@metamask-previews/gator-permissions-controller 5.0.2-preview-4f4c98e → 5.0.2-preview-eb263b0ee

package/dist/constants.d.mts

@@ -0,0 +1,26 @@
+/**
+ * Delegation framework version used to select the correct deployed enforcer
+ * contract addresses from `@metamask/delegation-deployments`.
+ */
+export declare const DELEGATION_FRAMEWORK_VERSION = "1.3.0";
+/**
+ * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for
+ * redeemer allowlists (RedeemerEnforcer). Hosts should advertise this for every
+ * supported execution permission type.
+ */
+export declare const EXECUTION_PERMISSION_REDEEMER_RULE_TYPE: "redeemer";
+/**
+ * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for
+ * payee allowlists (AllowedCalldataEnforcer / AllowedTargetsEnforcer). Hosts
+ * should advertise this for every supported execution permission type that supports
+ * payee restrictions.
+ */
+export declare const EXECUTION_PERMISSION_PAYEE_RULE_TYPE: "payee";
+/**
+ * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for
+ * permission expiry derived from a TimestampEnforcer caveat. The decoded
+ * permission additionally hoists the expiry value onto its top-level `expiry`
+ * field for convenience.
+ */
+export declare const EXECUTION_PERMISSION_EXPIRY_RULE_TYPE: "expiry";
+//# sourceMappingURL=constants.d.mts.map

package/dist/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,4BAA4B,UAAU,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,YAAsB,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,SAAmB,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,UAAoB,CAAC"}

package/dist/{constants.js → constants.mjs}

@@ -23,4 +23,4 @@ export const EXECUTION_PERMISSION_PAYEE_RULE_TYPE = 'payee';
  * field for convenience.
  */
 export const EXECUTION_PERMISSION_EXPIRY_RULE_TYPE = 'expiry';
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=constants.mjs.map

package/dist/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,UAAmB,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,OAAgB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,QAAiB,CAAC","sourcesContent":["/**\n * Delegation framework version used to select the correct deployed enforcer\n * contract addresses from `@metamask/delegation-deployments`.\n */\nexport const DELEGATION_FRAMEWORK_VERSION = '1.3.0';\n\n/**\n * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for\n * redeemer allowlists (RedeemerEnforcer). Hosts should advertise this for every\n * supported execution permission type.\n */\nexport const EXECUTION_PERMISSION_REDEEMER_RULE_TYPE = 'redeemer' as const;\n\n/**\n * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for\n * payee allowlists (AllowedCalldataEnforcer / AllowedTargetsEnforcer). Hosts\n * should advertise this for every supported execution permission type that supports\n * payee restrictions.\n */\nexport const EXECUTION_PERMISSION_PAYEE_RULE_TYPE = 'payee' as const;\n\n/**\n * `Rule.type` / `wallet_getSupportedExecutionPermissions` `ruleTypes` entry for\n * permission expiry derived from a TimestampEnforcer caveat. The decoded\n * permission additionally hoists the expiry value onto its top-level `expiry`\n * field for convenience.\n */\nexport const EXECUTION_PERMISSION_EXPIRY_RULE_TYPE = 'expiry' as const;\n"]}

package/dist/decodePermission/decodePermission.cjs

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconstructDecodedPermission = exports.selectUniqueDecoderAndDecodedPermission = exports.findDecodersWithMatchingCaveatAddresses = void 0;
+const delegation_core_1 = require("@metamask/delegation-core");
+const utils_1 = require("@metamask/utils");
+/**
+ * Returns every permission decoder whose caveat-address pattern matches the
+ * given enforcer list for the chain. Used when more than one permission type
+ * can share the same enforcer set; the caller must disambiguate by validating
+ * caveat terms (see {@link selectUniqueDecoderAndDecodedPermission}).
+ *
+ * @param args - The arguments to this function.
+ * @param args.enforcers - List of enforcer contract addresses (hex strings).
+ * @param args.permissionDecoders - The permission decoders for the chain.
+ * @returns All decoders that match, possibly empty.
+ */
+const findDecodersWithMatchingCaveatAddresses = ({ enforcers, permissionDecoders, }) => {
+    return permissionDecoders.filter((decoder) => decoder.caveatAddressesMatch(enforcers));
+};
+exports.findDecodersWithMatchingCaveatAddresses = findDecodersWithMatchingCaveatAddresses;
+/**
+ * Runs {@link PermissionDecoder.validateAndDecodePermission} on each candidate
+ * decoder. Use when several decoders share the same caveat addresses.
+ *
+ * @param args - The arguments to this function.
+ * @param args.candidateDecoders - Decoders whose addresses already match the caveats.
+ * @param args.caveats - Caveats from the delegation.
+ * @returns The unique decoder and decoded expiry/data when exactly one decoder validates.
+ * @throws If `candidateDecoders` is empty, if no decoder validates, or if more than one decoder validates.
+ */
+const selectUniqueDecoderAndDecodedPermission = ({ candidateDecoders, caveats, }) => {
+    if (candidateDecoders.length === 0) {
+        throw new Error('Unable to identify permission type');
+    }
+    const successfulDecodingResult = [];
+    const failedAttempts = [];
+    for (const decoder of candidateDecoders) {
+        const decodeResult = decoder.validateAndDecodePermission(caveats);
+        if (decodeResult.isValid) {
+            successfulDecodingResult.push({
+                decoder,
+                rules: decodeResult.rules,
+                data: decodeResult.data,
+                expiry: decodeResult.expiry,
+            });
+        }
+        else {
+            failedAttempts.push({
+                permissionType: decoder.permissionType,
+                error: decodeResult.error,
+            });
+        }
+    }
+    if (successfulDecodingResult.length === 1) {
+        return successfulDecodingResult[0];
+    }
+    if (successfulDecodingResult.length > 1) {
+        const types = successfulDecodingResult
+            .map((result) => result.decoder.permissionType)
+            .join(', ');
+        throw new Error(`Multiple permission types validate the same delegation caveats: ${types}`);
+    }
+    if (failedAttempts.length === 1) {
+        throw failedAttempts[0].error;
+    }
+    const details = failedAttempts
+        .map((attempt) => `${String(attempt.permissionType)}: ${attempt.error.message}`)
+        .join('; ');
+    throw new Error(`No permission type could validate the delegation caveats. Attempts: ${details}`);
+};
+exports.selectUniqueDecoderAndDecodedPermission = selectUniqueDecoderAndDecodedPermission;
+/**
+ * Reconstructs a {@link DecodedPermission} object from primitive values
+ * obtained while decoding a permission context.
+ *
+ * @param args - The arguments to this function.
+ * @param args.chainId - Chain ID.
+ * @param args.permissionType - Identified permission type.
+ * @param args.delegator - Address of the account delegating permission.
+ * @param args.delegate - Address that will act under the granted permission.
+ * @param args.authority - Authority identifier; must be ROOT_AUTHORITY.
+ * @param args.expiry - Expiry timestamp (unix seconds) or null if unbounded.
+ * @param args.data - Permission-specific decoded data payload.
+ * @param args.justification - Human-readable justification for the permission.
+ * @param args.specifiedOrigin - The origin reported in the request metadata.
+ * @param args.rules - Rules recovered from caveats (e.g. redeemer allowlist).
+ *
+ * @returns The reconstructed {@link DecodedPermission}.
+ */
+const reconstructDecodedPermission = ({ chainId, permissionType, delegator, delegate, authority, expiry, data, justification, specifiedOrigin, rules, }) => {
+    if (authority !== delegation_core_1.ROOT_AUTHORITY) {
+        throw new Error('Invalid authority');
+    }
+    const permission = {
+        chainId: (0, utils_1.numberToHex)(chainId),
+        from: delegator,
+        to: delegate,
+        permission: {
+            type: permissionType,
+            data,
+            justification,
+        },
+        expiry,
+        origin: specifiedOrigin,
+        ...(rules === undefined ? {} : { rules }),
+    };
+    return permission;
+};
+exports.reconstructDecodedPermission = reconstructDecodedPermission;
+//# sourceMappingURL=decodePermission.cjs.map

