@mysten-incubation/sui-agent-pass 0.0.0 → 0.1.0

package/dist/owner.js

@@ -0,0 +1,410 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+/** Owner transaction construction belongs to the consent flow, never to MCP. */
+import { Transaction, } from '@mysten/sui/transactions';
+import { normalizeStructTag } from '@mysten/sui/utils';
+import { appType } from './chain.js';
+import { AGENT_GAS_NAME, DAY_MS, healthFactorRay, sameCoin, SUI, } from './domain.js';
+import { canSweep, refreshNaviPrices, withdrawAllInto } from './navi.js';
+const RATE_LIMIT = '0x2::allowance::RateLimit';
+const CLOCK = '0x6';
+export const STAKED_SUI = '0x3::staking_pool::StakedSui';
+const balanceOf = (coin) => `0x2::balance::Balance<${coin}>`;
+/**
+ * Each rule becomes one policy object, built by its own module and installed with the
+ * pass's generic `add_policy`. Every policy names the coin type it governs.
+ */
+function installPolicies(tx, d, pass, p, openNavi) {
+    // Calls go to the latest upgrade; the policy types belong to the original package.
+    const pkg = d.publishedAt, types = d.packageId, clock = tx.object(CLOCK), config = tx.object(d.configId);
+    const install = (type, policy) => tx.moveCall({
+        target: `${pkg}::pass::add_policy`,
+        typeArguments: [type],
+        arguments: [pass, config, policy],
+    });
+    for (const t of p.transfers) {
+        const policy = tx.moveCall({
+            target: `${pkg}::transfer_policy::new`,
+            typeArguments: [t.coin],
+            arguments: [tx.pure.u64(t.perTransfer), tx.pure.u64(t.daily), clock],
+        });
+        for (const r of t.recipients)
+            tx.moveCall({
+                target: `${pkg}::transfer_policy::add_recipient`,
+                typeArguments: [t.coin],
+                arguments: [policy, tx.pure.string(r.name), tx.pure.address(r.address)],
+            });
+        install(`${types}::transfer_policy::TransferPolicy<${t.coin}>`, policy);
+    }
+    for (const sw of p.swaps)
+        install(`${types}::swap_policy::SwapPolicy<${sw.coinIn},${sw.coinOut}>`, tx.moveCall({
+            target: `${pkg}::swap_policy::new`,
+            typeArguments: [sw.coinIn, sw.coinOut],
+            arguments: [
+                tx.pure.vector('address', sw.pools),
+                tx.pure.u64(sw.perTrade),
+                tx.pure.u64(sw.daily),
+                tx.pure.u64(sw.minPrice),
+                clock,
+            ],
+        }));
+    for (const l of p.lending) {
+        const reserve = d.protocols.navi.reserves[l.coin];
+        if (!reserve)
+            throw new Error(`NAVI has no reserve for ${l.coin} in this deployment`);
+        install(`${types}::lending_policy::LendingPolicy<${l.coin}>`, tx.moveCall({
+            target: `${pkg}::lending_policy::new`,
+            typeArguments: [l.coin],
+            arguments: [
+                tx.pure.id(reserve.poolId),
+                tx.pure.u8(reserve.assetId),
+                tx.pure.bool(l.allowBorrow),
+                tx.pure.u64(l.perAction),
+                tx.pure.u64(l.daily),
+                tx.pure.u256(healthFactorRay(l.minHealthFactor)),
+                clock,
+            ],
+        }));
+    }
+    // The agent's lending runs on the pass's NAVI account, which only the owner opens, once.
+    if (p.lending.length && openNavi)
+        tx.moveCall({ target: `${pkg}::pass::navi_open`, arguments: [pass, config] });
+    if (p.staking)
+        install(`${types}::staking_policy::StakingPolicy`, tx.moveCall({
+            target: `${pkg}::staking_policy::new`,
+            arguments: [
+                tx.pure.vector('address', p.staking.validators),
+                tx.pure.u64(p.staking.perStake),
+                tx.pure.u64(p.staking.daily),
+                clock,
+            ],
+        }));
+}
+function gasStipend(tx, amount, session) {
+    tx.moveCall({
+        target: '0x2::balance::send_funds',
+        typeArguments: [SUI],
+        arguments: [tx.balance({ balance: amount }), tx.pure.address(session)],
+    });
+}
+/**
+ * Allowances draw only from the owner's address balance, so the authorization converts the
+ * owner's coin objects into it as far as the caps need (`conversion`), coin by coin. SUI comes
+ * off the gas coin, which the wallet backs with the address balance and coin objects together,
+ * so whatever it touches ends in the address balance. Any other coin is taken from the listed
+ * coin objects explicitly: a plain balance request would be served from the address balance
+ * when it is large enough, converting nothing. A demo stablecoin is minted from its faucet.
