@metamask-previews/gator-permissions-controller 4.2.3-preview-3f58e8b65 → 4.2.3-preview-e0f702919

package/dist/decodePermission/decoders/tokenApprovalRevocation.mjs

@@ -0,0 +1,77 @@
+/* eslint-disable no-bitwise */
+import { hexToNumber } from "@metamask/utils";
+import { getTermsByEnforcer } from "../utils.mjs";
+import { expiryRule } from "./expiryRule.mjs";
+var ApprovalRevocationFlag;
+(function (ApprovalRevocationFlag) {
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Erc20Approve"] = 1] = "Erc20Approve";
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Erc721Approve"] = 2] = "Erc721Approve";
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Erc721SetApprovalForAll"] = 4] = "Erc721SetApprovalForAll";
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Permit2Approve"] = 8] = "Permit2Approve";
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Permit2Lockdown"] = 16] = "Permit2Lockdown";
+    ApprovalRevocationFlag[ApprovalRevocationFlag["Permit2InvalidateNonces"] = 32] = "Permit2InvalidateNonces";
+})(ApprovalRevocationFlag || (ApprovalRevocationFlag = {}));
+const MAX_APPROVAL_REVOCATION_MASK = ApprovalRevocationFlag.Permit2InvalidateNonces |
+    ApprovalRevocationFlag.Permit2Lockdown |
+    ApprovalRevocationFlag.Permit2Approve |
+    ApprovalRevocationFlag.Erc721SetApprovalForAll |
+    ApprovalRevocationFlag.Erc721Approve |
+    ApprovalRevocationFlag.Erc20Approve;
+/**
+ * Builds the configuration for the token-approval-revocation permission decoder.
+ *
+ * @param contractAddresses - Checksummed enforcer addresses for the chain.
+ * @returns The token-approval-revocation permission decoder configuration.
+ */
+export function makeTokenApprovalRevocationDecoderConfig(contractAddresses) {
+    const { timestampEnforcer, approvalRevocationEnforcer, nonceEnforcer } = contractAddresses;
+    return {
+        permissionType: 'token-approval-revocation',
+        contractAddresses,
+        optionalEnforcers: [
+            timestampEnforcer, // expiry rule
+        ],
+        requiredEnforcers: {
+            [approvalRevocationEnforcer]: 1,
+            [nonceEnforcer]: 1,
+        },
+        rules: [expiryRule],
+        validateAndDecodeData,
+    };
+}
+/**
+ * Decodes token-approval-revocation permission data from caveats; throws on invalid.
+ *
+ * @param caveats - Caveats from the permission context (checksummed).
+ * @param contractAddresses - Checksummed enforcer addresses for the chain.
+ * @returns Decoded approval-revocation capability flags.
+ */
+function validateAndDecodeData(caveats, contractAddresses) {
+    const { approvalRevocationEnforcer } = contractAddresses;
+    const terms = getTermsByEnforcer({
+        caveats,
+        enforcer: approvalRevocationEnforcer,
+    });
+    if (terms === '0x') {
+        throw new Error('Invalid ApprovalRevocation terms: must be greater than 0');
+    }
+    const mask = hexToNumber(terms);
+    if (mask > MAX_APPROVAL_REVOCATION_MASK) {
+        throw new Error(`Invalid ApprovalRevocation terms: must be less than or equal to ${MAX_APPROVAL_REVOCATION_MASK}`);
+    }
+    if (mask === 0) {
+        throw new Error('Invalid ApprovalRevocation terms: must be greater than 0');
+    }
+    return {
+        erc20Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Erc20Approve),
+        erc721Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Erc721Approve),
+        erc721SetApprovalForAll: isFlagEnabled(mask, ApprovalRevocationFlag.Erc721SetApprovalForAll),
+        permit2Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Permit2Approve),
+        permit2Lockdown: isFlagEnabled(mask, ApprovalRevocationFlag.Permit2Lockdown),
+        permit2InvalidateNonces: isFlagEnabled(mask, ApprovalRevocationFlag.Permit2InvalidateNonces),
+    };
+}
+function isFlagEnabled(mask, flag) {
+    return (mask & flag) === flag;
+}
+//# sourceMappingURL=tokenApprovalRevocation.mjs.map

package/dist/decodePermission/decoders/tokenApprovalRevocation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenApprovalRevocation.mjs","sourceRoot":"","sources":["../../../src/decodePermission/decoders/tokenApprovalRevocation.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,WAAW,EAAE,wBAAwB;AAO9C,OAAO,EAAE,kBAAkB,EAAE,qBAAoB;AACjD,OAAO,EAAE,UAAU,EAAE,yBAAwB;AAG7C,IAAK,sBAOJ;AAPD,WAAK,sBAAsB;IACzB,mFAAmB,CAAA;IACnB,qFAAoB,CAAA;IACpB,yGAA8B,CAAA;IAC9B,uFAAqB,CAAA;IACrB,0FAAsB,CAAA;IACtB,0GAA8B,CAAA;AAChC,CAAC,EAPI,sBAAsB,KAAtB,sBAAsB,QAO1B;AAED,MAAM,4BAA4B,GAChC,sBAAsB,CAAC,uBAAuB;IAC9C,sBAAsB,CAAC,eAAe;IACtC,sBAAsB,CAAC,cAAc;IACrC,sBAAsB,CAAC,uBAAuB;IAC9C,sBAAsB,CAAC,aAAa;IACpC,sBAAsB,CAAC,YAAY,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAA6C;IAE7C,MAAM,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,aAAa,EAAE,GACpE,iBAAiB,CAAC;IAEpB,OAAO;QACL,cAAc,EAAE,2BAA2B;QAC3C,iBAAiB;QACjB,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,cAAc;SAClC;QACD,iBAAiB,EAAE;YACjB,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC/B,CAAC,aAAa,CAAC,EAAE,CAAC;SACnB;QACD,KAAK,EAAE,CAAC,UAAU,CAAC;QACnB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,iBAA6C;IAE7C,MAAM,EAAE,0BAA0B,EAAE,GAAG,iBAAiB,CAAC;IAEzD,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,OAAO;QACP,QAAQ,EAAE,0BAA0B;KACrC,CAAC,CAAC;IAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,IAAI,GAAG,4BAA4B,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,mEAAmE,4BAA4B,EAAE,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,YAAY,CAAC;QACtE,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,aAAa,CAAC;QACxE,uBAAuB,EAAE,aAAa,CACpC,IAAI,EACJ,sBAAsB,CAAC,uBAAuB,CAC/C;QACD,cAAc,EAAE,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,cAAc,CAAC;QAC1E,eAAe,EAAE,aAAa,CAC5B,IAAI,EACJ,sBAAsB,CAAC,eAAe,CACvC;QACD,uBAAuB,EAAE,aAAa,CACpC,IAAI,EACJ,sBAAsB,CAAC,uBAAuB,CAC/C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;AAChC,CAAC","sourcesContent":["/* eslint-disable no-bitwise */\nimport { hexToNumber } from '@metamask/utils';\n\nimport type {\n  ChecksumCaveat,\n  ChecksumEnforcersByChainId,\n  DecodedPermission,\n} from '../types.js';\nimport { getTermsByEnforcer } from '../utils.js';\nimport { expiryRule } from './expiryRule.js';\nimport type { MakePermissionDecoderConfig } from './makePermissionDecoder.js';\n\nenum ApprovalRevocationFlag {\n  Erc20Approve = 0x01,\n  Erc721Approve = 0x02,\n  Erc721SetApprovalForAll = 0x04,\n  Permit2Approve = 0x08,\n  Permit2Lockdown = 0x10,\n  Permit2InvalidateNonces = 0x20,\n}\n\nconst MAX_APPROVAL_REVOCATION_MASK =\n  ApprovalRevocationFlag.Permit2InvalidateNonces |\n  ApprovalRevocationFlag.Permit2Lockdown |\n  ApprovalRevocationFlag.Permit2Approve |\n  ApprovalRevocationFlag.Erc721SetApprovalForAll |\n  ApprovalRevocationFlag.Erc721Approve |\n  ApprovalRevocationFlag.Erc20Approve;\n\n/**\n * Builds the configuration for the token-approval-revocation permission decoder.\n *\n * @param contractAddresses - Checksummed enforcer addresses for the chain.\n * @returns The token-approval-revocation permission decoder configuration.\n */\nexport function makeTokenApprovalRevocationDecoderConfig(\n  contractAddresses: ChecksumEnforcersByChainId,\n): MakePermissionDecoderConfig {\n  const { timestampEnforcer, approvalRevocationEnforcer, nonceEnforcer } =\n    contractAddresses;\n\n  return {\n    permissionType: 'token-approval-revocation',\n    contractAddresses,\n    optionalEnforcers: [\n      timestampEnforcer, // expiry rule\n    ],\n    requiredEnforcers: {\n      [approvalRevocationEnforcer]: 1,\n      [nonceEnforcer]: 1,\n    },\n    rules: [expiryRule],\n    validateAndDecodeData,\n  };\n}\n\n/**\n * Decodes token-approval-revocation permission data from caveats; throws on invalid.\n *\n * @param caveats - Caveats from the permission context (checksummed).\n * @param contractAddresses - Checksummed enforcer addresses for the chain.\n * @returns Decoded approval-revocation capability flags.\n */\nfunction validateAndDecodeData(\n  caveats: ChecksumCaveat[],\n  contractAddresses: ChecksumEnforcersByChainId,\n): DecodedPermission['permission']['data'] {\n  const { approvalRevocationEnforcer } = contractAddresses;\n\n  const terms = getTermsByEnforcer({\n    caveats,\n    enforcer: approvalRevocationEnforcer,\n  });\n\n  if (terms === '0x') {\n    throw new Error('Invalid ApprovalRevocation terms: must be greater than 0');\n  }\n\n  const mask = hexToNumber(terms);\n\n  if (mask > MAX_APPROVAL_REVOCATION_MASK) {\n    throw new Error(\n      `Invalid ApprovalRevocation terms: must be less than or equal to ${MAX_APPROVAL_REVOCATION_MASK}`,\n    );\n  }\n\n  if (mask === 0) {\n    throw new Error('Invalid ApprovalRevocation terms: must be greater than 0');\n  }\n\n  return {\n    erc20Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Erc20Approve),\n    erc721Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Erc721Approve),\n    erc721SetApprovalForAll: isFlagEnabled(\n      mask,\n      ApprovalRevocationFlag.Erc721SetApprovalForAll,\n    ),\n    permit2Approve: isFlagEnabled(mask, ApprovalRevocationFlag.Permit2Approve),\n    permit2Lockdown: isFlagEnabled(\n      mask,\n      ApprovalRevocationFlag.Permit2Lockdown,\n    ),\n    permit2InvalidateNonces: isFlagEnabled(\n      mask,\n      ApprovalRevocationFlag.Permit2InvalidateNonces,\n    ),\n  };\n}\n\nfunction isFlagEnabled(mask: number, flag: number): boolean {\n  return (mask & flag) === flag;\n}\n"]}

