profile or the caller's context is wrong (ICRC-21 GenericError)
@@ -32,6 +33,8 @@ export const CODES = Object.freeze({
   ARG: "E_ARG",
   TAG_TYPE: "E_TAG_TYPE",
   TAG_CONFLICT: "E_TAG_CONFLICT",
+  // the ERC-7730 export (erc7730.mjs): the resolved form says something an ERC-7730 file cannot say (spec section 15)
+  EXPORT: "E_EXPORT",
 });
 
 /** ICRC-21 GenericError.error_code values this package uses (a nat chosen by the canister; see the README). */

package/src/evm.d.mts

@@ -0,0 +1,51 @@
+// Types for @meantjs/consent/evm: the consent text of an EVM call (spec section 15, D-054). Hand-written; the source is
+// src/evm.mjs. scripts/types.test.mjs keeps the declared names equal to the runtime exports.
+import type { AbiLimits, AbiValue } from "@meantjs/profile/evm";
+import type { ConsentDiagnostic, Model, Provenance, ResolvedForm } from "./index.mjs";
+
+/** An EVM contract's resolved form: `chain: "evm"`, and each method with its selector and named signature. */
+export type EvmResolvedForm = ResolvedForm & { chain: "evm" };
+
+/**
+ * One call decoded against a resolved form: the function its selector names, and its arguments keyed by parameter
+ * name (`#i` for an unnamed one). Strict: anything but the canonical encoding of the values read is E_DECODE.
+ * Throws E_RESOLVED_FORM (not an EVM resolved form), E_METHOD_UNKNOWN (no such selector) or E_DECODE.
+ */
+export function decodeCalldata(resolved: ResolvedForm, calldata: Uint8Array | string, limits?: AbiLimits): { method: string; selector: string; values: Record<string, AbiValue> };
+
+export interface EvmConsentInput {
+  resolved: ResolvedForm;
+  /** The selector and the ABI-encoded arguments, as bytes or 0x hex. */
+  calldata: Uint8Array | string;
+  /** The contract called: shown in the message, and checked against the deployments its profiles list (E_DEPLOYMENT). */
+  to: string;
+  /** Needed when a profile lists deployments. */
+  chainId?: number | bigint | string;
+  /** Resolved dynamic refs, keyed by `from`: `{ "query:decimals": 6, "query:symbol": "USDC" }`. */
+  refs?: Record<string, unknown>;
+  /** Default "generic" (Markdown). */
+  form?: "generic" | "fields";
+  /** Generic form only: show timestamps in this zone (default UTC). */
+  utcOffsetMinutes?: number | null;
+  /** Append the decoded raw arguments (spec section 11 item 1). */
+  rawArguments?: boolean;
+  limits?: AbiLimits;
+}
+/**
+ * The consent text of an EVM call: the same model and the same two layouts as an ICRC-21 message, without its envelope,
+ * ending with the contract's address and chain. A payable function is refused (E_UNSUPPORTED_TYPE): its native value
+ * has no position in a profile yet.
+ */
+export function evmConsent(input: EvmConsentInput): {
+  form: "generic" | "fields";
+  /** Markdown for "generic"; the intent line and `[label, text]` rows for "fields". */
+  message: string | { intent: string; fields: [string, string][] };
+  method: string;
+  selector: string;
+  /** The contract, in its EIP-55 form. */
+  to: string;
+  chainId: string | null;
+  diagnostics: ConsentDiagnostic[];
+  provenance: Provenance;
+  model: Model;
+};