+ */
+function convertCoins(tx, d, convert, coins, owner) {
+    for (const [coin, amount] of Object.entries(convert)) {
+        if (BigInt(amount) <= 0n)
+            continue;
+        const faucet = d.demoFaucet && sameCoin(d.demoFaucet.coin, coin) ? d.demoFaucet : null;
+        let source;
+        if (faucet)
+            source = tx.moveCall({
+                target: `${faucet.packageId}::usdc::mint`,
+                arguments: [tx.object(faucet.faucetId), tx.pure.u64(amount)],
+            });
+        else if (sameCoin(coin, SUI))
+            source = tx.splitCoins(tx.gas, [amount])[0];
+        else {
+            const refs = coins[normalizeStructTag(coin)] ?? [];
+            if (!refs.length)
+                throw new Error(`No ${coin} coin objects to convert`);
+            const [first, ...rest] = refs.map((r) => tx.objectRef(r));
+            if (rest.length)
+                tx.mergeCoins(first, rest);
+            source = tx.splitCoins(first, [amount])[0];
+        }
+        tx.moveCall({
+            target: '0x2::coin::send_funds',
+            typeArguments: [coin],
+            arguments: [source, tx.pure.address(owner)],
+        });
+    }
+}
+/** A daily-window rate limit as an `Option<RateLimit>`. */
+function rateLimitOption(tx, dailyLimit) {
+    const limit = tx.moveCall({
+        target: '0x2::allowance::periodic_rate_limit',
+        arguments: [tx.pure.u64(DAY_MS), tx.pure.u256(dailyLimit)],
+    });
+    return tx.moveCall({
+        target: '0x1::option::some',
+        typeArguments: [RATE_LIMIT],
+        arguments: [limit],
+    });
+}
+/**
+ * A separate, non-app-bound SUI allowance the agent spends to top up its own gas float. Its own
+ * lifetime cap and daily window bound gas spend independently of the asset-management allowances.
+ */
+function issueGasAllowance(tx, setup, session) {
+    tx.moveCall({
+        target: '0x2::allowance::new',
+        typeArguments: [balanceOf(SUI)],
+        arguments: [
+            tx.pure.string(AGENT_GAS_NAME),
+            tx.pure.address(session),
+            tx.pure.option('u256', setup.gasCap),
+            tx.pure.option('u64', null),
+            tx.pure.option('u64', setup.expiresMs),
+            rateLimitOption(tx, setup.gasDaily),
+        ],
+    });
+}
+/**
+ * One PTB: the pass (its receipt goes to the owner), one allowance bound to the pass module per
+ * coin the rules spend, the gas allowance, the policies, the NAVI account when lending is allowed, then the
+ * owner's coins converted into their address balance as far as the caps need, and the session's
+ * gas stipend sent. Coins never enter the pass.
+ */
+export function buildAuthorization(d, setup, owner, session, convert, coins = {}) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    const pass = tx.moveCall({
+        target: `${d.publishedAt}::pass::create`,
+        arguments: [
+            tx.object(d.configId),
+            tx.pure.string(setup.name),
+            tx.pure.address(session),
+            tx.pure.u64(setup.expiresMs),
+            tx.object(CLOCK),
+        ],
+    });
+    const issue = (coin, cap) => issueAllowance(tx, d, pass, setup, session, coin, cap);
+    for (const [coin, cap] of Object.entries(setup.allowances))
+        issue(coin, cap);
+    issueGasAllowance(tx, setup, session);
+    installPolicies(tx, d, pass, setup.policy, true);
+    tx.moveCall({ target: `${d.publishedAt}::pass::share`, arguments: [pass] });
+    convertCoins(tx, d, convert, coins, owner);
+    gasStipend(tx, setup.gasAmount, session);
+    return tx;
+}
+/**
+ * Revocation ends the agent's term on the pass and deletes every allowance, so later spends
+ * are refused before execution.