package/dist/decodePermission/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  PermissionRequest,\n  PermissionTypes,\n  Rule,\n} from '@metamask/7715-permission-types';\nimport type { Caveat } from '@metamask/delegation-core';\nimport type { Hex } from '@metamask/utils';\n\n// This is a somewhat convoluted type - it includes all of the fields that are decoded from the permission context.\n/**\n * A partially reconstructed permission object decoded from a permission context.\n *\n * This mirrors the shape of {@link PermissionRequest} for fields that can be\n * deterministically recovered from the encoded permission context, and it\n * augments the result with an explicit `expiry` property derived from the\n * `TimestampEnforcer` terms, as well as the `origin` property.\n */\nexport type DecodedPermission = Pick<\n  PermissionRequest<PermissionTypes>,\n  'chainId' | 'from' | 'to'\n> & {\n  permission: Omit<\n    PermissionRequest<PermissionTypes>['permission'],\n    'isAdjustmentAllowed' | 'type' | 'data'\n  > & {\n    type: PermissionTypes['type'];\n    data: PermissionTypes['data'];\n    // PermissionRequest type does not work well without the specific permission type, so we amend it here\n    justification?: string;\n  };\n  /**\n   * @deprecated Use `rules` instead.\n   */\n  expiry: number | null;\n  origin: string;\n  /** Rules recovered from caveats (e.g. redeemer allowlist). */\n  rules?: Rule[];\n};\n\n/**\n * Supported permission type identifiers that can be decoded from a permission context.\n */\nexport type PermissionType = DecodedPermission['permission']['type'];\n\n/**\n * Result of validating and decoding permission terms from caveats.\n * When valid, includes expiry and decoded data; when invalid, includes the error.\n */\nexport type ValidateAndDecodeResult =\n  | {\n      isValid: true;\n      expiry: number | null;\n      data: DecodedPermission['permission']['data'];\n      rules?: Rule[];\n    }\n  | { isValid: false; error: Error };\n\n/**\n * A decoder that defines the required and optional enforcers for a permission\n * type, and provides methods to test whether caveat addresses match the\n * permission and to validate and decode permission terms from caveats.\n */\nexport type PermissionDecoder = {\n  permissionType: PermissionType;\n  requiredEnforcers: Map<Hex, number>;\n  optionalEnforcers: Set<Hex>;\n  /**\n   * Returns true if the given caveat addresses (enforcer addresses) match this\n   * decoder (required enforcers present with correct multiplicity, no\n   * forbidden enforcers).\n   */\n  caveatAddressesMatch: (caveatAddresses: Hex[]) => boolean;\n  /**\n   * Validates and decodes permission terms from the caveats. Returns a result\n   * object with isValid; when valid, includes expiry and data.\n   */\n  validateAndDecodePermission: (\n    caveats: Caveat<Hex>[],\n  ) => ValidateAndDecodeResult;\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  BasePermission,\n  MetaMaskBasePermissionData,\n  PermissionRequest,\n  PermissionTypes,\n  Rule,\n} from '@metamask/7715-permission-types';\nimport type {\n  ApprovalRevocationTerms,\n  Caveat,\n} from '@metamask/delegation-core';\nimport type { DELEGATOR_CONTRACTS } from '@metamask/delegation-deployments';\nimport type { Hex } from '@metamask/utils';\n\nexport type DeployedContractsByName =\n  (typeof DELEGATOR_CONTRACTS)[number][number];\n\n/**\n * Permission type for an unbounded ERC-20 token allowance.\n *\n * Encoded on-chain as an ERC20PeriodTransferEnforcer caveat with\n * `periodDuration` set to `UINT256_MAX` so that the allowance never resets\n * within any realistic time horizon.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype Erc20TokenAllowancePermission = BasePermission & {\n  type: 'erc20-token-allowance';\n  data: MetaMaskBasePermissionData & {\n    allowanceAmount: Hex;\n    startTime?: number | null;\n    tokenAddress: Hex;\n  };\n};\n\n/**\n * Permission type for an unbounded native token allowance.\n *\n * Encoded on-chain as a NativeTokenPeriodTransferEnforcer caveat with\n * `periodDuration` set to `UINT256_MAX`.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype NativeTokenAllowancePermission = BasePermission & {\n  type: 'native-token-allowance';\n  data: MetaMaskBasePermissionData & {\n    allowanceAmount: Hex;\n    startTime?: number | null;\n  };\n};\n\n/**\n * Permission type for token approval revocation.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype TokenApprovalRevocationPermission = BasePermission & {\n  type: 'token-approval-revocation';\n  data: MetaMaskBasePermissionData & ApprovalRevocationTerms;\n};\n\n/**\n * Extended permission union, including types not yet published in\n * `@metamask/7715-permission-types` but supported by this package's decoder.\n */\ntype ExtendedPermissionTypes =\n  | PermissionTypes\n  | Erc20TokenAllowancePermission\n  | NativeTokenAllowancePermission\n  | TokenApprovalRevocationPermission;\n\n// This is a somewhat convoluted type - it includes all of the fields that are decoded from the permission context.\n/**\n * A partially reconstructed permission object decoded from a permission context.\n *\n * This mirrors the shape of {@link PermissionRequest} for fields that can be\n * deterministically recovered from the encoded permission context, and it\n * augments the result with an explicit `expiry` property derived from the\n * `TimestampEnforcer` terms, as well as the `origin` property.\n */\nexport type DecodedPermission = Pick<\n  PermissionRequest<PermissionTypes>,\n  'chainId' | 'from' | 'to'\n> & {\n  permission: Omit<\n    PermissionRequest<PermissionTypes>['permission'],\n    'isAdjustmentAllowed' | 'type' | 'data'\n  > & {\n    type: ExtendedPermissionTypes['type'];\n    data: ExtendedPermissionTypes['data'];\n    // PermissionRequest type does not work well without the specific permission type, so we amend it here\n    justification?: string;\n  };\n  /**\n   * @deprecated Use `rules` instead.\n   */\n  expiry: number | null;\n  origin: string;\n  /** Rules recovered from caveats (e.g. redeemer allowlist). */\n  rules?: Rule[];\n};\n\n/**\n * Supported permission type identifiers that can be decoded from a permission context.\n */\nexport type PermissionType = DecodedPermission['permission']['type'];\n\n/**\n * Checksummed enforcer contract addresses for a chain (from getChecksumEnforcersByChainId).\n */\nexport type ChecksumEnforcersByChainId = {\n  erc20StreamingEnforcer: Hex;\n  erc20PeriodicEnforcer: Hex;\n  nativeTokenStreamingEnforcer: Hex;\n  nativeTokenPeriodicEnforcer: Hex;\n  approvalRevocationEnforcer: Hex;\n  exactCalldataEnforcer: Hex;\n  valueLteEnforcer: Hex;\n  timestampEnforcer: Hex;\n  nonceEnforcer: Hex;\n  allowedCalldataEnforcer: Hex;\n  allowedTargetsEnforcer: Hex;\n  redeemerEnforcer: Hex;\n};\n\n/** Caveat with checksummed enforcer address; used by rule decode functions. */\nexport type ChecksumCaveat = Caveat<Hex>;\n\n/**\n * Result of validating and decoding permission terms from caveats.\n * When valid, includes expiry and decoded data; when invalid, includes the error.\n */\nexport type ValidateAndDecodeResult =\n  | {\n      isValid: true;\n      expiry: number | null;\n      data: DecodedPermission['permission']['data'];\n      rules?: Rule[];\n    }\n  | { isValid: false; error: Error };\n\n/**\n * A decoder that defines the required and optional enforcers for a permission\n * type, and provides methods to test whether caveat addresses match the\n * permission and to validate and decode permission terms from caveats.\n */\nexport type PermissionDecoder = {\n  permissionType: PermissionType;\n  requiredEnforcers: Map<Hex, number>;\n  optionalEnforcers: Set<Hex>;\n  /**\n   * Returns true if the given caveat addresses (enforcer addresses) match this\n   * decoder (required enforcers present with correct multiplicity, no\n   * forbidden enforcers).\n   */\n  caveatAddressesMatch: (caveatAddresses: Hex[]) => boolean;\n  /**\n   * Validates and decodes permission terms from the caveats. Returns a result\n   * object with isValid; when valid, includes expiry and data.\n   */\n  validateAndDecodePermission: (\n    caveats: Caveat<Hex>[],\n  ) => ValidateAndDecodeResult;\n};\n\n/**\n * A function that inspects checksummed caveats and optionally produces a\n * {@link Rule} (e.g. redeemer, payee, expiry). Each rule decoder is\n * responsible for a single rule type and is composed by\n * `makePermissionDecoder` to populate the permission's `rules` array. The\n * `expiry` rule, in addition to being appended to `rules`, has its value\n * hoisted onto the top-level `expiry` field of the decoded permission.\n */\nexport type RuleDecoder = (args: {\n  contractAddresses: ChecksumEnforcersByChainId;\n  caveats: ChecksumCaveat[];\n  requiredEnforcers: Map<Hex, number>;\n}) => Rule | null;\n"]}

