@pushchain/core 6.0.25 → 6.0.27-alpha.0

package/src/lib/agentic/management/svm-public.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svmMetadata = svmMetadata;
+exports.preparePublicSvmRule = preparePublicSvmRule;
+const web3_js_1 = require("@solana/web3.js");
+const viem_1 = require("viem");
+const enums_1 = require("../../constants/enums");
+const chain_1 = require("../../constants/chain");
+const prc20_metadata_1 = require("../contracts/prc20-metadata");
+const svm_context_1 = require("./svm-context");
+const svm_metadata_1 = require("./svm-metadata");
+const svm_accounts_1 = require("../codec/svm-accounts");
+const svm_idl_1 = require("../codec/svm-idl");
+const svm_terms_1 = require("../codec/svm-terms");
+const svm_terms_2 = require("../codec/svm-terms");
+function svmMetadata(runtime) {
+    return (runtime.svmMetadata ??
+        (0, svm_metadata_1.createSvmMetadataProvider)({
+            [enums_1.CHAIN.SOLANA_DEVNET]: {
+                gatewayProgram: chain_1.CHAIN_INFO[enums_1.CHAIN.SOLANA_DEVNET].lockerContract ?? '',
+                rpcUrls: chain_1.CHAIN_INFO[enums_1.CHAIN.SOLANA_DEVNET].defaultRPC,
+            },
+        }));
+}
+async function preparePublicSvmRule(runtime, snap, wallet, rule) {
+    const chain = rule.chainNamespace;
+    if (chain_1.CHAIN_INFO[chain]?.vm !== enums_1.VM.SVM)
+        throw (0, svm_terms_1.svmInvalid)('unknown Solana chain');
+    if (!Array.isArray(rule.assets) || rule.assets.length > 8)
+        throw (0, svm_terms_1.svmInvalid)('assets must contain at most eight entries');
+    const raw = 'format' in rule && rule.format === 'decoded';
+    const outputTokens = 'outputTokens' in rule ? rule.outputTokens : undefined;
+    if (outputTokens !== undefined && !Array.isArray(outputTokens))
+        throw (0, svm_terms_1.svmInvalid)('outputTokens must be an array of mint addresses');
+    const metadata = svmMetadata(runtime);
+    const requested = rule.assets.length
+        ? rule.assets
+        : [{ token: viem_1.zeroAddress, maxPerCall: BigInt(0), maxTotal: BigInt(0) }];
+    const caps = [];
+    const tokenAccounts = new Map(), mints = new Set();
+    const sources = [];
+    for (const asset of requested) {
+        const source = typeof asset.token === 'string' ? asset.token : asset.token?.address;
+        if (typeof source !== 'string')
+            throw (0, svm_terms_1.svmInvalid)('asset token requires an address');
+        if (typeof asset.token !== 'string' &&
+            'chain' in asset.token &&
+            asset.token.chain !== chain)
+            throw (0, svm_terms_1.svmInvalid)('asset token belongs to another chain');
+        const native = source === viem_1.zeroAddress ||
+            /^0x0{64}$/.test(source) ||
+            source === '11111111111111111111111111111111';
+        const key = native ? undefined : (0, svm_accounts_1.svmKey)(source);
+        const sourceToken = typeof asset.token === 'string' && key
+            ? new web3_js_1.PublicKey((0, viem_1.hexToBytes)(key)).toBase58()
+            : asset.token;
+        const token = native
+            ? await (0, prc20_metadata_1.readGasPrc20)(snap, chain)
+            : runtime.resolvePrc20(sourceToken, chain);
+        if (caps.some((c) => c.token === (0, viem_1.getAddress)(token)))
+            throw (0, svm_terms_1.svmInvalid)('duplicate SVM asset');
+        caps.push({
+            token: (0, viem_1.getAddress)(token),
+            maxPerCall: asset.maxPerCall,
+            maxTotal: asset.maxTotal ?? BigInt(0),
+        });
+        sources.push({ key, token });
+        if (key)
+            mints.add(key);
+    }
+    const outputs = (outputTokens ?? []).map((mint) => ({ mint }));
+    outputs.forEach((o) => mints.add((0, svm_accounts_1.svmKey)(o.mint)));
+    const ctx = await (0, svm_context_1.resolveSvmContext)(snap, wallet, rule.chainNamespace, caps, metadata, outputs, runtime.network);
+    // Validate the PRC20 actually represents the requested source mint, not merely its chain.