package/src/evm.mjs

@@ -0,0 +1,129 @@
+// EVM calldata -> the consent text of a call (spec section 15, D-054). ICRC-21 is the Internet Computer's, so an EVM
+// call gets the same model and the same two layouts without the ICRC-21 envelope: the generic form (Markdown) and the
+// fields form as plain text.
+//
+// Steps:
+//   1. the resolved form must be an EVM contract's (`chain: "evm"`), and the call's target, when a profile lists
+//      deployments, one of them (a profile describes the contracts it binds, never a look-alike);
+//   2. the selector picks the function; its `signature` gives the parameter types, and calldata is decoded strictly
+//      (`@meantjs/profile/evm` decodeParams: anything but the canonical encoding of the values read is refused);
+//   3. the resolved tree is read as a Candid-shaped view (a tuple is a record, an array a vec), so the template, the
+//      paths and the fields are those of a Candid call (model.mjs);
+//   4. the text ends with the contract's address and chain: a pack applies to any contract whose functions match, so a
+//      person must see which contract asks (spec section 11).
+//
+// Refused: a payable function (its native value has no position yet, O2), and a call with no matching selector.
+
+import { AbiError, decodeParams, parseSignature, readAddress } from "@meantjs/profile/evm";
+import { Renderer } from "./display.mjs";
+import { CODES, ConsentError, fail } from "./errors.mjs";
+import { modelOf } from "./model.mjs";
+import { renderGeneric, renderPlain } from "./render.mjs";
+import { abiView, methodOf } from "./resolved.mjs";
+import { codeSpan } from "./text.mjs";
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+function bytesOf(calldata) {
+  if (calldata instanceof Uint8Array) return calldata;
+  if (typeof calldata === "string" && /^0x(?:[0-9a-fA-F]{2})*$/.test(calldata)) return Uint8Array.from(calldata.slice(2).match(/../g) ?? [], (h) => parseInt(h, 16));
+  fail(CODES.REQUEST, "calldata must be a Uint8Array or 0x hex text");
+}
+
+function chainOf(chainId) {
+  if (chainId === undefined || chainId === null) return null;
+  const s = typeof chainId === "number" && Number.isSafeInteger(chainId) ? String(chainId) : typeof chainId === "bigint" ? chainId.toString() : chainId;
+  if (typeof s !== "string" || !/^[1-9][0-9]{0,19}$/.test(s)) fail(CODES.REQUEST, `chainId must be a positive integer, got ${String(chainId)}`);
+  return s;
+}
+
+/** The function of a selector, from the resolved form; its signature is checked against the selector. */
+function functionOf(resolved, selector) {
+  const hit = Object.entries(resolved.methods).find(([, m]) => isObject(m) && m.selector === selector);
+  if (!hit) fail(CODES.METHOD_UNKNOWN, `the resolved form has no function with selector ${selector}`);
+  const [name, method] = hit;
+  let f;
+  try {
+    f = parseSignature(String(method.signature), `methods.${name}.signature`);
+  } catch (e) {
+    if (e instanceof AbiError) fail(CODES.RESOLVED_FORM, e.message);
+    throw e;
+  }
+  if (f.name !== name || f.selector !== selector) fail(CODES.RESOLVED_FORM, `methods.${name}: the signature ${method.signature} does not hash to ${selector}`);
+  return { name, method: methodOf(resolved, name, "evm"), f };
+}
+
+/**
+ * Decode one EVM call against a resolved form: which function, and its arguments.
+ *
+ * @param {object} resolved  an EVM contract's resolved form (`chain: "evm"`)
+ * @param {Uint8Array | string} calldata  the selector and the ABI-encoded arguments
+ * @param {{ maxBytes?: number, maxDepth?: number, maxElements?: number }} [limits]
+ * @returns {{ method: string, selector: string, values: Record<string, unknown> }}
+ */
+export function decodeCalldata(resolved, calldata, limits) {
+  if (!isObject(resolved) || resolved.format !== "candid-profile-resolved" || !isObject(resolved.methods) || resolved.chain !== "evm") methodOf(resolved, "", "evm"); // throws the right error
+  const data = bytesOf(calldata);
+  if (data.length < 4) fail(CODES.DECODE, `calldata of ${data.length} bytes has no selector`);