package/dist/decodePermission/types.d.cts

@@ -1,6 +1,54 @@
-import type { PermissionRequest, PermissionTypes, Rule } from "@metamask/7715-permission-types";
-import type { Caveat } from "@metamask/delegation-core";
+import type { BasePermission, MetaMaskBasePermissionData, PermissionRequest, PermissionTypes, Rule } from "@metamask/7715-permission-types";
+import type { ApprovalRevocationTerms, Caveat } from "@metamask/delegation-core";
+import type { DELEGATOR_CONTRACTS } from "@metamask/delegation-deployments";
 import type { Hex } from "@metamask/utils";
+export type DeployedContractsByName = (typeof DELEGATOR_CONTRACTS)[number][number];
+/**
+ * Permission type for an unbounded ERC-20 token allowance.
+ *
+ * Encoded on-chain as an ERC20PeriodTransferEnforcer caveat with
+ * `periodDuration` set to `UINT256_MAX` so that the allowance never resets
+ * within any realistic time horizon.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type Erc20TokenAllowancePermission = BasePermission & {
+    type: 'erc20-token-allowance';
+    data: MetaMaskBasePermissionData & {
+        allowanceAmount: Hex;
+        startTime?: number | null;
+        tokenAddress: Hex;
+    };
+};
+/**
+ * Permission type for an unbounded native token allowance.
+ *
+ * Encoded on-chain as a NativeTokenPeriodTransferEnforcer caveat with
+ * `periodDuration` set to `UINT256_MAX`.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type NativeTokenAllowancePermission = BasePermission & {
+    type: 'native-token-allowance';
+    data: MetaMaskBasePermissionData & {
+        allowanceAmount: Hex;
+        startTime?: number | null;
+    };
+};
+/**
+ * Permission type for token approval revocation.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type TokenApprovalRevocationPermission = BasePermission & {
+    type: 'token-approval-revocation';
+    data: MetaMaskBasePermissionData & ApprovalRevocationTerms;
+};
+/**
+ * Extended permission union, including types not yet published in
+ * `@metamask/7715-permission-types` but supported by this package's decoder.
+ */
+type ExtendedPermissionTypes = PermissionTypes | Erc20TokenAllowancePermission | NativeTokenAllowancePermission | TokenApprovalRevocationPermission;
 /**
  * A partially reconstructed permission object decoded from a permission context.
  *
@@ -11,8 +59,8 @@ import type { Hex } from "@metamask/utils";
  */
 export type DecodedPermission = Pick<PermissionRequest<PermissionTypes>, 'chainId' | 'from' | 'to'> & {
     permission: Omit<PermissionRequest<PermissionTypes>['permission'], 'isAdjustmentAllowed' | 'type' | 'data'> & {
-        type: PermissionTypes['type'];
-        data: PermissionTypes['data'];
+        type: ExtendedPermissionTypes['type'];
+        data: ExtendedPermissionTypes['data'];
         justification?: string;
     };
     /**
@@ -27,6 +75,25 @@ export type DecodedPermission = Pick<PermissionRequest<PermissionTypes>, 'chainI
  * Supported permission type identifiers that can be decoded from a permission context.
  */
 export type PermissionType = DecodedPermission['permission']['type'];
+/**
+ * Checksummed enforcer contract addresses for a chain (from getChecksumEnforcersByChainId).
+ */
+export type ChecksumEnforcersByChainId = {
+    erc20StreamingEnforcer: Hex;
+    erc20PeriodicEnforcer: Hex;
+    nativeTokenStreamingEnforcer: Hex;
+    nativeTokenPeriodicEnforcer: Hex;
+    approvalRevocationEnforcer: Hex;
+    exactCalldataEnforcer: Hex;
+    valueLteEnforcer: Hex;
+    timestampEnforcer: Hex;
+    nonceEnforcer: Hex;
+    allowedCalldataEnforcer: Hex;
+    allowedTargetsEnforcer: Hex;
+    redeemerEnforcer: Hex;
+};
+/** Caveat with checksummed enforcer address; used by rule decode functions. */
+export type ChecksumCaveat = Caveat<Hex>;
 /**
  * Result of validating and decoding permission terms from caveats.
  * When valid, includes expiry and decoded data; when invalid, includes the error.
@@ -61,4 +128,18 @@ export type PermissionDecoder = {
      */
     validateAndDecodePermission: (caveats: Caveat<Hex>[]) => ValidateAndDecodeResult;
 };
+/**
+ * A function that inspects checksummed caveats and optionally produces a
+ * {@link Rule} (e.g. redeemer, payee, expiry). Each rule decoder is
+ * responsible for a single rule type and is composed by
+ * `makePermissionDecoder` to populate the permission's `rules` array. The
+ * `expiry` rule, in addition to being appended to `rules`, has its value
+ * hoisted onto the top-level `expiry` field of the decoded permission.
+ */
+export type RuleDecoder = (args: {
+    contractAddresses: ChecksumEnforcersByChainId;
+    caveats: ChecksumCaveat[];
+    requiredEnforcers: Map<Hex, number>;
+}) => Rule | null;
+export {};
 //# sourceMappingURL=types.d.cts.map

package/dist/decodePermission/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,IAAI,EACL,wCAAwC;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,kCAAkC;AACxD,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAG3C;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,iBAAiB,CAAC,eAAe,CAAC,EAClC,SAAS,GAAG,MAAM,GAAG,IAAI,CAC1B,GAAG;IACF,UAAU,EAAE,IAAI,CACd,iBAAiB,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAChD,qBAAqB,GAAG,MAAM,GAAG,MAAM,CACxC,GAAG;QACF,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAE9B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAC1D;;;OAGG;IACH,2BAA2B,EAAE,CAC3B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KACnB,uBAAuB,CAAC;CAC9B,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,IAAI,EACL,wCAAwC;AACzC,OAAO,KAAK,EACV,uBAAuB,EACvB,MAAM,EACP,kCAAkC;AACnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,yCAAyC;AAC5E,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAE3C,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,KAAK,6BAA6B,GAAG,cAAc,GAAG;IACpD,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,0BAA0B,GAAG;QACjC,eAAe,EAAE,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC;KACnB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,KAAK,8BAA8B,GAAG,cAAc,GAAG;IACrD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,IAAI,EAAE,0BAA0B,GAAG;QACjC,eAAe,EAAE,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,KAAK,iCAAiC,GAAG,cAAc,GAAG;IACxD,IAAI,EAAE,2BAA2B,CAAC;IAClC,IAAI,EAAE,0BAA0B,GAAG,uBAAuB,CAAC;CAC5D,CAAC;AAEF;;;GAGG;AACH,KAAK,uBAAuB,GACxB,eAAe,GACf,6BAA6B,GAC7B,8BAA8B,GAC9B,iCAAiC,CAAC;AAGtC;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,iBAAiB,CAAC,eAAe,CAAC,EAClC,SAAS,GAAG,MAAM,GAAG,IAAI,CAC1B,GAAG;IACF,UAAU,EAAE,IAAI,CACd,iBAAiB,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAChD,qBAAqB,GAAG,MAAM,GAAG,MAAM,CACxC,GAAG;QACF,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,sBAAsB,EAAE,GAAG,CAAC;IAC5B,qBAAqB,EAAE,GAAG,CAAC;IAC3B,4BAA4B,EAAE,GAAG,CAAC;IAClC,2BAA2B,EAAE,GAAG,CAAC;IACjC,0BAA0B,EAAE,GAAG,CAAC;IAChC,qBAAqB,EAAE,GAAG,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC;IACtB,iBAAiB,EAAE,GAAG,CAAC;IACvB,aAAa,EAAE,GAAG,CAAC;IACnB,uBAAuB,EAAE,GAAG,CAAC;IAC7B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,gBAAgB,EAAE,GAAG,CAAC;CACvB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAC1D;;;OAGG;IACH,2BAA2B,EAAE,CAC3B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KACnB,uBAAuB,CAAC;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,iBAAiB,EAAE,0BAA0B,CAAC;IAC9C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;CACrC,KAAK,IAAI,GAAG,IAAI,CAAC"}