+    const { resolveSvmAssets } = await Promise.resolve().then(() => __importStar(require('./svm-context')));
+    const resolved = await resolveSvmAssets(snap, rule.chainNamespace, caps, metadata, runtime.network);
+    resolved.forEach((a, i) => {
+        if (sources[i].key
+            ? a.kind !== 'spl' || (0, svm_accounts_1.svmKey)(a.mint) !== sources[i].key
+            : a.kind !== 'native')
+            throw (0, svm_terms_1.svmInvalid)('PRC20 source does not match requested asset');
+    });
+    for (const mint of mints) {
+        const token = await metadata.mint(rule.chainNamespace, mint);
+        if ((0, svm_accounts_1.svmKey)(token.mint) !== mint)
+            throw (0, svm_terms_1.svmInvalid)('mint resolver returned another mint');
+        tokenAccounts.set(mint, (0, svm_accounts_1.deriveAgwSvmAta)(ctx.expectedCEA, token));
+    }
+    if (raw) {
+        const stored = rule;
+        if ((0, svm_accounts_1.svmKey)(stored.expectedCEA) !== ctx.expectedCEA ||
+            (0, svm_accounts_1.svmKey)(stored.gatewayProgram) !== ctx.gatewayProgram)
+            throw (0, svm_terms_1.svmInvalid)('decoded rule belongs to another wallet or gateway');
+        if (ctx.ceaAccounts.some((a) => !stored.ceaAccounts.some((s) => (0, svm_accounts_1.svmKey)(s) === a)))
+            throw (0, svm_terms_1.svmInvalid)('decoded rule omits a required wallet value account');
+        const terms = { ...stored, assets: caps };
+        (0, svm_terms_2.validateSvmTerms)(terms, runtime.nowSeconds());
+        return terms;
+    }
+    return (0, svm_idl_1.compileSvmIdlRule)(rule, { ...ctx, tokenAccounts }, runtime.nowSeconds());
+}
+//# sourceMappingURL=svm-public.js.map

package/src/lib/agentic/management/svm.d.ts

@@ -0,0 +1,27 @@
+/** Internal explicit-wire operations. Not exported by the SDK entry point. */
+import { type Address, type Hex } from 'viem';
+import type { AgenticRuntime } from '../runtime';
+import { type AgenticGeneration } from '../deployments';
+import { type SvmTermsWire } from '../codec/svm-terms';
+export interface SvmWireGrant {
+    agent: Address;
+    chainNamespace: `solana:${string}`;
+    terms: SvmTermsWire;
+}
+export declare function verifySvmWallet(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address): Promise<void>;
+export declare function grantSvmWire(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, input: SvmWireGrant): Promise<{
+    rulesId: `0x${string}`;
+    tx: import("../../orchestrator/orchestrator.types").UniversalTxResponse;
+}>;
+/** Snapshot -> all-asset assertion -> revoke -> grant. No sequential fallback. */
+export declare function prepareSvmReplacement(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, oldId: Hex, input: SvmWireGrant): Promise<{
+    rulesId: `0x${string}`;
+    oldId: `0x${string}`;
+    snapshotBlock: bigint;
+    data: `0x${string}`;
+}>;
+export declare function replaceSvmWire(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, oldId: Hex, input: SvmWireGrant): Promise<{
+    rulesId: `0x${string}`;
+    replaced: `0x${string}`;
+    tx: import("../../orchestrator/orchestrator.types").UniversalTxResponse;
+}>;

package/src/lib/agentic/management/svm.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySvmWallet = verifySvmWallet;
+exports.grantSvmWire = grantSvmWire;
+exports.prepareSvmReplacement = prepareSvmReplacement;
+exports.replaceSvmWire = replaceSvmWire;
+/** Internal explicit-wire operations. Not exported by the SDK entry point. */
+const viem_1 = require("viem");
+const deployments_1 = require("../deployments");
+const snapshot_1 = require("../reads/snapshot");
+const svm_1 = require("../reads/svm");
+const common_1 = require("./common");