+  const selector = `0x${[...data.subarray(0, 4)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+  const { name, f } = functionOf(resolved, selector);
+  try {
+    return { method: name, selector, values: decodeParams(f.inputs, data.subarray(4), limits) };
+  } catch (e) {
+    if (e instanceof AbiError) throw new ConsentError(CODES.DECODE, `${name}: ${e.message}`, { cause: e });
+    throw e;
+  }
+}
+
+/** Every profile that lists deployments must list this one (chain id and address). */
+function checkTarget(resolved, to, chain) {
+  for (const p of Array.isArray(resolved.profiles) ? resolved.profiles : []) {
+    if (!Array.isArray(p?.deployments)) continue;
+    if (chain === null) fail(CODES.REQUEST, `profile ${p.name} binds deployments: give the chainId of the call`);
+    const listed = p.deployments.some((d) => String(d.chain_id) === chain && typeof d.address === "string" && d.address.toLowerCase() === to.toLowerCase());
+    if (!listed) fail(CODES.DEPLOYMENT, `profile ${p.name} describes ${p.deployments.map((d) => `${d.address} on chain ${d.chain_id}`).join(", ")}, not ${to} on chain ${chain}`);
+  }
+}
+
+/**
+ * The consent text of an EVM call.
+ *
+ * @param {object} input
+ * @param {object} input.resolved  an EVM contract's resolved form
+ * @param {Uint8Array | string} input.calldata
+ * @param {string} input.to  the contract called (shown, and checked against the profiles' deployments)
+ * @param {number | bigint | string} [input.chainId]  needed when a profile lists deployments
+ * @param {Record<string, unknown>} [input.refs]  resolved dynamic refs, for example { "query:decimals": 6, "query:symbol": "USDC" }
+ * @param {"generic" | "fields"} [input.form]  default "generic"
+ * @param {number | null} [input.utcOffsetMinutes]  generic form only (default 0, UTC)
+ * @param {boolean} [input.rawArguments]  append the decoded arguments (spec section 11 item 1)
+ * @param {object} [input.limits]  decoder limits (maxBytes, maxDepth, maxElements)
+ * @returns {{ form: string, message: string | { intent: string, fields: Array<[string, string]> }, method: string, selector: string, to: string, chainId: string | null, diagnostics: object[], provenance: object, model: object }}
+ */
+export function evmConsent({ resolved, calldata, to, chainId, refs = {}, form = "generic", utcOffsetMinutes = null, rawArguments = false, limits }) {
+  if (form !== "generic" && form !== "fields") fail(CODES.REQUEST, `form must be "generic" or "fields", got ${JSON.stringify(form)}`);
+  let target;
+  try {
+    target = readAddress(to);
+  } catch (e) {
+    if (e instanceof AbiError) fail(CODES.REQUEST, `to: ${e.message}`);
+    throw e;
+  }
+  const chain = chainOf(chainId);
+  const { method: name, selector, values } = decodeCalldata(resolved, calldata, limits);
+  checkTarget(resolved, target, chain);
+  const method = methodOf(resolved, name, "evm");
+  if (method.state_mutability === "payable") fail(CODES.UNSUPPORTED_TYPE, `${name} is payable: the native value a call sends has no position in a profile yet (spec section 15, O2)`);
+  const viewed = { ...method, args: method.args.map((n, i) => abiView(n, `${name}(${i})`)) };
+  const model = modelOf(resolved, name, viewed, viewed.args.length ? [values] : []);
+  const where = `${target}${chain === null ? "" : ` on chain ${chain}`}`;
+  const done = (rest) => ({ ...rest, method: name, selector, to: target, chainId: chain, diagnostics: model.diagnostics, provenance: model.provenance, model });
+  if (form === "fields") {
+    const plain = renderPlain(model, new Renderer({ refs, diagnostics: model.diagnostics }), { rawArguments });
+    plain.fields.push(["Contract", where]);
+    return done({ form, message: plain });
+  }
+  const renderer = new Renderer({ refs, utcOffsetMinutes: utcOffsetMinutes ?? 0, diagnostics: model.diagnostics });
+  const text = `${renderGeneric(model, renderer, { rawArguments })}\n\n**Contract:** ${codeSpan(target)}${chain === null ? "" : ` on chain ${chain}`}`;
+  return done({ form, message: text });
+}