package/dist/decodePermission/decodePermission.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"decodePermission.cjs","sourceRoot":"","sources":["../../src/decodePermission/decodePermission.ts"],"names":[],"mappings":";;;AACA,+DAA2D;AAC3D,2CAA8C;AAS9C;;;;;;;;;;GAUG;AACI,MAAM,uCAAuC,GAAG,CAAC,EACtD,SAAS,EACT,kBAAkB,GAInB,EAAuB,EAAE;IACxB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CACxC,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,uCAAuC,2CAUlD;AAcF;;;;;;;;;GASG;AACI,MAAM,uCAAuC,GAAG,CAAC,EACtD,iBAAiB,EACjB,OAAO,GAIR,EAA+B,EAAE;IAChC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,wBAAwB,GAAkC,EAAE,CAAC;IAEnE,MAAM,cAAc,GAAuD,EAAE,CAAC;IAE9E,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,wBAAwB,CAAC,IAAI,CAAC;gBAC5B,OAAO;gBACP,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,IAAI,CAAC;gBAClB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,KAAK,EAAE,YAAY,CAAC,KAAK;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,wBAAwB;aACnC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,cAAc;SAC3B,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,IAAI,KAAK,CACb,uEAAuE,OAAO,EAAE,CACjF,CAAC;AACJ,CAAC,CAAC;AA3DW,QAAA,uCAAuC,2CA2DlD;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,4BAA4B,GAAG,CAAC,EAC3C,OAAO,EACP,cAAc,EACd,SAAS,EACT,QAAQ,EACR,SAAS,EACT,MAAM,EACN,IAAI,EACJ,aAAa,EACb,eAAe,EACf,KAAK,GAYN,EAAqB,EAAE;IACtB,IAAI,SAAS,KAAK,gCAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAsB;QACpC,OAAO,EAAE,IAAA,mBAAW,EAAC,OAAO,CAAC;QAC7B,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE;YACV,IAAI,EAAE,cAAc;YACpB,IAAI;YACJ,aAAa;SACd;QACD,MAAM;QACN,MAAM,EAAE,eAAe;QACvB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;IAEF,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AA1CW,QAAA,4BAA4B,gCA0CvC","sourcesContent":["import type { Caveat, Hex } from '@metamask/delegation-core';\nimport { ROOT_AUTHORITY } from '@metamask/delegation-core';\nimport { numberToHex } from '@metamask/utils';\n\nimport type {\n  DecodedPermission,\n  PermissionType,\n  PermissionDecoder,\n  ValidateAndDecodeResult,\n} from './types.js';\n\n/**\n * Returns every permission decoder whose caveat-address pattern matches the\n * given enforcer list for the chain. Used when more than one permission type\n * can share the same enforcer set; the caller must disambiguate by validating\n * caveat terms (see {@link selectUniqueDecoderAndDecodedPermission}).\n *\n * @param args - The arguments to this function.\n * @param args.enforcers - List of enforcer contract addresses (hex strings).\n * @param args.permissionDecoders - The permission decoders for the chain.\n * @returns All decoders that match, possibly empty.\n */\nexport const findDecodersWithMatchingCaveatAddresses = ({\n  enforcers,\n  permissionDecoders,\n}: {\n  enforcers: Hex[];\n  permissionDecoders: PermissionDecoder[];\n}): PermissionDecoder[] => {\n  return permissionDecoders.filter((decoder) =>\n    decoder.caveatAddressesMatch(enforcers),\n  );\n};\n\ntype SuccessfulValidateAndDecodeResult = Extract<\n  ValidateAndDecodeResult,\n  { isValid: true }\n>;\n\ntype DecoderAndDecodedPermission = {\n  decoder: PermissionDecoder;\n  rules: SuccessfulValidateAndDecodeResult['rules'];\n  data: SuccessfulValidateAndDecodeResult['data'];\n  expiry: SuccessfulValidateAndDecodeResult['expiry'];\n};\n\n/**\n * Runs {@link PermissionDecoder.validateAndDecodePermission} on each candidate\n * decoder. Use when several decoders share the same caveat addresses.\n *\n * @param args - The arguments to this function.\n * @param args.candidateDecoders - Decoders whose addresses already match the caveats.\n * @param args.caveats - Caveats from the delegation.\n * @returns The unique decoder and decoded expiry/data when exactly one decoder validates.\n * @throws If `candidateDecoders` is empty, if no decoder validates, or if more than one decoder validates.\n */\nexport const selectUniqueDecoderAndDecodedPermission = ({\n  candidateDecoders,\n  caveats,\n}: {\n  candidateDecoders: PermissionDecoder[];\n  caveats: Caveat<Hex>[];\n}): DecoderAndDecodedPermission => {\n  if (candidateDecoders.length === 0) {\n    throw new Error('Unable to identify permission type');\n  }\n\n  const successfulDecodingResult: DecoderAndDecodedPermission[] = [];\n\n  const failedAttempts: { permissionType: PermissionType; error: Error }[] = [];\n\n  for (const decoder of candidateDecoders) {\n    const decodeResult = decoder.validateAndDecodePermission(caveats);\n    if (decodeResult.isValid) {\n      successfulDecodingResult.push({\n        decoder,\n        rules: decodeResult.rules,\n        data: decodeResult.data,\n        expiry: decodeResult.expiry,\n      });\n    } else {\n      failedAttempts.push({\n        permissionType: decoder.permissionType,\n        error: decodeResult.error,\n      });\n    }\n  }\n\n  if (successfulDecodingResult.length === 1) {\n    return successfulDecodingResult[0];\n  }\n\n  if (successfulDecodingResult.length > 1) {\n    const types = successfulDecodingResult\n      .map((result) => result.decoder.permissionType)\n      .join(', ');\n    throw new Error(\n      `Multiple permission types validate the same delegation caveats: ${types}`,\n    );\n  }\n\n  if (failedAttempts.length === 1) {\n    throw failedAttempts[0].error;\n  }\n\n  const details = failedAttempts\n    .map(\n      (attempt) =>\n        `${String(attempt.permissionType)}: ${attempt.error.message}`,\n    )\n    .join('; ');\n\n  throw new Error(\n    `No permission type could validate the delegation caveats. Attempts: ${details}`,\n  );\n};\n\n/**\n * Reconstructs a {@link DecodedPermission} object from primitive values\n * obtained while decoding a permission context.\n *\n * @param args - The arguments to this function.\n * @param args.chainId - Chain ID.\n * @param args.permissionType - Identified permission type.\n * @param args.delegator - Address of the account delegating permission.\n * @param args.delegate - Address that will act under the granted permission.\n * @param args.authority - Authority identifier; must be ROOT_AUTHORITY.\n * @param args.expiry - Expiry timestamp (unix seconds) or null if unbounded.\n * @param args.data - Permission-specific decoded data payload.\n * @param args.justification - Human-readable justification for the permission.\n * @param args.specifiedOrigin - The origin reported in the request metadata.\n * @param args.rules - Rules recovered from caveats (e.g. redeemer allowlist).\n *\n * @returns The reconstructed {@link DecodedPermission}.\n */\nexport const reconstructDecodedPermission = ({\n  chainId,\n  permissionType,\n  delegator,\n  delegate,\n  authority,\n  expiry,\n  data,\n  justification,\n  specifiedOrigin,\n  rules,\n}: {\n  chainId: number;\n  permissionType: PermissionType;\n  delegator: Hex;\n  delegate: Hex;\n  authority: Hex;\n  expiry: number | null;\n  data: DecodedPermission['permission']['data'];\n  justification: string;\n  specifiedOrigin: string;\n  rules?: DecodedPermission['rules'];\n}): DecodedPermission => {\n  if (authority !== ROOT_AUTHORITY) {\n    throw new Error('Invalid authority');\n  }\n\n  const permission: DecodedPermission = {\n    chainId: numberToHex(chainId),\n    from: delegator,\n    to: delegate,\n    permission: {\n      type: permissionType,\n      data,\n      justification,\n    },\n    expiry,\n    origin: specifiedOrigin,\n    ...(rules === undefined ? {} : { rules }),\n  };\n\n  return permission;\n};\n"]}