package/dist/decodePermission/types.d.mts

@@ -1,6 +1,54 @@
-import type { PermissionRequest, PermissionTypes, Rule } from "@metamask/7715-permission-types";
-import type { Caveat } from "@metamask/delegation-core";
+import type { BasePermission, MetaMaskBasePermissionData, PermissionRequest, PermissionTypes, Rule } from "@metamask/7715-permission-types";
+import type { ApprovalRevocationTerms, Caveat } from "@metamask/delegation-core";
+import type { DELEGATOR_CONTRACTS } from "@metamask/delegation-deployments";
 import type { Hex } from "@metamask/utils";
+export type DeployedContractsByName = (typeof DELEGATOR_CONTRACTS)[number][number];
+/**
+ * Permission type for an unbounded ERC-20 token allowance.
+ *
+ * Encoded on-chain as an ERC20PeriodTransferEnforcer caveat with
+ * `periodDuration` set to `UINT256_MAX` so that the allowance never resets
+ * within any realistic time horizon.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type Erc20TokenAllowancePermission = BasePermission & {
+    type: 'erc20-token-allowance';
+    data: MetaMaskBasePermissionData & {
+        allowanceAmount: Hex;
+        startTime?: number | null;
+        tokenAddress: Hex;
+    };
+};
+/**
+ * Permission type for an unbounded native token allowance.
+ *
+ * Encoded on-chain as a NativeTokenPeriodTransferEnforcer caveat with
+ * `periodDuration` set to `UINT256_MAX`.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type NativeTokenAllowancePermission = BasePermission & {
+    type: 'native-token-allowance';
+    data: MetaMaskBasePermissionData & {
+        allowanceAmount: Hex;
+        startTime?: number | null;
+    };
+};
+/**
+ * Permission type for token approval revocation.
+ *
+ * Not yet defined in `@metamask/7715-permission-types`, so declared locally.
+ */
+type TokenApprovalRevocationPermission = BasePermission & {
+    type: 'token-approval-revocation';
+    data: MetaMaskBasePermissionData & ApprovalRevocationTerms;
+};
+/**
+ * Extended permission union, including types not yet published in
+ * `@metamask/7715-permission-types` but supported by this package's decoder.
+ */
+type ExtendedPermissionTypes = PermissionTypes | Erc20TokenAllowancePermission | NativeTokenAllowancePermission | TokenApprovalRevocationPermission;
 /**
  * A partially reconstructed permission object decoded from a permission context.
  *
@@ -11,8 +59,8 @@ import type { Hex } from "@metamask/utils";
  */
 export type DecodedPermission = Pick<PermissionRequest<PermissionTypes>, 'chainId' | 'from' | 'to'> & {
     permission: Omit<PermissionRequest<PermissionTypes>['permission'], 'isAdjustmentAllowed' | 'type' | 'data'> & {
-        type: PermissionTypes['type'];
-        data: PermissionTypes['data'];
+        type: ExtendedPermissionTypes['type'];
+        data: ExtendedPermissionTypes['data'];
         justification?: string;
     };
     /**
@@ -27,6 +75,25 @@ export type DecodedPermission = Pick<PermissionRequest<PermissionTypes>, 'chainI
  * Supported permission type identifiers that can be decoded from a permission context.
  */
 export type PermissionType = DecodedPermission['permission']['type'];
+/**
+ * Checksummed enforcer contract addresses for a chain (from getChecksumEnforcersByChainId).
+ */
+export type ChecksumEnforcersByChainId = {
+    erc20StreamingEnforcer: Hex;
+    erc20PeriodicEnforcer: Hex;
+    nativeTokenStreamingEnforcer: Hex;
+    nativeTokenPeriodicEnforcer: Hex;
+    approvalRevocationEnforcer: Hex;
+    exactCalldataEnforcer: Hex;
+    valueLteEnforcer: Hex;
+    timestampEnforcer: Hex;
+    nonceEnforcer: Hex;
+    allowedCalldataEnforcer: Hex;
+    allowedTargetsEnforcer: Hex;
+    redeemerEnforcer: Hex;
+};
+/** Caveat with checksummed enforcer address; used by rule decode functions. */
+export type ChecksumCaveat = Caveat<Hex>;
 /**
  * Result of validating and decoding permission terms from caveats.
  * When valid, includes expiry and decoded data; when invalid, includes the error.
@@ -61,4 +128,18 @@ export type PermissionDecoder = {
      */
     validateAndDecodePermission: (caveats: Caveat<Hex>[]) => ValidateAndDecodeResult;
 };
+/**
+ * A function that inspects checksummed caveats and optionally produces a
+ * {@link Rule} (e.g. redeemer, payee, expiry). Each rule decoder is
+ * responsible for a single rule type and is composed by
+ * `makePermissionDecoder` to populate the permission's `rules` array. The
+ * `expiry` rule, in addition to being appended to `rules`, has its value
+ * hoisted onto the top-level `expiry` field of the decoded permission.
+ */
+export type RuleDecoder = (args: {
+    contractAddresses: ChecksumEnforcersByChainId;
+    caveats: ChecksumCaveat[];
+    requiredEnforcers: Map<Hex, number>;
+}) => Rule | null;
+export {};
 //# sourceMappingURL=types.d.mts.map

package/dist/decodePermission/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,IAAI,EACL,wCAAwC;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,kCAAkC;AACxD,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAG3C;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,iBAAiB,CAAC,eAAe,CAAC,EAClC,SAAS,GAAG,MAAM,GAAG,IAAI,CAC1B,GAAG;IACF,UAAU,EAAE,IAAI,CACd,iBAAiB,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAChD,qBAAqB,GAAG,MAAM,GAAG,MAAM,CACxC,GAAG;QACF,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAE9B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAC1D;;;OAGG;IACH,2BAA2B,EAAE,CAC3B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KACnB,uBAAuB,CAAC;CAC9B,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,IAAI,EACL,wCAAwC;AACzC,OAAO,KAAK,EACV,uBAAuB,EACvB,MAAM,EACP,kCAAkC;AACnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,yCAAyC;AAC5E,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAE3C,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,KAAK,6BAA6B,GAAG,cAAc,GAAG;IACpD,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,0BAA0B,GAAG;QACjC,eAAe,EAAE,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC;KACnB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,KAAK,8BAA8B,GAAG,cAAc,GAAG;IACrD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,IAAI,EAAE,0BAA0B,GAAG;QACjC,eAAe,EAAE,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,KAAK,iCAAiC,GAAG,cAAc,GAAG;IACxD,IAAI,EAAE,2BAA2B,CAAC;IAClC,IAAI,EAAE,0BAA0B,GAAG,uBAAuB,CAAC;CAC5D,CAAC;AAEF;;;GAGG;AACH,KAAK,uBAAuB,GACxB,eAAe,GACf,6BAA6B,GAC7B,8BAA8B,GAC9B,iCAAiC,CAAC;AAGtC;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,iBAAiB,CAAC,eAAe,CAAC,EAClC,SAAS,GAAG,MAAM,GAAG,IAAI,CAC1B,GAAG;IACF,UAAU,EAAE,IAAI,CACd,iBAAiB,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAChD,qBAAqB,GAAG,MAAM,GAAG,MAAM,CACxC,GAAG;QACF,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,sBAAsB,EAAE,GAAG,CAAC;IAC5B,qBAAqB,EAAE,GAAG,CAAC;IAC3B,4BAA4B,EAAE,GAAG,CAAC;IAClC,2BAA2B,EAAE,GAAG,CAAC;IACjC,0BAA0B,EAAE,GAAG,CAAC;IAChC,qBAAqB,EAAE,GAAG,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC;IACtB,iBAAiB,EAAE,GAAG,CAAC;IACvB,aAAa,EAAE,GAAG,CAAC;IACnB,uBAAuB,EAAE,GAAG,CAAC;IAC7B,sBAAsB,EAAE,GAAG,CAAC;IAC5B,gBAAgB,EAAE,GAAG,CAAC;CACvB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAC1D;;;OAGG;IACH,2BAA2B,EAAE,CAC3B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KACnB,uBAAuB,CAAC;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,iBAAiB,EAAE,0BAA0B,CAAC;IAC9C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;CACrC,KAAK,IAAI,GAAG,IAAI,CAAC"}