package/src/index.d.mts

@@ -206,6 +206,7 @@ export const CODES: Readonly<{
   TOO_LARGE: "E_TOO_LARGE";
   LANGUAGE: "E_LANGUAGE";
   REQUEST: "E_REQUEST";
+  DEPLOYMENT: "E_DEPLOYMENT";
   UNSUPPORTED_TYPE: "E_UNSUPPORTED_TYPE";
   RESOLVED_FORM: "E_RESOLVED_FORM";
   TEMPLATE: "E_TEMPLATE";
@@ -214,6 +215,7 @@ export const CODES: Readonly<{
   ARG: "E_ARG";
   TAG_TYPE: "E_TAG_TYPE";
   TAG_CONFLICT: "E_TAG_CONFLICT";
+  EXPORT: "E_EXPORT";
 }>;
 export type ConsentErrorCode = (typeof CODES)[keyof typeof CODES];
 /** ICRC-21 `GenericError.error_code` values this package uses. */

package/src/model.mjs

@@ -3,9 +3,10 @@
 // disagree about which values the call carries.
 //
 // Which fields appear:
-//   - a method with an `intent` tag: the placeholders of its template that are present (spec section 6; section 12:
-//     "one (label, Value) row per placeholder"), in template order, once per distinct path;
-//   - a method without one: the generic intent. Title from `describe.label` of the method, else `Call <method>`;
+//   - a call with an intent, its case's (spec section 5.2, D-053) or else its method's: the placeholders of its template
+//     that are present (spec section 6; section 12: "one (label, Value) row per placeholder"), in template order,
+//     once per distinct path;
+//   - a call without one: the generic intent. Title from `describe.label` of the method, else `Call <method>`;
 //     one field per leaf of the decoded arguments (records are flattened, tagged positions such as accounts are
 //     leaves, absent optionals are left out). More than MAX_FIELDS fields or MAX_ELEMENTS list elements is
 //     refused (E_TOO_LARGE), never truncated.
@@ -13,7 +14,7 @@
 import { VALUE_TAGS } from "@meantjs/format";
 import { decodeArguments } from "./decode.mjs";
 import { CODES, ConsentError, fail } from "./errors.mjs";
-import { effectKind, entriesOf, labelOf, methodOf } from "./resolved.mjs";
+import { callTag, effectKind, entriesOf, labelOf, methodOf } from "./resolved.mjs";
 import { parseTemplate } from "./template.mjs";
 import { resolvePath, valuesAt } from "./paths.mjs";
 
@@ -31,9 +32,9 @@ export const MAX_ELEMENTS = 256;
  *
  * @typedef {object} Model
  * @property {string} method
- * @property {string} effect  the effect kind of the method (spec section 5.3)
+ * @property {string} effect  the effect kind of the call: its case's, else its method's (spec section 5.3, D-053)
  * @property {string} title
- * @property {SentencePart[] | null} sentence  null for a method without an intent template
+ * @property {SentencePart[] | null} sentence  null for a call without an intent template
  * @property {Field[]} fields
  * @property {object[]} argNodes
  * @property {unknown[]} argValues
@@ -48,13 +49,18 @@ export const MAX_ELEMENTS = 256;
  */
 export function buildModel({ resolved, method: name, arg, limits }) {
   const method = methodOf(resolved, name);
-  const argValues = decodeArguments(method, arg, limits);
+  return modelOf(resolved, name, method, decodeArguments(method, arg, limits));
+}
+
+/** The model of a call whose arguments are decoded already (evm.mjs decodes calldata, then comes here). */
+export function modelOf(resolved, name, method, argValues) {
   const diagnostics = [];
-  const intent = method.tags?.intent?.args;
+  const intentTag = callTag(method, argValues, "intent"); // the call's intent: its case's, else its method's (D-053)
+  const intent = intentTag?.args;
   const title = typeof intent?.title === "string" && intent.title.trim() !== "" ? intent.title : (labelOf(method) ?? `Call ${name}`);
-  const tagOrigin = intent ? { origin: method.tags.intent.origin, ...(method.tags.intent.profile === undefined ? {} : { profile: method.tags.intent.profile }) } : null;
+  const tagOrigin = intent ? { origin: intentTag.origin, ...(intentTag.profile === undefined ? {} : { profile: intentTag.profile }) } : null;
   const provenance = { intent: tagOrigin, profiles: Array.isArray(resolved.profiles) ? resolved.profiles : [] };
-  const base = { method: name, effect: effectKind(method), title, argNodes: method.args, argValues, diagnostics, provenance };
+  const base = { method: name, effect: effectKind(method, callTag(method, argValues, "effect")), title, argNodes: method.args, argValues, diagnostics, provenance };
 
   if (intent && typeof intent.template === "string") {
     try {

package/src/render.mjs

@@ -50,6 +50,24 @@ export function renderFields(model, renderer, { rawArguments = false } = {}) {
   return { intent, fields };
 }
 
+/**
+ * The fields form as plain text, for a message that is not ICRC-21's (an EVM call, spec section 15): the same intent
+ * line as renderFields, and each row's values joined by ", ".
+ *
+ * @returns {{ intent: string, fields: Array<[string, string]> }}
+ */
+export function renderPlain(model, renderer, { rawArguments = false } = {}) {
+  const title = plainLabel(model.title, model.method);
+  let intent = title;
+  if (model.sentence !== null) {
+    const sentence = model.sentence.map((p) => ("lit" in p ? oneLine(p.lit) : fieldPlain(p.field, renderer))).join("");
+    if (sentence.trim() !== "") intent = `${title}: ${sentence.trim()}`;
+  }
+  const fields = model.fields.map((f) => [plainLabel(f.label, f.path), fieldPlain(f, renderer)]);
+  if (rawArguments) fields.push(["Raw arguments", visible(renderer.tupleText(model.argNodes, model.argValues))]);
+  return { intent, fields };
+}
+
 /** One row's ICRC-21 Value: typed when the field is a single value the typed form carries exactly, else Text. */
 function fieldValue(field, renderer) {
   if (field.values.length === 1) {