package/dist/decodePermission/{decodePermission.d.ts → decodePermission.d.cts}

@@ -1,5 +1,5 @@
-import type { Caveat, Hex } from '@metamask/delegation-core';
-import type { DecodedPermission, PermissionType, PermissionDecoder, ValidateAndDecodeResult } from './types.js';
+import type { Caveat, Hex } from "@metamask/delegation-core";
+import type { DecodedPermission, PermissionType, PermissionDecoder, ValidateAndDecodeResult } from "./types.cjs";
 /**
  * Returns every permission decoder whose caveat-address pattern matches the
  * given enforcer list for the chain. Used when more than one permission type
@@ -69,4 +69,4 @@ export declare const reconstructDecodedPermission: ({ chainId, permissionType, d
     rules?: DecodedPermission['rules'];
 }) => DecodedPermission;
 export {};
-//# sourceMappingURL=decodePermission.d.ts.map
+//# sourceMappingURL=decodePermission.d.cts.map

package/dist/decodePermission/decodePermission.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decodePermission.d.cts","sourceRoot":"","sources":["../../src/decodePermission/decodePermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kCAAkC;AAI7D,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACxB,oBAAmB;AAEpB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;eAIvC,GAAG,EAAE;wBACI,iBAAiB,EAAE;MACrC,iBAAiB,EAIpB,CAAC;AAEF,KAAK,iCAAiC,GAAG,OAAO,CAC9C,uBAAuB,EACvB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,EAAE,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;uBAI/B,iBAAiB,EAAE;aAC7B,OAAO,GAAG,CAAC,EAAE;MACpB,2BAqDH,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B;aAY9B,MAAM;oBACC,cAAc;eACnB,GAAG;cACJ,GAAG;eACF,GAAG;YACN,MAAM,GAAG,IAAI;UACf,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;mBAC9B,MAAM;qBACJ,MAAM;YACf,iBAAiB,CAAC,OAAO,CAAC;MAChC,iBAoBH,CAAC"}

package/dist/decodePermission/decodePermission.d.mts

@@ -0,0 +1,72 @@
+import type { Caveat, Hex } from "@metamask/delegation-core";
+import type { DecodedPermission, PermissionType, PermissionDecoder, ValidateAndDecodeResult } from "./types.mjs";
+/**
+ * Returns every permission decoder whose caveat-address pattern matches the
+ * given enforcer list for the chain. Used when more than one permission type
+ * can share the same enforcer set; the caller must disambiguate by validating
+ * caveat terms (see {@link selectUniqueDecoderAndDecodedPermission}).
+ *
+ * @param args - The arguments to this function.
+ * @param args.enforcers - List of enforcer contract addresses (hex strings).
+ * @param args.permissionDecoders - The permission decoders for the chain.
+ * @returns All decoders that match, possibly empty.
+ */
+export declare const findDecodersWithMatchingCaveatAddresses: ({ enforcers, permissionDecoders, }: {
+    enforcers: Hex[];
+    permissionDecoders: PermissionDecoder[];
+}) => PermissionDecoder[];
+type SuccessfulValidateAndDecodeResult = Extract<ValidateAndDecodeResult, {
+    isValid: true;
+}>;
+type DecoderAndDecodedPermission = {
+    decoder: PermissionDecoder;
+    rules: SuccessfulValidateAndDecodeResult['rules'];
+    data: SuccessfulValidateAndDecodeResult['data'];
+    expiry: SuccessfulValidateAndDecodeResult['expiry'];
+};
+/**
+ * Runs {@link PermissionDecoder.validateAndDecodePermission} on each candidate
+ * decoder. Use when several decoders share the same caveat addresses.
+ *
+ * @param args - The arguments to this function.
+ * @param args.candidateDecoders - Decoders whose addresses already match the caveats.
+ * @param args.caveats - Caveats from the delegation.
+ * @returns The unique decoder and decoded expiry/data when exactly one decoder validates.
+ * @throws If `candidateDecoders` is empty, if no decoder validates, or if more than one decoder validates.
+ */
+export declare const selectUniqueDecoderAndDecodedPermission: ({ candidateDecoders, caveats, }: {
+    candidateDecoders: PermissionDecoder[];
+    caveats: Caveat<Hex>[];
+}) => DecoderAndDecodedPermission;
+/**
+ * Reconstructs a {@link DecodedPermission} object from primitive values
+ * obtained while decoding a permission context.
+ *
+ * @param args - The arguments to this function.
+ * @param args.chainId - Chain ID.
+ * @param args.permissionType - Identified permission type.
+ * @param args.delegator - Address of the account delegating permission.
+ * @param args.delegate - Address that will act under the granted permission.
+ * @param args.authority - Authority identifier; must be ROOT_AUTHORITY.
+ * @param args.expiry - Expiry timestamp (unix seconds) or null if unbounded.
+ * @param args.data - Permission-specific decoded data payload.
+ * @param args.justification - Human-readable justification for the permission.
+ * @param args.specifiedOrigin - The origin reported in the request metadata.
+ * @param args.rules - Rules recovered from caveats (e.g. redeemer allowlist).
+ *
+ * @returns The reconstructed {@link DecodedPermission}.
+ */
+export declare const reconstructDecodedPermission: ({ chainId, permissionType, delegator, delegate, authority, expiry, data, justification, specifiedOrigin, rules, }: {
+    chainId: number;
+    permissionType: PermissionType;
+    delegator: Hex;
+    delegate: Hex;
+    authority: Hex;
+    expiry: number | null;
+    data: DecodedPermission['permission']['data'];
+    justification: string;
+    specifiedOrigin: string;
+    rules?: DecodedPermission['rules'];
+}) => DecodedPermission;
+export {};
+//# sourceMappingURL=decodePermission.d.mts.map