package/dist/decodePermission/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  PermissionRequest,\n  PermissionTypes,\n  Rule,\n} from '@metamask/7715-permission-types';\nimport type { Caveat } from '@metamask/delegation-core';\nimport type { Hex } from '@metamask/utils';\n\n// This is a somewhat convoluted type - it includes all of the fields that are decoded from the permission context.\n/**\n * A partially reconstructed permission object decoded from a permission context.\n *\n * This mirrors the shape of {@link PermissionRequest} for fields that can be\n * deterministically recovered from the encoded permission context, and it\n * augments the result with an explicit `expiry` property derived from the\n * `TimestampEnforcer` terms, as well as the `origin` property.\n */\nexport type DecodedPermission = Pick<\n  PermissionRequest<PermissionTypes>,\n  'chainId' | 'from' | 'to'\n> & {\n  permission: Omit<\n    PermissionRequest<PermissionTypes>['permission'],\n    'isAdjustmentAllowed' | 'type' | 'data'\n  > & {\n    type: PermissionTypes['type'];\n    data: PermissionTypes['data'];\n    // PermissionRequest type does not work well without the specific permission type, so we amend it here\n    justification?: string;\n  };\n  /**\n   * @deprecated Use `rules` instead.\n   */\n  expiry: number | null;\n  origin: string;\n  /** Rules recovered from caveats (e.g. redeemer allowlist). */\n  rules?: Rule[];\n};\n\n/**\n * Supported permission type identifiers that can be decoded from a permission context.\n */\nexport type PermissionType = DecodedPermission['permission']['type'];\n\n/**\n * Result of validating and decoding permission terms from caveats.\n * When valid, includes expiry and decoded data; when invalid, includes the error.\n */\nexport type ValidateAndDecodeResult =\n  | {\n      isValid: true;\n      expiry: number | null;\n      data: DecodedPermission['permission']['data'];\n      rules?: Rule[];\n    }\n  | { isValid: false; error: Error };\n\n/**\n * A decoder that defines the required and optional enforcers for a permission\n * type, and provides methods to test whether caveat addresses match the\n * permission and to validate and decode permission terms from caveats.\n */\nexport type PermissionDecoder = {\n  permissionType: PermissionType;\n  requiredEnforcers: Map<Hex, number>;\n  optionalEnforcers: Set<Hex>;\n  /**\n   * Returns true if the given caveat addresses (enforcer addresses) match this\n   * decoder (required enforcers present with correct multiplicity, no\n   * forbidden enforcers).\n   */\n  caveatAddressesMatch: (caveatAddresses: Hex[]) => boolean;\n  /**\n   * Validates and decodes permission terms from the caveats. Returns a result\n   * object with isValid; when valid, includes expiry and data.\n   */\n  validateAndDecodePermission: (\n    caveats: Caveat<Hex>[],\n  ) => ValidateAndDecodeResult;\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../../src/decodePermission/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  BasePermission,\n  MetaMaskBasePermissionData,\n  PermissionRequest,\n  PermissionTypes,\n  Rule,\n} from '@metamask/7715-permission-types';\nimport type {\n  ApprovalRevocationTerms,\n  Caveat,\n} from '@metamask/delegation-core';\nimport type { DELEGATOR_CONTRACTS } from '@metamask/delegation-deployments';\nimport type { Hex } from '@metamask/utils';\n\nexport type DeployedContractsByName =\n  (typeof DELEGATOR_CONTRACTS)[number][number];\n\n/**\n * Permission type for an unbounded ERC-20 token allowance.\n *\n * Encoded on-chain as an ERC20PeriodTransferEnforcer caveat with\n * `periodDuration` set to `UINT256_MAX` so that the allowance never resets\n * within any realistic time horizon.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype Erc20TokenAllowancePermission = BasePermission & {\n  type: 'erc20-token-allowance';\n  data: MetaMaskBasePermissionData & {\n    allowanceAmount: Hex;\n    startTime?: number | null;\n    tokenAddress: Hex;\n  };\n};\n\n/**\n * Permission type for an unbounded native token allowance.\n *\n * Encoded on-chain as a NativeTokenPeriodTransferEnforcer caveat with\n * `periodDuration` set to `UINT256_MAX`.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype NativeTokenAllowancePermission = BasePermission & {\n  type: 'native-token-allowance';\n  data: MetaMaskBasePermissionData & {\n    allowanceAmount: Hex;\n    startTime?: number | null;\n  };\n};\n\n/**\n * Permission type for token approval revocation.\n *\n * Not yet defined in `@metamask/7715-permission-types`, so declared locally.\n */\ntype TokenApprovalRevocationPermission = BasePermission & {\n  type: 'token-approval-revocation';\n  data: MetaMaskBasePermissionData & ApprovalRevocationTerms;\n};\n\n/**\n * Extended permission union, including types not yet published in\n * `@metamask/7715-permission-types` but supported by this package's decoder.\n */\ntype ExtendedPermissionTypes =\n  | PermissionTypes\n  | Erc20TokenAllowancePermission\n  | NativeTokenAllowancePermission\n  | TokenApprovalRevocationPermission;\n\n// This is a somewhat convoluted type - it includes all of the fields that are decoded from the permission context.\n/**\n * A partially reconstructed permission object decoded from a permission context.\n *\n * This mirrors the shape of {@link PermissionRequest} for fields that can be\n * deterministically recovered from the encoded permission context, and it\n * augments the result with an explicit `expiry` property derived from the\n * `TimestampEnforcer` terms, as well as the `origin` property.\n */\nexport type DecodedPermission = Pick<\n  PermissionRequest<PermissionTypes>,\n  'chainId' | 'from' | 'to'\n> & {\n  permission: Omit<\n    PermissionRequest<PermissionTypes>['permission'],\n    'isAdjustmentAllowed' | 'type' | 'data'\n  > & {\n    type: ExtendedPermissionTypes['type'];\n    data: ExtendedPermissionTypes['data'];\n    // PermissionRequest type does not work well without the specific permission type, so we amend it here\n    justification?: string;\n  };\n  /**\n   * @deprecated Use `rules` instead.\n   */\n  expiry: number | null;\n  origin: string;\n  /** Rules recovered from caveats (e.g. redeemer allowlist). */\n  rules?: Rule[];\n};\n\n/**\n * Supported permission type identifiers that can be decoded from a permission context.\n */\nexport type PermissionType = DecodedPermission['permission']['type'];\n\n/**\n * Checksummed enforcer contract addresses for a chain (from getChecksumEnforcersByChainId).\n */\nexport type ChecksumEnforcersByChainId = {\n  erc20StreamingEnforcer: Hex;\n  erc20PeriodicEnforcer: Hex;\n  nativeTokenStreamingEnforcer: Hex;\n  nativeTokenPeriodicEnforcer: Hex;\n  approvalRevocationEnforcer: Hex;\n  exactCalldataEnforcer: Hex;\n  valueLteEnforcer: Hex;\n  timestampEnforcer: Hex;\n  nonceEnforcer: Hex;\n  allowedCalldataEnforcer: Hex;\n  allowedTargetsEnforcer: Hex;\n  redeemerEnforcer: Hex;\n};\n\n/** Caveat with checksummed enforcer address; used by rule decode functions. */\nexport type ChecksumCaveat = Caveat<Hex>;\n\n/**\n * Result of validating and decoding permission terms from caveats.\n * When valid, includes expiry and decoded data; when invalid, includes the error.\n */\nexport type ValidateAndDecodeResult =\n  | {\n      isValid: true;\n      expiry: number | null;\n      data: DecodedPermission['permission']['data'];\n      rules?: Rule[];\n    }\n  | { isValid: false; error: Error };\n\n/**\n * A decoder that defines the required and optional enforcers for a permission\n * type, and provides methods to test whether caveat addresses match the\n * permission and to validate and decode permission terms from caveats.\n */\nexport type PermissionDecoder = {\n  permissionType: PermissionType;\n  requiredEnforcers: Map<Hex, number>;\n  optionalEnforcers: Set<Hex>;\n  /**\n   * Returns true if the given caveat addresses (enforcer addresses) match this\n   * decoder (required enforcers present with correct multiplicity, no\n   * forbidden enforcers).\n   */\n  caveatAddressesMatch: (caveatAddresses: Hex[]) => boolean;\n  /**\n   * Validates and decodes permission terms from the caveats. Returns a result\n   * object with isValid; when valid, includes expiry and data.\n   */\n  validateAndDecodePermission: (\n    caveats: Caveat<Hex>[],\n  ) => ValidateAndDecodeResult;\n};\n\n/**\n * A function that inspects checksummed caveats and optionally produces a\n * {@link Rule} (e.g. redeemer, payee, expiry). Each rule decoder is\n * responsible for a single rule type and is composed by\n * `makePermissionDecoder` to populate the permission's `rules` array. The\n * `expiry` rule, in addition to being appended to `rules`, has its value\n * hoisted onto the top-level `expiry` field of the decoded permission.\n */\nexport type RuleDecoder = (args: {\n  contractAddresses: ChecksumEnforcersByChainId;\n  caveats: ChecksumCaveat[];\n  requiredEnforcers: Map<Hex, number>;\n}) => Rule | null;\n"]}

package/dist/decodePermission/utils.cjs

@@ -1,7 +1,94 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.splitHex = exports.getTermsByEnforcer = exports.enforcersMatchRule = exports.buildEnforcerCountsAndSet = exports.extractExpiryFromCaveatTerms = void 0;
+exports.splitHex = exports.getTermsByEnforcer = exports.enforcersMatchRule = exports.buildEnforcerCountsAndSet = exports.extractExpiryFromCaveatTerms = exports.getChecksumEnforcersByChainId = exports.getByteLength = exports.MAX_PERIOD_DURATION = exports.ERC20_APPROVE_ZERO_AMOUNT_TERMS = exports.ERC20_APPROVE_SELECTOR_TERMS = exports.UINT256_MAX = exports.ZERO_32_BYTES = void 0;
 const utils_1 = require("@metamask/utils");
+/**
+ * The names of the enforcer contracts for each permission type.
+ */
+const ENFORCER_CONTRACT_NAMES = {
+    ERC20PeriodTransferEnforcer: 'ERC20PeriodTransferEnforcer',
+    ERC20StreamingEnforcer: 'ERC20StreamingEnforcer',
+    ApprovalRevocationEnforcer: 'ApprovalRevocationEnforcer',
+    ExactCalldataEnforcer: 'ExactCalldataEnforcer',
+    NativeTokenPeriodTransferEnforcer: 'NativeTokenPeriodTransferEnforcer',
+    NativeTokenStreamingEnforcer: 'NativeTokenStreamingEnforcer',
+    TimestampEnforcer: 'TimestampEnforcer',
+    ValueLteEnforcer: 'ValueLteEnforcer',
+    NonceEnforcer: 'NonceEnforcer',
+    AllowedCalldataEnforcer: 'AllowedCalldataEnforcer',
+    AllowedTargetsEnforcer: 'AllowedTargetsEnforcer',
+    RedeemerEnforcer: 'RedeemerEnforcer',
+};
+/**
+ * 32 bytes of zero (0x + 64 hex chars).
+ */
+exports.ZERO_32_BYTES = '0x0000000000000000000000000000000000000000000000000000000000000000';
+/**
+ * Maximum unsigned 256-bit integer encoded as 32 bytes (0x + 64 hex chars).
+ */
+exports.UINT256_MAX = '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
+/** AllowedCalldataEnforcer terms for ERC20 approve selector. */
+exports.ERC20_APPROVE_SELECTOR_TERMS = '0x0000000000000000000000000000000000000000000000000000000000000000095ea7b3';
+/** AllowedCalldataEnforcer terms for ERC20 approve zero amount. */
+exports.ERC20_APPROVE_ZERO_AMOUNT_TERMS = '0x00000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000000000000000000000000000000000000000';
+/** Maximum period duration in seconds. */
+exports.MAX_PERIOD_DURATION = 10 * 365 * 24 * 60 * 60; // 10 years in seconds
+/**
+ * Get the byte length of a hex string.
+ *
+ * @param hexString - The hex string to get the byte length of.
+ * @returns The byte length of the hex string.
+ */
+const getByteLength = (hexString) => {
+    return (hexString.length - 2) / 2;
+};
+exports.getByteLength = getByteLength;
+/**
+ * Resolves and returns checksummed addresses of all known enforcer contracts
+ * for a given `chainId` under the current delegation framework version.
+ *
+ * @param contracts - The deployed contracts for the chain.
+ * @returns An object mapping enforcer names to checksummed contract addresses.
+ * @throws If the chain or an expected enforcer contract is not found.
+ */
+const getChecksumEnforcersByChainId = (contracts) => {
+    const getChecksumContractAddress = (contractName) => {
+        const address = contracts[contractName];
+        if (!address) {
+            throw new Error(`Contract not found: ${contractName}`);
+        }
+        return (0, utils_1.getChecksumAddress)(address);
+    };
+    // permission type specific enforcers
+    const erc20StreamingEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.ERC20StreamingEnforcer);
+    const erc20PeriodicEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.ERC20PeriodTransferEnforcer);
+    const nativeTokenStreamingEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.NativeTokenStreamingEnforcer);
+    const nativeTokenPeriodicEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.NativeTokenPeriodTransferEnforcer);
+    const approvalRevocationEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.ApprovalRevocationEnforcer);
+    // general enforcers
+    const exactCalldataEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.ExactCalldataEnforcer);
+    const valueLteEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.ValueLteEnforcer);
+    const timestampEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.TimestampEnforcer);
+    const nonceEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.NonceEnforcer);
+    const allowedCalldataEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.AllowedCalldataEnforcer);
+    const allowedTargetsEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.AllowedTargetsEnforcer);
+    const redeemerEnforcer = getChecksumContractAddress(ENFORCER_CONTRACT_NAMES.RedeemerEnforcer);
+    return {
+        erc20StreamingEnforcer,
+        erc20PeriodicEnforcer,
+        nativeTokenStreamingEnforcer,
+        nativeTokenPeriodicEnforcer,
+        approvalRevocationEnforcer,
+        exactCalldataEnforcer,
+        valueLteEnforcer,
+        timestampEnforcer,
+        nonceEnforcer,
+        allowedCalldataEnforcer,
+        allowedTargetsEnforcer,
+        redeemerEnforcer,
+    };
+};
+exports.getChecksumEnforcersByChainId = getChecksumEnforcersByChainId;
 /**
  * Extracts the expiry timestamp from TimestampEnforcer caveat terms.
  * Terms are 32 bytes: first 16 bytes timestampAfterThreshold (must be 0),