+const svm_terms_1 = require("../codec/svm-terms");
+const session_1 = require("../codec/session");
+const ids_1 = require("../codec/ids");
+const v5_1 = require("../contracts/v5");
+const svm_accounts_1 = require("../codec/svm-accounts");
+const errors_1 = require("../errors");
+const prc20_metadata_1 = require("../contracts/prc20-metadata");
+async function verifyAssets(snap, input) {
+    if (!/^solana:[1-9A-HJ-NP-Za-km-z]{32}$/.test(input.chainNamespace))
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'SVM chain must be a full Solana CAIP-2 namespace');
+    for (const cap of input.terms.assets) {
+        if ((await snap.read(cap.token, prc20_metadata_1.PRC20_SOURCE_ABI, 'SOURCE_CHAIN_NAMESPACE')) !== input.chainNamespace)
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.ASSET_CHAIN_MISMATCH, 'SVM asset source-chain mismatch');
+    }
+}
+async function verifySvmWallet(runtime, gen, wallet) {
+    const actual = await (0, deployments_1.resolveWalletGeneration)(runtime.reader, runtime.network, wallet);
+    if (actual.addresses.factory !== gen.addresses.factory)
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.CAPABILITY_UNAVAILABLE, 'SVM wallet generation mismatch');
+    await (0, deployments_1.verifyPolicyVersion)(runtime.reader, gen);
+}
+function session(gen, wallet, owner, input, now) {
+    const agent = (0, viem_1.getAddress)(input.agent);
+    if (agent === owner)
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.AGENT_IS_OWNER, 'agent must differ from owner');
+    const cea = (0, svm_accounts_1.deriveAgwSvmCea)(wallet, input.terms.gatewayProgram).address;
+    if (cea.toLowerCase() !== input.terms.expectedCEA.toLowerCase())
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'SVM expectedCEA does not belong to this wallet/gateway');
+    return (0, session_1.buildSession)({
+        validator: gen.addresses.sessionValidator,
+        rulesPolicy: gen.addresses.rulesPolicy,
+        agent,
+        actions: [
+            {
+                target: gen.addresses.gateway,
+                selector: v5_1.SEND_OUTBOUND_SELECTOR,
+                initData: (0, session_1.encodeEnvelope)(input.chainNamespace, (0, svm_terms_1.encodeSvmTerms)(input.terms, now)),
+            },
+        ],
+    });
+}
+async function grantSvmWire(runtime, gen, wallet, input) {
+    (0, common_1.assertCanSign)(runtime, 'internal SVM grant');
+    await verifySvmWallet(runtime, gen, wallet);
+    const snap = await snapshot_1.Snapshot.at(runtime.reader);
+    const owner = await (0, common_1.assertOwner)(runtime, gen, wallet, snap);
+    await verifyAssets(snap, input);
+    const s = session(gen, wallet, owner, input, runtime.nowSeconds());
+    const nonce = await snap.read(wallet, gen.contracts.abis.wallet, 'grantNonce');
+    const expected = (0, ids_1.rulesId)({
+        validator: gen.addresses.sessionValidator,
+        agent: (0, viem_1.getAddress)(input.agent),
+        grantNonce: nonce,
+    });
+    let tx;
+    try {
+        tx = await runtime.execute({
+            to: wallet,
+            value: BigInt(0),
+            data: gen.contracts.encodeGrantRules(s),
+        });
+    }
+    catch (error) {
+        throw (0, common_1.wrapSendError)(error);
+    }
+    const { logs } = await (0, common_1.confirmedLogs)(runtime, tx);
+    const granted = gen.contracts.parseRulesGranted(logs, wallet);
+    if (granted.length !== 1 ||
+        granted[0].mode !== 0 ||
+        granted[0].chainNamespace !== input.chainNamespace)
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RECEIPT_MISMATCH, 'SVM grant receipt did not match this operation', { details: { txHash: tx.hash, expected } });
+    // Another owner grant can advance grantNonce between read and inclusion.