package/dist/decodePermission/decodePermission.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decodePermission.d.mts","sourceRoot":"","sources":["../../src/decodePermission/decodePermission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kCAAkC;AAI7D,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACxB,oBAAmB;AAEpB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;eAIvC,GAAG,EAAE;wBACI,iBAAiB,EAAE;MACrC,iBAAiB,EAIpB,CAAC;AAEF,KAAK,iCAAiC,GAAG,OAAO,CAC9C,uBAAuB,EACvB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,EAAE,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;uBAI/B,iBAAiB,EAAE;aAC7B,OAAO,GAAG,CAAC,EAAE;MACpB,2BAqDH,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B;aAY9B,MAAM;oBACC,cAAc;eACnB,GAAG;cACJ,GAAG;eACF,GAAG;YACN,MAAM,GAAG,IAAI;UACf,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;mBAC9B,MAAM;qBACJ,MAAM;YACf,iBAAiB,CAAC,OAAO,CAAC;MAChC,iBAoBH,CAAC"}

package/dist/decodePermission/{decodePermission.js → decodePermission.mjs}

@@ -1,5 +1,5 @@
-import { ROOT_AUTHORITY } from '@metamask/delegation-core';
-import { numberToHex } from '@metamask/utils';
+import { ROOT_AUTHORITY } from "@metamask/delegation-core";
+import { numberToHex } from "@metamask/utils";
 /**
  * Returns every permission decoder whose caveat-address pattern matches the
  * given enforcer list for the chain. Used when more than one permission type
@@ -101,4 +101,4 @@ export const reconstructDecodedPermission = ({ chainId, permissionType, delegato
     };
     return permission;
 };
-//# sourceMappingURL=decodePermission.js.map
+//# sourceMappingURL=decodePermission.mjs.map

package/dist/decodePermission/decodePermission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"decodePermission.mjs","sourceRoot":"","sources":["../../src/decodePermission/decodePermission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,EAAE,WAAW,EAAE,wBAAwB;AAS9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,EACtD,SAAS,EACT,kBAAkB,GAInB,EAAuB,EAAE;IACxB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CACxC,CAAC;AACJ,CAAC,CAAC;AAcF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,EACtD,iBAAiB,EACjB,OAAO,GAIR,EAA+B,EAAE;IAChC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,wBAAwB,GAAkC,EAAE,CAAC;IAEnE,MAAM,cAAc,GAAuD,EAAE,CAAC;IAE9E,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,wBAAwB,CAAC,IAAI,CAAC;gBAC5B,OAAO;gBACP,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,IAAI,CAAC;gBAClB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,KAAK,EAAE,YAAY,CAAC,KAAK;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,wBAAwB;aACnC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,cAAc;SAC3B,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,IAAI,KAAK,CACb,uEAAuE,OAAO,EAAE,CACjF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,EAC3C,OAAO,EACP,cAAc,EACd,SAAS,EACT,QAAQ,EACR,SAAS,EACT,MAAM,EACN,IAAI,EACJ,aAAa,EACb,eAAe,EACf,KAAK,GAYN,EAAqB,EAAE;IACtB,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAsB;QACpC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;QAC7B,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE;YACV,IAAI,EAAE,cAAc;YACpB,IAAI;YACJ,aAAa;SACd;QACD,MAAM;QACN,MAAM,EAAE,eAAe;QACvB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;IAEF,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC","sourcesContent":["import type { Caveat, Hex } from '@metamask/delegation-core';\nimport { ROOT_AUTHORITY } from '@metamask/delegation-core';\nimport { numberToHex } from '@metamask/utils';\n\nimport type {\n  DecodedPermission,\n  PermissionType,\n  PermissionDecoder,\n  ValidateAndDecodeResult,\n} from './types.js';\n\n/**\n * Returns every permission decoder whose caveat-address pattern matches the\n * given enforcer list for the chain. Used when more than one permission type\n * can share the same enforcer set; the caller must disambiguate by validating\n * caveat terms (see {@link selectUniqueDecoderAndDecodedPermission}).\n *\n * @param args - The arguments to this function.\n * @param args.enforcers - List of enforcer contract addresses (hex strings).\n * @param args.permissionDecoders - The permission decoders for the chain.\n * @returns All decoders that match, possibly empty.\n */\nexport const findDecodersWithMatchingCaveatAddresses = ({\n  enforcers,\n  permissionDecoders,\n}: {\n  enforcers: Hex[];\n  permissionDecoders: PermissionDecoder[];\n}): PermissionDecoder[] => {\n  return permissionDecoders.filter((decoder) =>\n    decoder.caveatAddressesMatch(enforcers),\n  );\n};\n\ntype SuccessfulValidateAndDecodeResult = Extract<\n  ValidateAndDecodeResult,\n  { isValid: true }\n>;\n\ntype DecoderAndDecodedPermission = {\n  decoder: PermissionDecoder;\n  rules: SuccessfulValidateAndDecodeResult['rules'];\n  data: SuccessfulValidateAndDecodeResult['data'];\n  expiry: SuccessfulValidateAndDecodeResult['expiry'];\n};\n\n/**\n * Runs {@link PermissionDecoder.validateAndDecodePermission} on each candidate\n * decoder. Use when several decoders share the same caveat addresses.\n *\n * @param args - The arguments to this function.\n * @param args.candidateDecoders - Decoders whose addresses already match the caveats.\n * @param args.caveats - Caveats from the delegation.\n * @returns The unique decoder and decoded expiry/data when exactly one decoder validates.\n * @throws If `candidateDecoders` is empty, if no decoder validates, or if more than one decoder validates.\n */\nexport const selectUniqueDecoderAndDecodedPermission = ({\n  candidateDecoders,\n  caveats,\n}: {\n  candidateDecoders: PermissionDecoder[];\n  caveats: Caveat<Hex>[];\n}): DecoderAndDecodedPermission => {\n  if (candidateDecoders.length === 0) {\n    throw new Error('Unable to identify permission type');\n  }\n\n  const successfulDecodingResult: DecoderAndDecodedPermission[] = [];\n\n  const failedAttempts: { permissionType: PermissionType; error: Error }[] = [];\n\n  for (const decoder of candidateDecoders) {\n    const decodeResult = decoder.validateAndDecodePermission(caveats);\n    if (decodeResult.isValid) {\n      successfulDecodingResult.push({\n        decoder,\n        rules: decodeResult.rules,\n        data: decodeResult.data,\n        expiry: decodeResult.expiry,\n      });\n    } else {\n      failedAttempts.push({\n        permissionType: decoder.permissionType,\n        error: decodeResult.error,\n      });\n    }\n  }\n\n  if (successfulDecodingResult.length === 1) {\n    return successfulDecodingResult[0];\n  }\n\n  if (successfulDecodingResult.length > 1) {\n    const types = successfulDecodingResult\n      .map((result) => result.decoder.permissionType)\n      .join(', ');\n    throw new Error(\n      `Multiple permission types validate the same delegation caveats: ${types}`,\n    );\n  }\n\n  if (failedAttempts.length === 1) {\n    throw failedAttempts[0].error;\n  }\n\n  const details = failedAttempts\n    .map(\n      (attempt) =>\n        `${String(attempt.permissionType)}: ${attempt.error.message}`,\n    )\n    .join('; ');\n\n  throw new Error(\n    `No permission type could validate the delegation caveats. Attempts: ${details}`,\n  );\n};\n\n/**\n * Reconstructs a {@link DecodedPermission} object from primitive values\n * obtained while decoding a permission context.\n *\n * @param args - The arguments to this function.\n * @param args.chainId - Chain ID.\n * @param args.permissionType - Identified permission type.\n * @param args.delegator - Address of the account delegating permission.\n * @param args.delegate - Address that will act under the granted permission.\n * @param args.authority - Authority identifier; must be ROOT_AUTHORITY.\n * @param args.expiry - Expiry timestamp (unix seconds) or null if unbounded.\n * @param args.data - Permission-specific decoded data payload.\n * @param args.justification - Human-readable justification for the permission.\n * @param args.specifiedOrigin - The origin reported in the request metadata.\n * @param args.rules - Rules recovered from caveats (e.g. redeemer allowlist).\n *\n * @returns The reconstructed {@link DecodedPermission}.\n */\nexport const reconstructDecodedPermission = ({\n  chainId,\n  permissionType,\n  delegator,\n  delegate,\n  authority,\n  expiry,\n  data,\n  justification,\n  specifiedOrigin,\n  rules,\n}: {\n  chainId: number;\n  permissionType: PermissionType;\n  delegator: Hex;\n  delegate: Hex;\n  authority: Hex;\n  expiry: number | null;\n  data: DecodedPermission['permission']['data'];\n  justification: string;\n  specifiedOrigin: string;\n  rules?: DecodedPermission['rules'];\n}): DecodedPermission => {\n  if (authority !== ROOT_AUTHORITY) {\n    throw new Error('Invalid authority');\n  }\n\n  const permission: DecodedPermission = {\n    chainId: numberToHex(chainId),\n    from: delegator,\n    to: delegate,\n    permission: {\n      type: permissionType,\n      data,\n      justification,\n    },\n    expiry,\n    origin: specifiedOrigin,\n    ...(rules === undefined ? {} : { rules }),\n  };\n\n  return permission;\n};\n"]}