package/dist/decodePermission/utils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.cjs","sourceRoot":"","sources":["../../src/decodePermission/utils.ts"],"names":[],"mappings":";;;AACA,2CAAkE;AAGlE;;;;;;;;GAQG;AACI,MAAM,4BAA4B,GAAG,CAAC,KAAU,EAAU,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qFAAqF,KAAK,CAAC,MAAM,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,IAAI,IAAA,mBAAW,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAjBW,QAAA,4BAA4B,gCAiBvC;AAEF;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,eAAsB;IAI9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,0BAAkB,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AATD,8DASC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,MAAwB,EACxB,YAAsB,EACtB,iBAAmC,EACnC,iBAA2B;IAE3B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAM;QACpC,GAAG,iBAAiB;QACpB,GAAG,iBAAiB,CAAC,IAAI,EAAE;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AArBD,gDAqBC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAA0C,EAC1E,OAAO,EACP,QAAQ,EACR,eAAe,GAKhB;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACzC,CAAC;IAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAwD,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClC,CAAC;AAzBD,gDAyBC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,QAAQ,CAAC,KAAU,EAAE,OAAiB;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAAC,CAAC;QACxD,KAAK,IAAI,cAAc,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAW,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAVD,4BAUC","sourcesContent":["import type { Caveat } from '@metamask/delegation-core';\nimport { getChecksumAddress, hexToNumber } from '@metamask/utils';\nimport type { Hex } from '@metamask/utils';\n\n/**\n * Extracts the expiry timestamp from TimestampEnforcer caveat terms.\n * Terms are 32 bytes: first 16 bytes timestampAfterThreshold (must be 0),\n * last 16 bytes timestampBeforeThreshold (expiry).\n *\n * @param terms - The hex-encoded terms from a TimestampEnforcer caveat.\n * @returns The expiry timestamp in seconds.\n * @throws If terms are invalid.\n */\nexport const extractExpiryFromCaveatTerms = (terms: Hex): number => {\n  if (terms.length !== 66) {\n    throw new Error(\n      `Invalid TimestampEnforcer terms length: expected 66 characters (0x + 64 hex), got ${terms.length}`,\n    );\n  }\n  const [after, before] = splitHex(terms, [16, 16]);\n  if (hexToNumber(after) !== 0) {\n    throw new Error('Invalid expiry: timestampAfterThreshold must be 0');\n  }\n  const expiry = hexToNumber(before);\n  if (expiry === 0) {\n    throw new Error(\n      'Invalid expiry: timestampBeforeThreshold must be greater than 0',\n    );\n  }\n  return expiry;\n};\n\n/**\n * Builds enforcer counts and set from caveat addresses (checksummed).\n * Used by caveatAddressesMatch.\n *\n * @param caveatAddresses - List of enforcer contract addresses (hex).\n * @returns Counts per enforcer and set of unique enforcers.\n */\nexport function buildEnforcerCountsAndSet(caveatAddresses: Hex[]): {\n  counts: Map<Hex, number>;\n  enforcersSet: Set<Hex>;\n} {\n  const counts = new Map<Hex, number>();\n  for (const addr of caveatAddresses.map(getChecksumAddress)) {\n    counts.set(addr, (counts.get(addr) ?? 0) + 1);\n  }\n  return { counts, enforcersSet: new Set(counts.keys()) };\n}\n\n/**\n * Returns true if the given counts/set match the rule (required counts exact,\n * no enforcer outside required + optional).\n *\n * @param counts - Map of enforcer address to occurrence count.\n * @param enforcersSet - Set of unique enforcer addresses present.\n * @param requiredEnforcers - Map of required enforcer to required count.\n * @param optionalEnforcers - Set of optional enforcer addresses.\n * @returns True if the counts match the rule.\n */\nexport function enforcersMatchRule(\n  counts: Map<Hex, number>,\n  enforcersSet: Set<Hex>,\n  requiredEnforcers: Map<Hex, number>,\n  optionalEnforcers: Set<Hex>,\n): boolean {\n  const allowedEnforcers = new Set<Hex>([\n    ...optionalEnforcers,\n    ...requiredEnforcers.keys(),\n  ]);\n  for (const addr of enforcersSet) {\n    if (!allowedEnforcers.has(addr)) {\n      return false;\n    }\n  }\n  for (const [addr, requiredCount] of requiredEnforcers.entries()) {\n    if ((counts.get(addr) ?? 0) !== requiredCount) {\n      return false;\n    }\n  }\n  return true;\n}\n\n/**\n * Gets the terms for a given enforcer from a list of caveats.\n *\n * @param args - The arguments to this function.\n * @param  args.throwIfNotFound - Whether to throw an error if no matching enforcer is found. Default is true.\n * @param args.caveats - The list of caveats to search.\n * @param args.enforcer - The enforcer to search for.\n * @returns The terms for the given enforcer.\n */\nexport function getTermsByEnforcer<TThrowIfNotFound extends boolean = true>({\n  caveats,\n  enforcer,\n  throwIfNotFound,\n}: {\n  caveats: Caveat<Hex>[];\n  enforcer: Hex;\n  throwIfNotFound?: TThrowIfNotFound;\n}): TThrowIfNotFound extends true ? Hex : Hex | null {\n  const matchingCaveats = caveats.filter(\n    (caveat) => caveat.enforcer === enforcer,\n  );\n\n  if (matchingCaveats.length === 0) {\n    if (throwIfNotFound ?? true) {\n      throw new Error('Invalid caveats');\n    }\n    return null as TThrowIfNotFound extends true ? Hex : Hex | null;\n  }\n\n  if (matchingCaveats.length > 1) {\n    throw new Error('Invalid caveats');\n  }\n\n  return matchingCaveats[0].terms;\n}\n\n/**\n * Splits a 0x-prefixed hex string into parts according to the provided byte lengths.\n *\n * Each entry in `lengths` represents a part length in bytes; internally this is\n * multiplied by 2 to derive the number of hexadecimal characters to slice. The\n * returned substrings do not include the `0x` prefix and preserve leading zeros.\n *\n * Note: This function does not perform input validation (e.g., verifying the\n * payload length equals the sum of requested lengths). Callers are expected to\n * provide well-formed inputs.\n *\n * Example:\n * splitHex('0x12345678', [1, 3]) => ['0x12', '0x345678']\n *\n * @param value - The 0x-prefixed hex string to split.\n * @param lengths - The lengths of each part, in bytes.\n * @returns An array of hex substrings (each with `0x` prefix), one for each part.\n */\nexport function splitHex(value: Hex, lengths: number[]): Hex[] {\n  let start = 2;\n  const parts: Hex[] = [];\n  for (const partLength of lengths) {\n    const partCharLength = partLength * 2;\n    const part = value.slice(start, start + partCharLength);\n    start += partCharLength;\n    parts.push(`0x${part}` as const);\n  }\n  return parts;\n}\n"]}
+{"version":3,"file":"utils.cjs","sourceRoot":"","sources":["../../src/decodePermission/utils.ts"],"names":[],"mappings":";;;AACA,2CAAkE;AAQlE;;GAEG;AACH,MAAM,uBAAuB,GAAG;IAC9B,2BAA2B,EAAE,6BAA6B;IAC1D,sBAAsB,EAAE,wBAAwB;IAChD,0BAA0B,EAAE,4BAA4B;IACxD,qBAAqB,EAAE,uBAAuB;IAC9C,iCAAiC,EAAE,mCAAmC;IACtE,4BAA4B,EAAE,8BAA8B;IAC5D,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,aAAa,EAAE,eAAe;IAC9B,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;CACrC,CAAC;AAEF;;GAEG;AACU,QAAA,aAAa,GACxB,oEAA6E,CAAC;AAEhF;;GAEG;AACU,QAAA,WAAW,GACtB,oEAA6E,CAAC;AAEhF,gEAAgE;AACnD,QAAA,4BAA4B,GACvC,4EAAqF,CAAC;AAExF,mEAAmE;AACtD,QAAA,+BAA+B,GAC1C,oIAA6I,CAAC;AAEhJ,0CAA0C;AAC7B,QAAA,mBAAmB,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,sBAAsB;AAElF;;;;;GAKG;AACI,MAAM,aAAa,GAAG,CAAC,SAAc,EAAU,EAAE;IACtD,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC;AAFW,QAAA,aAAa,iBAExB;AAEF;;;;;;;GAOG;AACI,MAAM,6BAA6B,GAAG,CAC3C,SAAkC,EACN,EAAE;IAC9B,MAAM,0BAA0B,GAAG,CAAC,YAAoB,EAAO,EAAE;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAExC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAA,0BAAkB,EAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,qCAAqC;IACrC,MAAM,sBAAsB,GAAG,0BAA0B,CACvD,uBAAuB,CAAC,sBAAsB,CAC/C,CAAC;IACF,MAAM,qBAAqB,GAAG,0BAA0B,CACtD,uBAAuB,CAAC,2BAA2B,CACpD,CAAC;IACF,MAAM,4BAA4B,GAAG,0BAA0B,CAC7D,uBAAuB,CAAC,4BAA4B,CACrD,CAAC;IACF,MAAM,2BAA2B,GAAG,0BAA0B,CAC5D,uBAAuB,CAAC,iCAAiC,CAC1D,CAAC;IACF,MAAM,0BAA0B,GAAG,0BAA0B,CAC3D,uBAAuB,CAAC,0BAA0B,CACnD,CAAC;IAEF,oBAAoB;IACpB,MAAM,qBAAqB,GAAG,0BAA0B,CACtD,uBAAuB,CAAC,qBAAqB,CAC9C,CAAC;IACF,MAAM,gBAAgB,GAAG,0BAA0B,CACjD,uBAAuB,CAAC,gBAAgB,CACzC,CAAC;IACF,MAAM,iBAAiB,GAAG,0BAA0B,CAClD,uBAAuB,CAAC,iBAAiB,CAC1C,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAC9C,uBAAuB,CAAC,aAAa,CACtC,CAAC;IAEF,MAAM,uBAAuB,GAAG,0BAA0B,CACxD,uBAAuB,CAAC,uBAAuB,CAChD,CAAC;IAEF,MAAM,sBAAsB,GAAG,0BAA0B,CACvD,uBAAuB,CAAC,sBAAsB,CAC/C,CAAC;IAEF,MAAM,gBAAgB,GAAG,0BAA0B,CACjD,uBAAuB,CAAC,gBAAgB,CACzC,CAAC;IAEF,OAAO;QACL,sBAAsB;QACtB,qBAAqB;QACrB,4BAA4B;QAC5B,2BAA2B;QAC3B,0BAA0B;QAC1B,qBAAqB;QACrB,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,uBAAuB;QACvB,sBAAsB;QACtB,gBAAgB;KACjB,CAAC;AACJ,CAAC,CAAC;AAtEW,QAAA,6BAA6B,iCAsExC;AAEF;;;;;;;;GAQG;AACI,MAAM,4BAA4B,GAAG,CAAC,KAAU,EAAU,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qFAAqF,KAAK,CAAC,MAAM,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,IAAI,IAAA,mBAAW,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAjBW,QAAA,4BAA4B,gCAiBvC;AAEF;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,eAAsB;IAI9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,0BAAkB,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AATD,8DASC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,MAAwB,EACxB,YAAsB,EACtB,iBAAmC,EACnC,iBAA2B;IAE3B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAM;QACpC,GAAG,iBAAiB;QACpB,GAAG,iBAAiB,CAAC,IAAI,EAAE;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AArBD,gDAqBC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAA0C,EAC1E,OAAO,EACP,QAAQ,EACR,eAAe,GAKhB;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACzC,CAAC;IAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,IAAwD,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClC,CAAC;AAzBD,gDAyBC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,QAAQ,CAAC,KAAU,EAAE,OAAiB;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAAC,CAAC;QACxD,KAAK,IAAI,cAAc,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAW,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAVD,4BAUC","sourcesContent":["import type { Caveat } from '@metamask/delegation-core';\nimport { getChecksumAddress, hexToNumber } from '@metamask/utils';\nimport type { Hex } from '@metamask/utils';\n\nimport type {\n  ChecksumEnforcersByChainId,\n  DeployedContractsByName,\n} from './types.js';\n\n/**\n * The names of the enforcer contracts for each permission type.