+    // The sole matching event from this receipt is the authoritative ID.
+    return { rulesId: granted[0].rulesId, tx };
+}
+/** Snapshot -> all-asset assertion -> revoke -> grant. No sequential fallback. */
+async function prepareSvmReplacement(runtime, gen, wallet, oldId, input) {
+    (0, common_1.assertCanSign)(runtime, 'internal SVM replacement');
+    await verifySvmWallet(runtime, gen, wallet);
+    const snap = await snapshot_1.Snapshot.at(runtime.reader);
+    const owner = await (0, common_1.assertOwner)(runtime, gen, wallet, snap);
+    await verifyAssets(snap, input);
+    const old = await (0, svm_1.readSvmRule)(snap, gen, wallet, oldId, runtime.pushChainNamespace);
+    const s = session(gen, wallet, owner, input, runtime.nowSeconds());
+    const nonce = await snap.read(wallet, gen.contracts.abis.wallet, 'grantNonce');
+    const rulesId = (0, ids_1.rulesId)({
+        validator: gen.addresses.sessionValidator,
+        agent: (0, viem_1.getAddress)(input.agent),
+        grantNonce: nonce,
+    });
+    const calls = [
+        {
+            target: gen.addresses.rulesPolicy,
+            value: BigInt(0),
+            data: gen.contracts.encodeAssertSpentUniversal(old.configId, wallet, old.config.assets.map((a) => a.spent)),
+        },
+        {
+            target: wallet,
+            value: BigInt(0),
+            data: gen.contracts.encodeRevokeRules(oldId),
+        },
+        {
+            target: wallet,
+            value: BigInt(0),
+            data: gen.contracts.encodeGrantRules(s),
+        },
+    ];
+    return {
+        rulesId,
+        oldId,
+        snapshotBlock: snap.blockNumber,
+        data: gen.contracts.encodeExecute(calls),
+    };
+}
+async function replaceSvmWire(runtime, gen, wallet, oldId, input) {
+    const prepared = await prepareSvmReplacement(runtime, gen, wallet, oldId, input);
+    let tx;
+    try {
+        tx = await runtime.execute({
+            to: wallet,
+            value: BigInt(0),
+            data: prepared.data,
+        });
+    }
+    catch (error) {
+        throw (0, common_1.wrapSendError)(error);
+    }
+    const { logs } = await (0, common_1.confirmedLogs)(runtime, tx);
+    const grants = gen.contracts.parseRulesGranted(logs, wallet);
+    const revokes = gen.contracts.parseRulesRevoked(logs, wallet);
+    if (grants.length !== 1 ||
+        grants[0].mode !== 0 ||
+        grants[0].chainNamespace !== input.chainNamespace ||
+        !revokes.some((r) => r.rulesId.toLowerCase() === oldId.toLowerCase()))
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RECEIPT_MISMATCH, 'SVM replacement receipt mismatch', { details: { txHash: tx.hash } });
+    return { rulesId: grants[0].rulesId, replaced: oldId, tx };
+}
+//# sourceMappingURL=svm.js.map

package/src/lib/agentic/presets/catalog.d.ts

@@ -0,0 +1,21 @@
+import type { Address } from 'viem';
+import type { RuleCall, ForeignChainNamespace } from '../agentic.types';
+import type { PresetCategory } from './types';
+/** Internal catalog: reviewed addresses and explicit calls only; never fetched at runtime. */