package/dist/decodePermission/decoders/index.cjs

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPermissionDecodersForContracts = void 0;
+const _7715_permission_types_1 = require("@metamask/7715-permission-types");
+const makePermissionDecoder_js_1 = require("./makePermissionDecoder.cjs");
+/**
+ * Builds the canonical set of permission decoders for a chain.
+ *
+ * Each decoder specifies the `permissionType`, required/optional enforcers,
+ * and provides `caveatAddressesMatch` and `validateAndDecodePermission` so the
+ * entire decode flow can be driven by the decoders.
+ *
+ * `contracts` should already be checksummed (see {@link toEnforcerAddressesByName}).
+ * `makePermissionDecoderConfigs` checksums them again, and {@link makePermissionDecoder}
+ * normalizes enforcer sets once more — see the module comment in
+ * `makePermissionDecoder.ts` for why checksumming is layered this way.
+ *
+ * @param contracts - The deployed enforcer addresses for the chain.
+ * @returns A list of permission decoders used to identify and decode permission types.
+ * @throws Propagates any errors from resolving enforcer addresses.
+ */
+const createPermissionDecodersForContracts = (contracts) => {
+    return (0, _7715_permission_types_1.makePermissionDecoderConfigs)(contracts).map(makePermissionDecoder_js_1.makePermissionDecoder);
+};
+exports.createPermissionDecodersForContracts = createPermissionDecodersForContracts;
+//# sourceMappingURL=index.cjs.map

package/dist/decodePermission/decoders/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sourceRoot":"","sources":["../../../src/decodePermission/decoders/index.ts"],"names":[],"mappings":";;;AAAA,4EAA+E;AAI/E,0EAAmE;AAEnE;;;;;;;;;;;;;;;GAeG;AACI,MAAM,oCAAoC,GAAG,CAClD,SAAkC,EACb,EAAE;IACvB,OAAO,IAAA,qDAA4B,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gDAAqB,CAAC,CAAC;AAC5E,CAAC,CAAC;AAJW,QAAA,oCAAoC,wCAI/C","sourcesContent":["import { makePermissionDecoderConfigs } from '@metamask/7715-permission-types';\nimport type { EnforcerAddressesByName } from '@metamask/7715-permission-types';\n\nimport type { PermissionDecoder } from '../types.js';\nimport { makePermissionDecoder } from './makePermissionDecoder.js';\n\n/**\n * Builds the canonical set of permission decoders for a chain.\n *\n * Each decoder specifies the `permissionType`, required/optional enforcers,\n * and provides `caveatAddressesMatch` and `validateAndDecodePermission` so the\n * entire decode flow can be driven by the decoders.\n *\n * `contracts` should already be checksummed (see {@link toEnforcerAddressesByName}).\n * `makePermissionDecoderConfigs` checksums them again, and {@link makePermissionDecoder}\n * normalizes enforcer sets once more — see the module comment in\n * `makePermissionDecoder.ts` for why checksumming is layered this way.\n *\n * @param contracts - The deployed enforcer addresses for the chain.\n * @returns A list of permission decoders used to identify and decode permission types.\n * @throws Propagates any errors from resolving enforcer addresses.\n */\nexport const createPermissionDecodersForContracts = (\n  contracts: EnforcerAddressesByName,\n): PermissionDecoder[] => {\n  return makePermissionDecoderConfigs(contracts).map(makePermissionDecoder);\n};\n"]}

package/dist/decodePermission/decoders/{index.d.ts → index.d.cts}

@@ -1,5 +1,5 @@
-import type { EnforcerAddressesByName } from '@metamask/7715-permission-types';
-import type { PermissionDecoder } from '../types.js';
+import type { EnforcerAddressesByName } from "@metamask/7715-permission-types";
+import type { PermissionDecoder } from "../types.cjs";
 /**
  * Builds the canonical set of permission decoders for a chain.
  *
@@ -17,4 +17,4 @@ import type { PermissionDecoder } from '../types.js';
  * @throws Propagates any errors from resolving enforcer addresses.
  */
 export declare const createPermissionDecodersForContracts: (contracts: EnforcerAddressesByName) => PermissionDecoder[];
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=index.d.cts.map

package/dist/decodePermission/decoders/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../../../src/decodePermission/decoders/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,wCAAwC;AAE/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAoB;AAGrD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oCAAoC,cACpC,uBAAuB,KACjC,iBAAiB,EAEnB,CAAC"}

package/dist/decodePermission/decoders/index.d.mts

@@ -0,0 +1,20 @@
+import type { EnforcerAddressesByName } from "@metamask/7715-permission-types";
+import type { PermissionDecoder } from "../types.mjs";
+/**
+ * Builds the canonical set of permission decoders for a chain.
+ *
+ * Each decoder specifies the `permissionType`, required/optional enforcers,
+ * and provides `caveatAddressesMatch` and `validateAndDecodePermission` so the
+ * entire decode flow can be driven by the decoders.
+ *
+ * `contracts` should already be checksummed (see {@link toEnforcerAddressesByName}).
+ * `makePermissionDecoderConfigs` checksums them again, and {@link makePermissionDecoder}
+ * normalizes enforcer sets once more — see the module comment in
+ * `makePermissionDecoder.ts` for why checksumming is layered this way.
+ *
+ * @param contracts - The deployed enforcer addresses for the chain.
+ * @returns A list of permission decoders used to identify and decode permission types.
+ * @throws Propagates any errors from resolving enforcer addresses.
+ */
+export declare const createPermissionDecodersForContracts: (contracts: EnforcerAddressesByName) => PermissionDecoder[];
+//# sourceMappingURL=index.d.mts.map