+ */
+/** One pass-bound allowance over the owner's balance: proposed with the pass's terms, issued by the pass. */
+function issueAllowance(tx, d, pass, setup, session, coin, cap) {
+    tx.moveCall({
+        target: `${d.publishedAt}::pass::issue`,
+        typeArguments: [coin],
+        arguments: [
+            pass,
+            tx.object(d.configId),
+            tx.moveCall({
+                target: '0x2::allowance::propose_for_app',
+                typeArguments: [balanceOf(coin), appType(d)],
+                arguments: [
+                    tx.pure.string(setup.name),
+                    tx.pure.address(session),
+                    tx.pure.option('u256', cap),
+                    tx.pure.option('u64', null),
+                    tx.pure.option('u64', setup.expiresMs),
+                    tx.moveCall({ target: '0x1::option::none', typeArguments: [RATE_LIMIT] }),
+                ],
+            }),
+        ],
+    });
+}
+function revokeAllowance(tx, coin, cap, allowance) {
+    tx.moveCall({
+        target: '0x2::allowance::revoke',
+        typeArguments: [balanceOf(coin)],
+        arguments: [tx.object(cap), tx.object(allowance)],
+    });
+}
+/** Removes every installed policy; transfer policies hold a table and must be destroyed, the others drop. */
+function removePolicies(tx, d, pass, policies) {
+    const call = d.publishedAt, types = d.packageId;
+    const remove = (type) => tx.moveCall({
+        target: `${call}::pass::remove_policy`,
+        typeArguments: [type],
+        arguments: [pass],
+    });
+    for (const t of policies.transfers)
+        tx.moveCall({
+            target: `${call}::transfer_policy::destroy`,
+            typeArguments: [t.coinType],
+            arguments: [remove(`${types}::transfer_policy::TransferPolicy<${t.coinType}>`)],
+        });
+    for (const s of policies.swaps)
+        remove(`${types}::swap_policy::SwapPolicy<${s.coinIn},${s.coinOut}>`);
+    for (const l of policies.lending)
+        remove(`${types}::lending_policy::LendingPolicy<${l.coinType}>`);
+    if (policies.staking.length)
+        remove(`${types}::staking_policy::StakingPolicy`);
+}
+/**
+ * Replaces a pass's rules with `next` in one owner transaction: the term first (new allowances
+ * may not outlive it), then every policy removed and the new set installed, then each coin's
+ * allowance kept when its cap and expiry are unchanged and otherwise revoked and reissued, the
+ * gas allowance likewise. The agent key stays, nothing is sent to it, and a NAVI position the
+ * pass already holds stays whether or not lending remains allowed. Replaced policies start with
+ * empty daily meters; kept allowances keep their lifetime spend.
+ */
+export function buildAmendment(d, current, next, owner) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    const { active, control } = current, pass = tx.object(active.passId), session = control.agent;
+    if (String(next.expiresMs) !== control.agentExpiresMs)
+        tx.moveCall({
+            target: `${d.publishedAt}::pass::set_agent`,
+            arguments: [
+                pass,
+                tx.object(d.configId),
+                tx.pure.address(session),
+                tx.pure.u64(next.expiresMs),
+                tx.object(CLOCK),
+            ],
+        });
+    removePolicies(tx, d, pass, control.policies);
+    installPolicies(tx, d, pass, next.policy, next.policy.lending.length > 0 && !control.naviPosition);
+    const same = (v, cap, daily) => !!v &&
+        v.lifetimeCap === cap &&
+        v.expirationMs === String(next.expiresMs) &&
+        (daily === null ? v.rateLimit === null : v.rateLimit?.limit === daily);
+    for (const [coin, cap] of Object.entries(next.allowances)) {
+        const key = normalizeStructTag(coin), have = active.allowances[key];
+        if (have && same(current.allowances[key] ?? null, cap, null))
+            continue;
+        if (have)
+            revokeAllowance(tx, key, have.revokeCap, have.allowance);
+        issueAllowance(tx, d, pass, next, session, key, cap);
+    }
+    for (const [coin, have] of Object.entries(active.allowances))
+        if (!(normalizeStructTag(coin) in next.allowances) &&
+            !Object.keys(next.allowances).some((c) => sameCoin(c, coin)))
+            revokeAllowance(tx, coin, have.revokeCap, have.allowance);
+    if (!same(current.gas, next.gasCap, next.gasDaily)) {
+        revokeAllowance(tx, SUI, active.gasRevokeCap, active.gasAllowance);
+        issueGasAllowance(tx, next, session);
+    }
+    return tx;
+}
+export function buildRevocation(d, active, owner) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    tx.moveCall({
+        target: `${d.publishedAt}::pass::revoke_agent`,
+        arguments: [tx.object(active.passId)],
+    });
+    for (const [coin, cap, allowance] of grants(active))
+        tx.moveCall({
+            target: '0x2::allowance::revoke',
+            typeArguments: [balanceOf(coin)],
+            arguments: [tx.object(cap), tx.object(allowance)],
+        });
+    return tx;
+}
+/** Every (coin, revoke cap, allowance) triple of a session: the pass-bound ones and gas. */
+export function grants(active) {
+    return [
+        ...Object.entries(active.allowances).map(([coin, ids]) => [
+            coin,
+            ids.revokeCap,
+            ids.allowance,
+        ]),
+        [SUI, active.gasRevokeCap, active.gasAllowance],
+    ];
+}
+/**
+ * The owner takes the NAVI account cap out of the pass into their own wallet. NAVI files the
+ * position under the cap, so holding it is holding the position: the owner acts on NAVI directly
+ * and the agent has nothing to lend on until the cap is deposited again.