+export interface PresetChainDefinition {
+    chainNamespace: ForeignChainNamespace;
+    allowedCalls: readonly RuleCall[];
+    /** Exact spenders that need an approval for each non-native supplied asset. */
+    approvals?: readonly {
+        spender: Address;
+        app: string;
+    }[];
+    maxGasPerCall?: bigint;
+}
+export interface PresetDefinition {
+    constant: PresetCategory;
+    name: string;
+    chains: readonly PresetChainDefinition[];
+}
+/** No approved app/address catalog yet. Empty categories must be hidden by UIs. */
+export declare const PRESET_CATALOG: readonly PresetDefinition[];

package/src/lib/agentic/presets/catalog.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESET_CATALOG = void 0;
+/** No approved app/address catalog yet. Empty categories must be hidden by UIs. */
+exports.PRESET_CATALOG = [
+    { constant: 'DEXES', name: 'Popular DEXes', chains: [] },
+    { constant: 'LENDING', name: 'Lending', chains: [] },
+    { constant: 'PREDICTION', name: 'Prediction markets', chains: [] },
+];
+//# sourceMappingURL=catalog.js.map

package/src/lib/agentic/presets/index.d.ts

@@ -0,0 +1,5 @@
+import type { AgenticPresets } from './types';
+import { type PresetDefinition } from './catalog';
+/** Not a public registration API. Tests inject fixtures; production uses the bundled catalog. */
+export declare function buildPresetApi(catalog: readonly PresetDefinition[]): AgenticPresets;
+export declare const agenticPresets: AgenticPresets;

package/src/lib/agentic/presets/index.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agenticPresets = void 0;
+exports.buildPresetApi = buildPresetApi;
+const viem_1 = require("viem");
+const errors_1 = require("../errors");
+const selectors_1 = require("../codec/selectors");
+const catalog_1 = require("./catalog");
+const MAX_UINT256 = (BigInt(1) << BigInt(256)) - BigInt(1);
+const invalid = (message) => new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, message);
+function cap(value, name) {
+    if (value === undefined)
+        return BigInt(0);
+    if (typeof value !== 'bigint' || value < BigInt(0) || value > MAX_UINT256)
+        throw invalid(`${name} must be a uint256 bigint`);
+    return value;
+}
+function copyCall(call) {
+    return {
+        ...call,
+        ...(call.pins
+            ? {
+                pins: call.pins.map((p) => ({
+                    ...p,
+                    ...('token' in p && p.token && typeof p.token === 'object'
+                        ? { token: { ...p.token } }
+                        : {}),
+                })),
+            }
+            : {}),
+    };
+}
+function tokenAddress(token) {
+    const address = typeof token === 'string' ? token : token?.address;
+    if (typeof address !== 'string' || !address.trim())
+        throw invalid('preset asset requires a token address');
+    return address;
+}
+/** Not a public registration API. Tests inject fixtures; production uses the bundled catalog. */
+function buildPresetApi(catalog) {
+    // Detach from the input so neither a returned template nor an input mutation changes the catalog.