package/dist/decodePermission/decoders/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/decodePermission/decoders/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,wCAAwC;AAE/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAoB;AAGrD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oCAAoC,cACpC,uBAAuB,KACjC,iBAAiB,EAEnB,CAAC"}

package/dist/decodePermission/decoders/{index.js → index.mjs}

@@ -1,5 +1,5 @@
-import { makePermissionDecoderConfigs } from '@metamask/7715-permission-types';
-import { makePermissionDecoder } from './makePermissionDecoder.js';
+import { makePermissionDecoderConfigs } from "@metamask/7715-permission-types";
+import { makePermissionDecoder } from "./makePermissionDecoder.mjs";
 /**
  * Builds the canonical set of permission decoders for a chain.
  *
@@ -19,4 +19,4 @@ import { makePermissionDecoder } from './makePermissionDecoder.js';
 export const createPermissionDecodersForContracts = (contracts) => {
     return makePermissionDecoderConfigs(contracts).map(makePermissionDecoder);
 };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.mjs.map

package/dist/decodePermission/decoders/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/decodePermission/decoders/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,wCAAwC;AAI/E,OAAO,EAAE,qBAAqB,EAAE,oCAAmC;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAkC,EACb,EAAE;IACvB,OAAO,4BAA4B,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAC5E,CAAC,CAAC","sourcesContent":["import { makePermissionDecoderConfigs } from '@metamask/7715-permission-types';\nimport type { EnforcerAddressesByName } from '@metamask/7715-permission-types';\n\nimport type { PermissionDecoder } from '../types.js';\nimport { makePermissionDecoder } from './makePermissionDecoder.js';\n\n/**\n * Builds the canonical set of permission decoders for a chain.\n *\n * Each decoder specifies the `permissionType`, required/optional enforcers,\n * and provides `caveatAddressesMatch` and `validateAndDecodePermission` so the\n * entire decode flow can be driven by the decoders.\n *\n * `contracts` should already be checksummed (see {@link toEnforcerAddressesByName}).\n * `makePermissionDecoderConfigs` checksums them again, and {@link makePermissionDecoder}\n * normalizes enforcer sets once more — see the module comment in\n * `makePermissionDecoder.ts` for why checksumming is layered this way.\n *\n * @param contracts - The deployed enforcer addresses for the chain.\n * @returns A list of permission decoders used to identify and decode permission types.\n * @throws Propagates any errors from resolving enforcer addresses.\n */\nexport const createPermissionDecodersForContracts = (\n  contracts: EnforcerAddressesByName,\n): PermissionDecoder[] => {\n  return makePermissionDecoderConfigs(contracts).map(makePermissionDecoder);\n};\n"]}

package/dist/decodePermission/decoders/makePermissionDecoder.cjs

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makePermissionDecoder = void 0;
+const utils_1 = require("@metamask/utils");
+const constants_js_1 = require("../../constants.cjs");
+const utils_js_1 = require("../utils.cjs");
+/**
+ * Address checksumming in the permission decode flow.
+ *
+ * Enforcer addresses come from three sources, each of which may use a
+ * different hex encoding (EIP-55 checksummed vs lowercase). Comparisons rely
+ * on strict equality, so we normalize at function boundaries instead of
+ * requiring callers to pass a specific encoding. `getChecksumAddress` is
+ * idempotent, so repeated normalization is intentional and cheap.
+ *
+ * 1. **Canonical contract addresses** (`EnforcerAddressesByName`): normalized
+ *    in {@link toEnforcerAddressesByName}, again in
+ *    `makePermissionDecoderConfigs` (`checksumEnforcerAddresses` in
+ *    `@metamask/7715-permission-types`), and once more below when building
+ *    each decoder's required/optional enforcer sets.
+ *
+ * 2. **Delegation caveat enforcers**: read from the encoded permission
+ *    context with unpredictable casing. Normalized in
+ *    {@link buildEnforcerCountsAndSet} during address matching and again in
+ *    `validateAndDecodePermission` before term decoding (rule decoders and
+ *    `getTermsByEnforcer` compare enforcer addresses with `===`).
+ *
+ * 3. **Decoder required/optional enforcers**: populated from contract
+ *    addresses by `makePermissionDecoderConfigs`; normalized at decoder
+ *    construction so `caveatAddressesMatch` compares like-for-like with
+ *    caveat addresses from source (2).
+ */
+/**
+ * Creates a single {@link PermissionDecoder} with the given type, enforcer
+ * sets, rule decoders, and decode/validate callback.
+ *
+ * @param config - The configuration describing the permission type's
+ * enforcers, rule decoders, and data decoder. See
+ * {@link PermissionDecoderConfig} for field documentation.
+ * @param config.permissionType - The type of permission to decode.
+ * @param config.contractAddresses - Checksummed enforcer addresses for the chain.
+ * @param config.optionalEnforcers - Optional enforcers for the permission.
+ * @param config.requiredEnforcers - Required enforcers for the permission.
+ * @param config.rules - Rule decoders for the permission.
+ * @param config.validateAndDecodeData - Data decoder for the permission.
+ * @returns A {@link PermissionDecoder} with `caveatAddressesMatch` and
+ * `validateAndDecodePermission`.
+ */
+function makePermissionDecoder({ permissionType, contractAddresses, optionalEnforcers, requiredEnforcers, rules, validateAndDecodeData, }) {
+    const optionalEnforcersSet = new Set(optionalEnforcers.map(utils_1.getChecksumAddress));
+    const requiredEnforcersMap = new Map(Object.entries(requiredEnforcers).map(([enforcer, count]) => [
+        (0, utils_1.getChecksumAddress)(enforcer),
+        count,
+    ]));
+    const caveatAddressesMatch = (caveatAddresses) => {
+        const { counts, enforcersSet } = (0, utils_js_1.buildEnforcerCountsAndSet)(caveatAddresses);
+        return (0, utils_js_1.enforcersMatchRule)(counts, enforcersSet, requiredEnforcersMap, optionalEnforcersSet);
+    };
+    const validateAndDecodePermission = (caveats) => {
+        const checksumCaveats = caveats.map((caveat) => ({
+            ...caveat,
+            enforcer: (0, utils_1.getChecksumAddress)(caveat.enforcer),
+        }));
+        try {
+            const invalidTerms = checksumCaveats.filter(
+            // isStrictHexString rejects '0x' which is a valid terms value
+            ({ terms }) => terms !== '0x' && !(0, utils_1.isStrictHexString)(terms));
+            if (invalidTerms.length > 0) {
+                throw new Error('Invalid terms: must be a hex string');
+            }
+            let expiry = null;
+            const decodedRules = [];
+            for (const decode of rules) {
+                const rule = decode({
+                    contractAddresses,
+                    caveats: checksumCaveats,
+                    requiredEnforcers: requiredEnforcersMap,
+                });
+                if (rule === null) {
+                    continue;
+                }
+                decodedRules.push(rule);
+                if (rule.type === constants_js_1.EXECUTION_PERMISSION_EXPIRY_RULE_TYPE) {
+                    expiry = rule.data.timestamp;
+                }
+            }
+            const data = validateAndDecodeData(checksumCaveats, contractAddresses);
+            return {
+                isValid: true,
+                expiry,
+                data,
+                rules: decodedRules.length > 0 ? decodedRules : undefined,
+            };
+        }
+        catch (caughtError) {
+            return { isValid: false, error: caughtError };
+        }
+    };
+    return {
+        permissionType,
+        caveatAddressesMatch,
+        validateAndDecodePermission,
+        optionalEnforcers: optionalEnforcersSet,
+        requiredEnforcers: requiredEnforcersMap,
+    };
+}
+exports.makePermissionDecoder = makePermissionDecoder;
+//# sourceMappingURL=makePermissionDecoder.cjs.map