package/src/resolved.mjs

@@ -6,11 +6,17 @@ import { CODES, fail } from "./errors.mjs";
 
 const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 
-/** The method entry of a resolved form, or a ConsentError. */
-export function methodOf(resolved, name) {
+/**
+ * The method entry of a resolved form, or a ConsentError. `chain` is "evm" for an EVM contract's form (spec section 15);
+ * a Candid entry point never reads one, whose positions are ABI types, not Candid.
+ */
+export function methodOf(resolved, name, chain = undefined) {
   if (!isObject(resolved) || resolved.format !== "candid-profile-resolved" || !isObject(resolved.methods)) {
     fail(CODES.RESOLVED_FORM, "not a candid-profile-resolved document (format, methods)");
   }
+  if (resolved.chain !== chain) {
+    fail(CODES.RESOLVED_FORM, resolved.chain === "evm" ? "this resolved form is an EVM contract's (chain evm): use evmConsent, not a Candid entry point" : `expected the resolved form of an EVM contract (chain evm), found ${resolved.chain === undefined ? "a Candid service's" : `chain ${JSON.stringify(resolved.chain)}`}`);
+  }
   if (typeof name !== "string" || !Object.hasOwn(resolved.methods, name)) {
     fail(CODES.METHOD_UNKNOWN, `the resolved form has no method ${JSON.stringify(String(name))}`);
   }
@@ -24,6 +30,20 @@ export function keyId(key) {
   return /^#(0|[1-9][0-9]{0,9})$/.test(key) ? Number(key.slice(1)) : idlHash(key);
 }
 
+/**
+ * A position of an EVM contract's resolved form (spec section 15) read as the Candid shapes the model walks: a tuple is
+ * a record, an array a vec, any other ABI type a primitive of that name. `abi` is kept, so display writes ABI text.
+ */
+export function abiView(node, where, depth = 0) {
+  if (!isObject(node) || typeof node.abi !== "string") fail(CODES.RESOLVED_FORM, `${where}: not an EVM resolved-form position`);
+  if (depth > 64) fail(CODES.UNSUPPORTED_TYPE, `${where}: nested deeper than 64`);
+  if (node.abi === "tuple") {
+    return { ...node, candid: "record", fields: Object.fromEntries(entriesOf(node.fields).map(([k, c]) => [k, abiView(c, `${where}.${k}`, depth + 1)])) };
+  }
+  if (node.abi === "array") return { ...node, candid: "vec", element: abiView(node.element, `${where}[]`, depth + 1) };
+  return { ...node, candid: node.abi };
+}
+
 /** Own entries of a `fields` or `cases` object (never walks the prototype chain). */
 export function entriesOf(bucket) {
   return isObject(bucket) ? Object.entries(bucket) : [];
@@ -39,7 +59,44 @@ export function tagArgs(node, tag) {
   return node?.tags && Object.hasOwn(node.tags, tag) ? (node.tags[tag]?.args ?? {}) : undefined;
 }
 
-/** The effect kind of a method: its tag, or the spec default (section 5.3: queries read, updates write). */
-export function effectKind(method) {
-  return method.tags?.effect?.args?.kind ?? (method.mode === "query" || method.mode === "composite_query" ? "read" : "write");
+/**
+ * The effect kind of a call: its effect tag (the call's, `callTag`; the method's by default), or the spec default
+ * (section 5.3: queries read, updates write).
+ */
+export function effectKind(method, tag = method.tags?.effect) {
+  return tag?.args?.kind ?? (method.mode === "query" || method.mode === "composite_query" ? "read" : "write");
+}
+
+/**
+ * The `intent` or `effect` entry (`{ args, origin, profile }`) a call takes: that of the deepest tagged variant case
+ * its decoded arguments hold (spec section 5.2, D-053), else the method's. The resolver lets the tagged cases of one
+ * method only exclude each other or nest, so the cases one call holds are a chain; a resolved form with tagged cases
+ * that one call holds side by side is not one a resolver writes, and the method's entry is used for it.
+ *
+ * @param {object} method  a method of the resolved form
+ * @param {unknown[]} argValues  its decoded arguments (decode.mjs: records by key, variants as { tag, value })
+ * @param {"intent" | "effect"} tag
+ */
+export function callTag(method, argValues, tag) {
+  let best = null; // { entry, chain }: the hit with the most hits above and at it
+  let hits = 0;
+  const visit = (node, value, chain) => {
+    if (!isObject(node) || node.recursive === true || !isObject(value)) return; // null: an absent optional, a bare case
+    if (node.candid === "record") {
+      for (const [key, child] of entriesOf(node.fields)) if (Object.hasOwn(value, key)) visit(child, value[key], chain);
+    } else if (node.candid === "variant") {
+      const hit = entriesOf(node.cases).find(([key]) => key === value.tag);
+      if (hit === undefined) return;
+      const child = hit[1];
+      const entry = isObject(child) && isObject(child.tags) && Object.hasOwn(child.tags, tag) ? child.tags[tag] : undefined;
+      if (isObject(entry)) {
+        chain += 1;
+        hits += 1;
+        if (best === null || chain > best.chain) best = { entry, chain };
+      }
+      visit(child, value.value, chain);
+    }
+  };
+  method.args.forEach((node, i) => visit(node, argValues[i], 0));
+  return best !== null && best.chain === hits ? best.entry : method.tags?.[tag];
 }