+    const entries = catalog.map((p) => ({
+        ...p,
+        chains: p.chains.map((c) => ({
+            ...c,
+            allowedCalls: c.allowedCalls.map(copyCall),
+            approvals: c.approvals?.map((a) => ({ ...a })),
+        })),
+    }));
+    if (new Set(entries.map((e) => e.constant)).size !== entries.length ||
+        entries.some((e) => new Set(e.chains.map((c) => c.chainNamespace)).size !== e.chains.length))
+        throw invalid('duplicate preset or chain in catalog');
+    const api = {
+        list(options) {
+            if (options?.type !== undefined && options.type !== 'CATEGORY')
+                throw invalid('only CATEGORY presets are supported');
+            return {
+                presets: entries.map((p) => ({
+                    type: 'CATEGORY',
+                    constant: p.constant,
+                    name: p.name,
+                    chains: p.chains.map((c) => c.chainNamespace),
+                })),
+            };
+        },
+        get(preset, options = {}) {
+            const entry = entries.find((p) => p.constant === preset);
+            if (!entry)
+                throw invalid(`unknown preset ${String(preset)}`);
+            if (!options || typeof options !== 'object' || Array.isArray(options))
+                throw invalid('preset options must be an object');
+            if (options.agent !== undefined &&
+                (!(0, viem_1.isAddress)(options.agent, { strict: false }) ||
+                    (0, viem_1.getAddress)(options.agent) === viem_1.zeroAddress))
+                throw invalid('preset agent must be a nonzero Push address');
+            if (options.validUntil !== undefined &&
+                (!Number.isSafeInteger(options.validUntil) ||
+                    options.validUntil <= Math.floor(Date.now() / 1000) ||
+                    options.validUntil >= 2 ** 48))
+                throw invalid('preset validUntil must be a future uint48 timestamp');
+            if (options.assets !== undefined && !Array.isArray(options.assets))
+                throw invalid('preset assets must be an array');
+            const chains = options.chainNamespace === undefined
+                ? entry.chains
+                : entry.chains.filter((c) => c.chainNamespace === options.chainNamespace);
+            if (options.chainNamespace !== undefined && !chains.length)
+                throw (0, errors_1.capabilityUnavailable)('presetChain', `preset ${preset} has no approved entry for ${options.chainNamespace}`);
+            if (!chains.length && options.assets?.length)
+                throw (0, errors_1.capabilityUnavailable)('presetCatalog', `preset ${preset} has no approved app entries`);
+            const assets = new Map();
+            for (const asset of options.assets ?? []) {
+                if (!asset || typeof asset !== 'object')
+                    throw invalid('preset asset must be an object');
+                const chain = asset.chainNamespace ?? options.chainNamespace;
+                if (!chain)
+                    throw invalid('each asset needs chainNamespace when no chain filter is supplied');
+                if (!chains.some((c) => c.chainNamespace === chain))
+                    throw invalid(`asset chain ${chain} is outside the selected preset`);
+                const address = tokenAddress(asset.token);
+                if (chain.startsWith('eip155:') &&
+                    !(0, viem_1.isAddress)(address, { strict: false }))
+                    throw invalid('EVM preset asset requires an EVM address');
+                const group = assets.get(chain) ?? [];
+                const key = chain.startsWith('eip155:')
+                    ? address.toLowerCase()
+                    : address;
+                if (group.some((a) => (chain.startsWith('eip155:')
+                    ? tokenAddress(a.token).toLowerCase()
+                    : tokenAddress(a.token)) === key))
+                    throw invalid('duplicate preset asset on the same chain');
+                group.push({
+                    token: typeof asset.token === 'string' ? asset.token : { ...asset.token },
+                    maxPerCall: cap(asset.maxPerCall, 'maxPerCall'),
+                    maxTotal: cap(asset.maxTotal, 'maxTotal'),
+                });
+                assets.set(chain, group);
+            }
+            const rules = chains.map((chain) => {
+                const calls = chain.allowedCalls.map(copyCall);
+                const approvals = new Map();
+                for (const asset of assets.get(chain.chainNamespace) ?? []) {
+                    const token = tokenAddress(asset.token);
+                    if (token === viem_1.zeroAddress ||
+                        (typeof asset.token !== 'string' &&
+                            asset.token.mechanism === 'native'))