\n */\nconst ENFORCER_CONTRACT_NAMES = {\n  ERC20PeriodTransferEnforcer: 'ERC20PeriodTransferEnforcer',\n  ERC20StreamingEnforcer: 'ERC20StreamingEnforcer',\n  ApprovalRevocationEnforcer: 'ApprovalRevocationEnforcer',\n  ExactCalldataEnforcer: 'ExactCalldataEnforcer',\n  NativeTokenPeriodTransferEnforcer: 'NativeTokenPeriodTransferEnforcer',\n  NativeTokenStreamingEnforcer: 'NativeTokenStreamingEnforcer',\n  TimestampEnforcer: 'TimestampEnforcer',\n  ValueLteEnforcer: 'ValueLteEnforcer',\n  NonceEnforcer: 'NonceEnforcer',\n  AllowedCalldataEnforcer: 'AllowedCalldataEnforcer',\n  AllowedTargetsEnforcer: 'AllowedTargetsEnforcer',\n  RedeemerEnforcer: 'RedeemerEnforcer',\n};\n\n/**\n * 32 bytes of zero (0x + 64 hex chars).\n */\nexport const ZERO_32_BYTES =\n  '0x0000000000000000000000000000000000000000000000000000000000000000' as const;\n\n/**\n * Maximum unsigned 256-bit integer encoded as 32 bytes (0x + 64 hex chars).\n */\nexport const UINT256_MAX =\n  '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' as const;\n\n/** AllowedCalldataEnforcer terms for ERC20 approve selector. */\nexport const ERC20_APPROVE_SELECTOR_TERMS =\n  '0x0000000000000000000000000000000000000000000000000000000000000000095ea7b3' as const;\n\n/** AllowedCalldataEnforcer terms for ERC20 approve zero amount. */\nexport const ERC20_APPROVE_ZERO_AMOUNT_TERMS =\n  '0x00000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000000000000000000000000000000000000000' as const;\n\n/** Maximum period duration in seconds. */\nexport const MAX_PERIOD_DURATION = 10 * 365 * 24 * 60 * 60; // 10 years in seconds\n\n/**\n * Get the byte length of a hex string.\n *\n * @param hexString - The hex string to get the byte length of.\n * @returns The byte length of the hex string.\n */\nexport const getByteLength = (hexString: Hex): number => {\n  return (hexString.length - 2) / 2;\n};\n\n/**\n * Resolves and returns checksummed addresses of all known enforcer contracts\n * for a given `chainId` under the current delegation framework version.\n *\n * @param contracts - The deployed contracts for the chain.\n * @returns An object mapping enforcer names to checksummed contract addresses.\n * @throws If the chain or an expected enforcer contract is not found.\n */\nexport const getChecksumEnforcersByChainId = (\n  contracts: DeployedContractsByName,\n): ChecksumEnforcersByChainId => {\n  const getChecksumContractAddress = (contractName: string): Hex => {\n    const address = contracts[contractName];\n\n    if (!address) {\n      throw new Error(`Contract not found: ${contractName}`);\n    }\n\n    return getChecksumAddress(address);\n  };\n\n  // permission type specific enforcers\n  const erc20StreamingEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.ERC20StreamingEnforcer,\n  );\n  const erc20PeriodicEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.ERC20PeriodTransferEnforcer,\n  );\n  const nativeTokenStreamingEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.NativeTokenStreamingEnforcer,\n  );\n  const nativeTokenPeriodicEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.NativeTokenPeriodTransferEnforcer,\n  );\n  const approvalRevocationEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.ApprovalRevocationEnforcer,\n  );\n\n  // general enforcers\n  const exactCalldataEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.ExactCalldataEnforcer,\n  );\n  const valueLteEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.ValueLteEnforcer,\n  );\n  const timestampEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.TimestampEnforcer,\n  );\n  const nonceEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.NonceEnforcer,\n  );\n\n  const allowedCalldataEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.AllowedCalldataEnforcer,\n  );\n\n  const allowedTargetsEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.AllowedTargetsEnforcer,\n  );\n\n  const redeemerEnforcer = getChecksumContractAddress(\n    ENFORCER_CONTRACT_NAMES.RedeemerEnforcer,\n  );\n\n  return {\n    erc20StreamingEnforcer,\n    erc20PeriodicEnforcer,\n    nativeTokenStreamingEnforcer,\n    nativeTokenPeriodicEnforcer,\n    approvalRevocationEnforcer,\n    exactCalldataEnforcer,\n    valueLteEnforcer,\n    timestampEnforcer,\n    nonceEnforcer,\n    allowedCalldataEnforcer,\n    allowedTargetsEnforcer,\n    redeemerEnforcer,\n  };\n};\n\n/**\n * Extracts the expiry timestamp from TimestampEnforcer caveat terms.\n * Terms are 32 bytes: first 16 bytes timestampAfterThreshold (must be 0),\n * last 16 bytes timestampBeforeThreshold (expiry).\n *\n * @param terms - The hex-encoded terms from a TimestampEnforcer caveat.\n * @returns The expiry timestamp in seconds.\n * @throws If terms are invalid.\n */\nexport const extractExpiryFromCaveatTerms = (terms: Hex): number => {\n  if (terms.length !== 66) {\n    throw new Error(\n      `Invalid TimestampEnforcer terms length: expected 66 characters (0x + 64 hex), got ${terms.length}`,\n    );\n  }\n  const [after, before] = splitHex(terms, [16, 16]);\n  if (hexToNumber(after) !== 0) {\n    throw new Error('Invalid expiry: timestampAfterThreshold must be 0');\n  }\n  const expiry = hexToNumber(before);\n  if (expiry === 0) {\n    throw new Error(\n      'Invalid expiry: timestampBeforeThreshold must be greater than 0',\n    );\n  }\n  return expiry;\n};\n\n/**\n * Builds enforcer counts and set from caveat addresses (checksummed).\n * Used by caveatAddressesMatch.\n *\n * @param caveatAddresses - List of enforcer contract addresses (hex).\n * @returns Counts per enforcer and set of unique enforcers.\n */\nexport function buildEnforcerCountsAndSet(caveatAddresses: Hex[]): {\n  counts: Map<Hex, number>;\n  enforcersSet: Set<Hex>;\n} {\n  const counts = new Map<Hex, number>();\n  for (const addr of caveatAddresses.map(getChecksumAddress)) {\n    counts.set(addr, (counts.get(addr) ?? 0) + 1);\n  }\n  return { counts, enforcersSet: new Set(counts.keys()) };\n}\n\n/**\n * Returns true if the given counts/set match the rule (required counts exact,\n * no enforcer outside required + optional).\n *\n * @param counts - Map of enforcer address to occurrence count.\n * @param enforcersSet - Set of unique enforcer addresses present.\n * @param requiredEnforcers - Map of required enforcer to required count.\n * @param optionalEnforcers - Set of optional enforcer addresses.\n * @returns True if the counts match the rule.\n */\nexport function enforcersMatchRule(\n  counts: Map<Hex, number>,\n  enforcersSet: Set<Hex>,\n  requiredEnforcers: Map<Hex, number>,\n  optionalEnforcers: Set<Hex>,\n): boolean {\n  const allowedEnforcers = new Set<Hex>([\n    ...optionalEnforcers,\n    ...requiredEnforcers.keys(),\n  ]);\n  for (const addr of enforcersSet) {\n    if (!allowedEnforcers.has(addr)) {\n      return false;\n    }\n  }\n  for (const [addr, requiredCount] of requiredEnforcers.entries()) {\n    if ((counts.get(addr) ?? 0) !== requiredCount) {\n      return false;\n    }\n  }\n  return true;\n}\n\n/**\n * Gets the terms for a given enforcer from a list of caveats.\n *\n * @param args - The arguments to this function.\n * @param  args.throwIfNotFound - Whether to throw an error if no matching enforcer is found. Default is true.\n * @param args.caveats - The list of caveats to search.\n * @param args.enforcer - The enforcer to search for.\n * @returns The terms for the given enforcer.\n */\nexport function getTermsByEnforcer<TThrowIfNotFound extends boolean = true>({\n  caveats,\n  enforcer,\n  throwIfNotFound,\n}: {\n  caveats: Caveat<Hex>[];\n  enforcer: Hex;\n  throwIfNotFound?: TThrowIfNotFound;\n}): TThrowIfNotFound extends true ? Hex : Hex | null {\n  const matchingCaveats = caveats.filter(\n    (caveat) => caveat.enforcer === enforcer,\n  );\n\n  if (matchingCaveats.length === 0) {\n    if (throwIfNotFound ?? true) {\n      throw new Error('Invalid caveats');\n    }\n    return null as TThrowIfNotFound extends true ? Hex : Hex | null;\n  }\n\n  if (matchingCaveats.length > 1) {\n    throw new Error('Invalid caveats');\n  }\n\n  return matchingCaveats[0].terms;\n}\n\n/**\n * Splits a 0x-prefixed hex string into parts according to the provided byte lengths.\n *\n * Each entry in `lengths` represents a part length in bytes; internally this is\n * multiplied by 2 to derive the number of hexadecimal characters to slice. The\n * returned substrings do not include the `0x` prefix and preserve leading zeros.\n *\n * Note: This function does not perform input validation (e.g., verifying the\n * payload length equals the sum of requested lengths). Callers are expected to\n * provide well-formed inputs.\n *\n * Example:\n * splitHex('0x12345678', [1, 3]) => ['0x12', '0x345678']\n *\n * @param value - The 0x-prefixed hex string to split.\n * @param lengths - The lengths of each part, in bytes.\n * @returns An array of hex substrings (each with `0x` prefix), one for each part.\n */\nexport function splitHex(value: Hex, lengths: number[]): Hex[] {\n  let start = 2;\n  const parts: Hex[] = [];\n  for (const partLength of lengths) {\n    const partCharLength = partLength * 2;\n    const part = value.slice(start, start + partCharLength);\n    start += partCharLength;\n    parts.push(`0x${part}` as const);\n  }\n  return parts;\n}\n"]}