package/dist/decodePermission/decoders/makePermissionDecoder.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"makePermissionDecoder.cjs","sourceRoot":"","sources":["../../../src/decodePermission/decoders/makePermissionDecoder.ts"],"names":[],"mappings":";;;AAKA,2CAAwE;AAGxE,sDAA2E;AAE3E,2CAA4E;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,qBAAqB,CAAC,EACpC,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,EACL,qBAAqB,GACG;IACxB,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,iBAAiB,CAAC,GAAG,CAAC,0BAAkB,CAAC,CAC1C,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3D,IAAA,0BAAkB,EAAC,QAAe,CAAC;QACnC,KAAK;KACN,CAAC,CACH,CAAC;IAEF,MAAM,oBAAoB,GAAG,CAAC,eAAsB,EAAW,EAAE;QAC/D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,oCAAyB,EAAC,eAAe,CAAC,CAAC;QAE5E,OAAO,IAAA,6BAAkB,EACvB,MAAM,EACN,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,2BAA2B,GAAG,CAClC,OAAsB,EACG,EAAE;QAC3B,MAAM,eAAe,GAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,MAAM;YACT,QAAQ,EAAE,IAAA,0BAAkB,EAAC,MAAM,CAAC,QAAQ,CAAC;SAC9C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM;YACzC,8DAA8D;YAC9D,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAC3D,CAAC;YAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,MAAM,YAAY,GAAW,EAAE,CAAC;YAEhC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,CAAC;oBAClB,iBAAiB;oBACjB,OAAO,EAAE,eAAe;oBACxB,iBAAiB,EAAE,oBAAoB;iBACxC,CAAC,CAAC;gBAEH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAExB,IAAI,IAAI,CAAC,IAAI,KAAK,oDAAqC,EAAE,CAAC;oBACxD,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAmB,CAAC;gBACzC,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAEvE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,IAAI;gBACJ,KAAK,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAoB,EAAE,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,cAAc;QACd,oBAAoB;QACpB,2BAA2B;QAC3B,iBAAiB,EAAE,oBAAoB;QACvC,iBAAiB,EAAE,oBAAoB;KACxC,CAAC;AACJ,CAAC;AAvFD,sDAuFC","sourcesContent":["import type {\n  PermissionDecoderConfig,\n  Rule,\n} from '@metamask/7715-permission-types';\nimport type { Caveat } from '@metamask/delegation-core';\nimport { getChecksumAddress, isStrictHexString } from '@metamask/utils';\nimport type { Hex } from '@metamask/utils';\n\nimport { EXECUTION_PERMISSION_EXPIRY_RULE_TYPE } from '../../constants.js';\nimport type { PermissionDecoder, ValidateAndDecodeResult } from '../types.js';\nimport { buildEnforcerCountsAndSet, enforcersMatchRule } from '../utils.js';\n\n/**\n * Address checksumming in the permission decode flow.\n *\n * Enforcer addresses come from three sources, each of which may use a\n * different hex encoding (EIP-55 checksummed vs lowercase). Comparisons rely\n * on strict equality, so we normalize at function boundaries instead of\n * requiring callers to pass a specific encoding. `getChecksumAddress` is\n * idempotent, so repeated normalization is intentional and cheap.\n *\n * 1. **Canonical contract addresses** (`EnforcerAddressesByName`): normalized\n *    in {@link toEnforcerAddressesByName}, again in\n *    `makePermissionDecoderConfigs` (`checksumEnforcerAddresses` in\n *    `@metamask/7715-permission-types`), and once more below when building\n *    each decoder's required/optional enforcer sets.\n *\n * 2. **Delegation caveat enforcers**: read from the encoded permission\n *    context with unpredictable casing. Normalized in\n *    {@link buildEnforcerCountsAndSet} during address matching and again in\n *    `validateAndDecodePermission` before term decoding (rule decoders and\n *    `getTermsByEnforcer` compare enforcer addresses with `===`).\n *\n * 3. **Decoder required/optional enforcers**: populated from contract\n *    addresses by `makePermissionDecoderConfigs`; normalized at decoder\n *    construction so `caveatAddressesMatch` compares like-for-like with\n *    caveat addresses from source (2).\n */\n\n/**\n * Creates a single {@link PermissionDecoder} with the given type, enforcer\n * sets, rule decoders, and decode/validate callback.\n *\n * @param config - The configuration describing the permission type's\n * enforcers, rule decoders, and data decoder. See\n * {@link PermissionDecoderConfig} for field documentation.\n * @param config.permissionType - The type of permission to decode.\n * @param config.contractAddresses - Checksummed enforcer addresses for the chain.\n * @param config.optionalEnforcers - Optional enforcers for the permission.\n * @param config.requiredEnforcers - Required enforcers for the permission.\n * @param config.rules - Rule decoders for the permission.\n * @param config.validateAndDecodeData - Data decoder for the permission.\n * @returns A {@link PermissionDecoder} with `caveatAddressesMatch` and\n * `validateAndDecodePermission`.\n */\nexport function makePermissionDecoder({\n  permissionType,\n  contractAddresses,\n  optionalEnforcers,\n  requiredEnforcers,\n  rules,\n  validateAndDecodeData,\n}: PermissionDecoderConfig): PermissionDecoder {\n  const optionalEnforcersSet = new Set(\n    optionalEnforcers.map(getChecksumAddress),\n  );\n  const requiredEnforcersMap = new Map(\n    Object.entries(requiredEnforcers).map(([enforcer, count]) => [\n      getChecksumAddress(enforcer as Hex),\n      count,\n    ]),\n  );\n\n  const caveatAddressesMatch = (caveatAddresses: Hex[]): boolean => {\n    const { counts, enforcersSet } = buildEnforcerCountsAndSet(caveatAddresses);\n\n    return enforcersMatchRule(\n      counts,\n      enforcersSet,\n      requiredEnforcersMap,\n      optionalEnforcersSet,\n    );\n  };\n\n  const validateAndDecodePermission = (\n    caveats: Caveat<Hex>[],\n  ): ValidateAndDecodeResult => {\n    const checksumCaveats: Caveat<Hex>[] = caveats.map((caveat) => ({\n      ...caveat,\n      enforcer: getChecksumAddress(caveat.enforcer),\n    }));\n    try {\n      const invalidTerms = checksumCaveats.filter(\n        // isStrictHexString rejects '0x' which is a valid terms value\n        ({ terms }) => terms !== '0x' && !isStrictHexString(terms),\n      );\n\n      if (invalidTerms.length > 0) {\n        throw new Error('Invalid terms: must be a hex string');\n      }\n\n      let expiry: number | null = null;\n      const decodedRules: Rule[] = [];\n\n      for (const decode of rules) {\n        const rule = decode({\n          contractAddresses,\n          caveats: checksumCaveats,\n          requiredEnforcers: requiredEnforcersMap,\n        });\n\n        if (rule === null) {\n          continue;\n        }\n\n        decodedRules.push(rule);\n\n        if (rule.type === EXECUTION_PERMISSION_EXPIRY_RULE_TYPE) {\n          expiry = rule.data.timestamp as number;\n        }\n      }\n\n      const data = validateAndDecodeData(checksumCaveats, contractAddresses);\n\n      return {\n        isValid: true,\n        expiry,\n        data,\n        rules: decodedRules.length > 0 ? decodedRules : undefined,\n      };\n    } catch (caughtError) {\n      return { isValid: false, error: caughtError as Error };\n    }\n  };\n\n  return {\n    permissionType,\n    caveatAddressesMatch,\n    validateAndDecodePermission,\n    optionalEnforcers: optionalEnforcersSet,\n    requiredEnforcers: requiredEnforcersMap,\n  };\n}\n"]}