package/src/sns.mjs

@@ -26,8 +26,8 @@
 //   1. The body is the generic consent message of spec section 12 with the title at heading level 3, so it nests
 //      under governance's `## Payload:`. Times are shown in UTC (`2026-10-09 12:00:00 UTC`, rule 6 of section 12):
 //      a proposal has many readers and no user preferences.
-//   2. Then the method the rendering describes and its effect (spec section 5.3; the default for an update without
-//      an `effect` tag is said to be a default).
+//   2. Then the method the rendering describes and the call's effect (spec section 5.3: its case's, else its
+//      method's, D-053; the default for an update without an `effect` tag is said to be a default).
 //   3. Then the arguments as Candid text with no formatter applied (base units, nanoseconds, bytes), always: there is
 //      no signer between the text and the voter to show them (spec section 11 item 1).
 //   4. Then where the words come from: every profile with its profile_id, the interface_id, and these rules.
@@ -43,7 +43,7 @@ import { bytesOf } from "./bytes.mjs";
 import { ConsentError, CODES, fail } from "./errors.mjs";
 import { buildModel } from "./model.mjs";
 import { renderGeneric } from "./render.mjs";
-import { methodOf } from "./resolved.mjs";
+import { callTag, methodOf } from "./resolved.mjs";
 import { codeBlock, codeSpan, escapeMarkdown, oneLine } from "./text.mjs";
 
 /** The name and version of the rules this module renders by. Part of every rendering, so a re-render knows what to compare. */
@@ -114,7 +114,7 @@ function renderSnsPayload({ payload, resolved, method: name, refs, limits }) {
   const model = buildModel({ resolved, method: name, arg: payload, limits });
   const renderer = new Renderer({ refs, utcOffsetMinutes: 0, diagnostics: model.diagnostics });
   const blocks = [renderGeneric(model, renderer, { headingLevel: 3 })];
-  blocks.push(`**Method:** ${codeSpan(name)}. **Effect:** ${effectText(method)}.`);
+  blocks.push(`**Method:** ${codeSpan(name)}. **Effect:** ${effectText(method, callTag(method, model.argValues, "effect"))}.`);
   blocks.push(`**Arguments (Candid, as sent, no units applied):**\n\n${codeBlock(renderer.plainTupleText(model.argNodes, model.argValues))}`);
   blocks.push(sourceText(resolved));
   const text = blocks.join("\n\n");
@@ -125,12 +125,12 @@ function renderSnsPayload({ payload, resolved, method: name, refs, limits }) {
 const isQuery = (method) => method.mode === "query" || method.mode === "composite_query";
 
 /**
- * The effect kind and reversibility (spec section 5.3), and whether a profile stated them. The resolver writes the
+ * The effect kind and reversibility of the call (spec section 5.3; `tag` is its effect entry, `callTag`), and whether
+ * a profile stated them. The resolver writes the
  * section 5.3 default with origin "default" when no profile has an `effect` tag; this says so instead of passing a
  * default off as the author's word.
  */
-function effectText(method) {
-  const tag = method.tags?.effect;
+function effectText(method, tag) {
   const query = isQuery(method);
   const kind = typeof tag?.args?.kind === "string" ? tag.args.kind : query ? "read" : "write";
   const irreversible = typeof tag?.args?.irreversible === "boolean" ? tag.args.irreversible : tag ? null : !query;