package/dist/decodePermission/utils.d.cts

@@ -1,5 +1,36 @@
 import type { Caveat } from "@metamask/delegation-core";
 import type { Hex } from "@metamask/utils";
+import type { ChecksumEnforcersByChainId, DeployedContractsByName } from "./types.cjs";
+/**
+ * 32 bytes of zero (0x + 64 hex chars).
+ */
+export declare const ZERO_32_BYTES: "0x0000000000000000000000000000000000000000000000000000000000000000";
+/**
+ * Maximum unsigned 256-bit integer encoded as 32 bytes (0x + 64 hex chars).
+ */
+export declare const UINT256_MAX: "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff";
+/** AllowedCalldataEnforcer terms for ERC20 approve selector. */
+export declare const ERC20_APPROVE_SELECTOR_TERMS: "0x0000000000000000000000000000000000000000000000000000000000000000095ea7b3";
+/** AllowedCalldataEnforcer terms for ERC20 approve zero amount. */
+export declare const ERC20_APPROVE_ZERO_AMOUNT_TERMS: "0x00000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000000000000000000000000000000000000000";
+/** Maximum period duration in seconds. */
+export declare const MAX_PERIOD_DURATION: number;
+/**
+ * Get the byte length of a hex string.
+ *
+ * @param hexString - The hex string to get the byte length of.
+ * @returns The byte length of the hex string.
+ */
+export declare const getByteLength: (hexString: Hex) => number;
+/**
+ * Resolves and returns checksummed addresses of all known enforcer contracts
+ * for a given `chainId` under the current delegation framework version.
+ *
+ * @param contracts - The deployed contracts for the chain.
+ * @returns An object mapping enforcer names to checksummed contract addresses.
+ * @throws If the chain or an expected enforcer contract is not found.
+ */
+export declare const getChecksumEnforcersByChainId: (contracts: DeployedContractsByName) => ChecksumEnforcersByChainId;
 /**
  * Extracts the expiry timestamp from TimestampEnforcer caveat terms.
  * Terms are 32 bytes: first 16 bytes timestampAfterThreshold (must be 0),

package/dist/decodePermission/utils.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.cts","sourceRoot":"","sources":["../../src/decodePermission/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,kCAAkC;AAExD,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,UAAW,GAAG,KAAG,MAiBzD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG;IACjE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;CACxB,CAMA;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EACxB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,EACtB,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EACnC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,GAC1B,OAAO,CAgBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,SAAS,OAAO,GAAG,IAAI,EAAE,EAC1E,OAAO,EACP,QAAQ,EACR,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvB,QAAQ,EAAE,GAAG,CAAC;IACd,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC,GAAG,gBAAgB,SAAS,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAiBnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAU7D"}
+{"version":3,"file":"utils.d.cts","sourceRoot":"","sources":["../../src/decodePermission/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,kCAAkC;AAExD,OAAO,KAAK,EAAE,GAAG,EAAE,wBAAwB;AAE3C,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACxB,oBAAmB;AAoBpB;;GAEG;AACH,eAAO,MAAM,aAAa,sEACqD,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,WAAW,sEACuD,CAAC;AAEhF,gEAAgE;AAChE,eAAO,MAAM,4BAA4B,8EAC8C,CAAC;AAExF,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,sIACmG,CAAC;AAEhJ,0CAA0C;AAC1C,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,aAAa,cAAe,GAAG,KAAG,MAE9C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,cAC7B,uBAAuB,KACjC,0BAoEF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,UAAW,GAAG,KAAG,MAiBzD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG;IACjE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;CACxB,CAMA;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EACxB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,EACtB,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EACnC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,GAC1B,OAAO,CAgBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,SAAS,OAAO,GAAG,IAAI,EAAE,EAC1E,OAAO,EACP,QAAQ,EACR,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvB,QAAQ,EAAE,GAAG,CAAC;IACd,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC,GAAG,gBAAgB,SAAS,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAiBnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAU7D"}

package/dist/decodePermission/utils.d.mts

@@ -1,5 +1,36 @@
 import type { Caveat } from "@metamask/delegation-core";
 import type { Hex } from "@metamask/utils";
+import type { ChecksumEnforcersByChainId, DeployedContractsByName } from "./types.mjs";
+/**
+ * 32 bytes of zero (0x + 64 hex chars).
+ */
+export declare const ZERO_32_BYTES: "0x0000000000000000000000000000000000000000000000000000000000000000";
+/**
+ * Maximum unsigned 256-bit integer encoded as 32 bytes (0x + 64 hex chars).
+ */
+export declare const UINT256_MAX: "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff";
+/** AllowedCalldataEnforcer terms for ERC20 approve selector. */
+export declare const ERC20_APPROVE_SELECTOR_TERMS: "0x0000000000000000000000000000000000000000000000000000000000000000095ea7b3";
+/** AllowedCalldataEnforcer terms for ERC20 approve zero amount. */
+export declare const ERC20_APPROVE_ZERO_AMOUNT_TERMS: "0x00000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000000000000000000000000000000000000000";
+/** Maximum period duration in seconds. */
+export declare const MAX_PERIOD_DURATION: number;
+/**
+ * Get the byte length of a hex string.
+ *
+ * @param hexString - The hex string to get the byte length of.
+ * @returns The byte length of the hex string.
+ */
+export declare const getByteLength: (hexString: Hex) => number;
+/**
+ * Resolves and returns checksummed addresses of all known enforcer contracts
+ * for a given `chainId` under the current delegation framework version.
+ *
+ * @param contracts - The deployed contracts for the chain.
+ * @returns An object mapping enforcer names to checksummed contract addresses.
+ * @throws If the chain or an expected enforcer contract is not found.
+ */
+export declare const getChecksumEnforcersByChainId: (contracts: DeployedContractsByName) => ChecksumEnforcersByChainId;
 /**
  * Extracts the expiry timestamp from TimestampEnforcer caveat terms.
  * Terms are 32 bytes: first 16 bytes timestampAfterThreshold (must be 0),