package/dist/decodePermission/decoders/{makePermissionDecoder.d.ts → makePermissionDecoder.d.cts}

@@ -1,5 +1,5 @@
-import type { PermissionDecoderConfig } from '@metamask/7715-permission-types';
-import type { PermissionDecoder } from '../types.js';
+import type { PermissionDecoderConfig } from "@metamask/7715-permission-types";
+import type { PermissionDecoder } from "../types.cjs";
 /**
  * Address checksumming in the permission decode flow.
  *
@@ -43,4 +43,4 @@ import type { PermissionDecoder } from '../types.js';
  * `validateAndDecodePermission`.
  */
 export declare function makePermissionDecoder({ permissionType, contractAddresses, optionalEnforcers, requiredEnforcers, rules, validateAndDecodeData, }: PermissionDecoderConfig): PermissionDecoder;
-//# sourceMappingURL=makePermissionDecoder.d.ts.map
+//# sourceMappingURL=makePermissionDecoder.d.cts.map

package/dist/decodePermission/decoders/makePermissionDecoder.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"makePermissionDecoder.d.cts","sourceRoot":"","sources":["../../../src/decodePermission/decoders/makePermissionDecoder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EAExB,wCAAwC;AAMzC,OAAO,KAAK,EAAE,iBAAiB,EAA2B,qBAAoB;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,EACL,qBAAqB,GACtB,EAAE,uBAAuB,GAAG,iBAAiB,CAgF7C"}

package/dist/decodePermission/decoders/makePermissionDecoder.d.mts

@@ -0,0 +1,46 @@
+import type { PermissionDecoderConfig } from "@metamask/7715-permission-types";
+import type { PermissionDecoder } from "../types.mjs";
+/**
+ * Address checksumming in the permission decode flow.
+ *
+ * Enforcer addresses come from three sources, each of which may use a
+ * different hex encoding (EIP-55 checksummed vs lowercase). Comparisons rely
+ * on strict equality, so we normalize at function boundaries instead of
+ * requiring callers to pass a specific encoding. `getChecksumAddress` is
+ * idempotent, so repeated normalization is intentional and cheap.
+ *
+ * 1. **Canonical contract addresses** (`EnforcerAddressesByName`): normalized
+ *    in {@link toEnforcerAddressesByName}, again in
+ *    `makePermissionDecoderConfigs` (`checksumEnforcerAddresses` in
+ *    `@metamask/7715-permission-types`), and once more below when building
+ *    each decoder's required/optional enforcer sets.
+ *
+ * 2. **Delegation caveat enforcers**: read from the encoded permission
+ *    context with unpredictable casing. Normalized in
+ *    {@link buildEnforcerCountsAndSet} during address matching and again in
+ *    `validateAndDecodePermission` before term decoding (rule decoders and
+ *    `getTermsByEnforcer` compare enforcer addresses with `===`).
+ *
+ * 3. **Decoder required/optional enforcers**: populated from contract
+ *    addresses by `makePermissionDecoderConfigs`; normalized at decoder
+ *    construction so `caveatAddressesMatch` compares like-for-like with
+ *    caveat addresses from source (2).
+ */
+/**
+ * Creates a single {@link PermissionDecoder} with the given type, enforcer
+ * sets, rule decoders, and decode/validate callback.
+ *
+ * @param config - The configuration describing the permission type's
+ * enforcers, rule decoders, and data decoder. See
+ * {@link PermissionDecoderConfig} for field documentation.
+ * @param config.permissionType - The type of permission to decode.
+ * @param config.contractAddresses - Checksummed enforcer addresses for the chain.
+ * @param config.optionalEnforcers - Optional enforcers for the permission.
+ * @param config.requiredEnforcers - Required enforcers for the permission.
+ * @param config.rules - Rule decoders for the permission.
+ * @param config.validateAndDecodeData - Data decoder for the permission.
+ * @returns A {@link PermissionDecoder} with `caveatAddressesMatch` and
+ * `validateAndDecodePermission`.
+ */
+export declare function makePermissionDecoder({ permissionType, contractAddresses, optionalEnforcers, requiredEnforcers, rules, validateAndDecodeData, }: PermissionDecoderConfig): PermissionDecoder;
+//# sourceMappingURL=makePermissionDecoder.d.mts.map

package/dist/decodePermission/decoders/makePermissionDecoder.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"makePermissionDecoder.d.mts","sourceRoot":"","sources":["../../../src/decodePermission/decoders/makePermissionDecoder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EAExB,wCAAwC;AAMzC,OAAO,KAAK,EAAE,iBAAiB,EAA2B,qBAAoB;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,EACL,qBAAqB,GACtB,EAAE,uBAAuB,GAAG,iBAAiB,CAgF7C"}

package/dist/decodePermission/decoders/{makePermissionDecoder.js → makePermissionDecoder.mjs}

@@ -1,6 +1,6 @@
-import { getChecksumAddress, isStrictHexString } from '@metamask/utils';
-import { EXECUTION_PERMISSION_EXPIRY_RULE_TYPE } from '../../constants.js';
-import { buildEnforcerCountsAndSet, enforcersMatchRule } from '../utils.js';
+import { getChecksumAddress, isStrictHexString } from "@metamask/utils";
+import { EXECUTION_PERMISSION_EXPIRY_RULE_TYPE } from "../../constants.mjs";
+import { buildEnforcerCountsAndSet, enforcersMatchRule } from "../utils.mjs";
 /**
  * Address checksumming in the permission decode flow.
  *
@@ -101,4 +101,4 @@ export function makePermissionDecoder({ permissionType, contractAddresses, optio
         requiredEnforcers: requiredEnforcersMap,
     };
 }
-//# sourceMappingURL=makePermissionDecoder.js.map
+//# sourceMappingURL=makePermissionDecoder.mjs.map