+ */
+/** The pass's NAVI account cap, out of the pass and into the transaction's hands. */
+function takeNaviCap(tx, d, pass) {
+    const key = tx.moveCall({ target: `${d.publishedAt}::navi::account_key` });
+    return tx.moveCall({
+        target: `${d.publishedAt}::pass::withdraw_object`,
+        typeArguments: [
+            `${d.packageId}::navi::AccountKey`,
+            `${d.protocols.navi.packageId}::account::AccountCap`,
+        ],
+        arguments: [pass, key],
+    });
+}
+/**
+ * Takes the pass's NAVI account into the owner's wallet, emptied of its collateral first when it
+ * owes nothing, since NAVI's app cannot operate a cap-based position.
+ */
+export async function buildReclaimPosition(d, active, owner, position = null) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    if (canSweep(position))
+        await refreshNaviPrices(tx, d);
+    const cap = takeNaviCap(tx, d, tx.object(active.passId));
+    if (canSweep(position))
+        withdrawAllInto(tx, d, cap, position, owner);
+    tx.transferObjects([cap], owner);
+    return tx;
+}
+export function buildClose(d, pass, active, control, owner, position = null) {
+    return buildCloseAll(d, [{ pass, active, control, position }], owner);
+}
+/**
+ * Closes several passes of one owner in one transaction and one signature. NAVI's app does not
+ * see account-cap positions, so a position with collateral and no debt is withdrawn into the
+ * owner's wallet here, before its cap is handed over; one with debt comes over as it is.
+ */
+export async function buildCloseAll(d, closings, owner) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    if (closings.some((c) => c.control.naviPosition && canSweep(c.position)))
+        await refreshNaviPrices(tx, d);
+    for (const c of closings)
+        closeInto(tx, d, c, owner);
+    return tx;
+}
+function closeInto(tx, d, { pass, active, control, position }, owner) {
+    const call = d.publishedAt, types = d.packageId;
+    const passArg = tx.object(pass.passId);
+    if (!control.revoked)
+        tx.moveCall({ target: `${call}::pass::revoke_agent`, arguments: [passArg] });
+    if (active)
+        for (const [coin, cap, allowance] of grants(active))
+            revokeAllowance(tx, coin, cap, allowance);
+    removePolicies(tx, d, passArg, control.policies);
+    const held = [];
+    if (control.naviPosition) {
+        const cap = takeNaviCap(tx, d, passArg);
+        if (canSweep(position))
+            withdrawAllInto(tx, d, cap, position, owner);
+        held.push(cap);
+    }
+    for (const s of control.stakes) {
+        const key = tx.moveCall({
+            target: `${call}::staking::stake_key`,
+            arguments: [tx.pure.id(s.id)],
+        });
+        held.push(tx.moveCall({
+            target: `${call}::pass::withdraw_object`,
+            typeArguments: [`${types}::staking::StakeKey`, STAKED_SUI],
+            arguments: [passArg, key],
+        }));
+    }
+    if (held.length)
+        tx.transferObjects(held, owner);
+    tx.moveCall({ target: `${call}::pass::destroy`, arguments: [passArg] });
+    tx.moveCall({ target: `${call}::pass::burn_receipt`, arguments: [tx.object(pass.receiptId)] });
+}
+/** The owner takes one stake out of the pass; it is then an ordinary `StakedSui` in their wallet. */
+export function buildReclaimStake(d, active, owner, stakeId) {
+    const tx = new Transaction();
+    tx.setSender(owner);
+    const key = tx.moveCall({
+        target: `${d.packageId}::staking::stake_key`,
+        arguments: [tx.pure.id(stakeId)],
+    });
+    const stake = tx.moveCall({
+        target: `${d.publishedAt}::pass::withdraw_object`,
+        typeArguments: [`${d.packageId}::staking::StakeKey`, STAKED_SUI],
+        arguments: [tx.object(active.passId), key],
+    });
+    tx.transferObjects([stake], owner);
+    return tx;
+}