+                        continue;
+                    for (const approval of chain.approvals ?? []) {
+                        if (!chain.chainNamespace.startsWith('eip155:'))
+                            throw (0, errors_1.capabilityUnavailable)('presetApproval', 'Solana approvals require a separately reviewed instruction template');
+                        const spender = (0, viem_1.getAddress)(approval.spender);
+                        const target = (0, viem_1.getAddress)(token);
+                        const previous = approvals.get(target);
+                        if (previous && previous !== spender)
+                            throw (0, errors_1.capabilityUnavailable)('presetApproval', 'multiple spenders for one token need a reviewed policy representation; no unrestricted approval is generated');
+                        if (previous)
+                            continue;
+                        approvals.set(target, spender);
+                        calls.push({
+                            target,
+                            selector: 'approve(address,uint256)',
+                            pins: [
+                                { arg: 0, expected: spender },
+                                { arg: 1, max: asset.maxPerCall },
+                            ],
+                            app: approval.app,
+                            label: 'Approve token spending',
+                        });
+                    }
+                }
+                if (!calls.length || calls.length > 32)
+                    throw (0, errors_1.capabilityUnavailable)('presetCalls', 'preset must contain 1..32 allowed calls including approvals');
+                const pairs = new Set();
+                for (const call of calls) {
+                    if (!/^[A-Za-z_$][\w$]*\(.*\)$/.test(call.selector))
+                        throw invalid('preset selectors must be full signatures');
+                    const selector = chain.chainNamespace.startsWith('eip155:')
+                        ? (0, selectors_1.parseSelector)(call.selector).selector
+                        : call.selector;
+                    const pair = `${chain.chainNamespace.startsWith('eip155:')
+                        ? call.target.toLowerCase()
+                        : call.target}:${selector}`;
+                    if (pairs.has(pair))
+                        throw (0, errors_1.capabilityUnavailable)('presetCalls', 'duplicate target/function entries need a reviewed policy representation');
+                    pairs.add(pair);
+                }
+                return {
+                    chainNamespace: chain.chainNamespace,
+                    allowedCalls: calls,
+                    ...(options.agent !== undefined
+                        ? { agent: (0, viem_1.getAddress)(options.agent) }
+                        : {}),
+                    ...(options.validUntil !== undefined
+                        ? { validUntil: options.validUntil }
+                        : {}),
+                    ...(options.assets !== undefined
+                        ? { assets: assets.get(chain.chainNamespace) ?? [] }
+                        : {}),
+                    ...(chain.maxGasPerCall !== undefined
+                        ? { maxGasPerCall: cap(chain.maxGasPerCall, 'maxGasPerCall') }
+                        : {}),
+                };
+            });
+            return { rules };
+        },
+    };
+    // The overload narrows templates only when both required fields were supplied and validated.
+    return Object.freeze(api);
+}
+exports.agenticPresets = buildPresetApi(catalog_1.PRESET_CATALOG);
+//# sourceMappingURL=index.js.map

package/src/lib/agentic/presets/types.d.ts

@@ -0,0 +1,44 @@
+import type { Address } from 'viem';
+import type { Rule, RuleAsset, ForeignChainNamespace } from '../agentic.types';
+export type PresetCategory = 'DEXES' | 'LENDING' | 'PREDICTION';
+export interface Preset {
+    type: 'CATEGORY';
+    constant: PresetCategory;
+    name: string;
+    chains: ForeignChainNamespace[];
+}
+/** An editable review-screen template; both identity and expiry are required by create. */
+export type PresetRuleTemplate = Omit<Rule, 'agent' | 'validUntil'> & {
+    agent?: Address;
+    validUntil?: number;
+};
+export interface PresetAsset {
+    chainNamespace?: ForeignChainNamespace;
+    token: RuleAsset['token'];
+    /** Omitted caps are zero, by the user's October 12 decision. */
+    maxPerCall?: bigint;
+    maxTotal?: bigint;
+}
+export interface PresetOptions {
+    chainNamespace?: ForeignChainNamespace;
+    agent?: Address;
+    validUntil?: number;
+    assets?: PresetAsset[];
+}
+export interface ReadyPresetOptions extends PresetOptions {
+    agent: Address;
+    validUntil: number;
+}
+export interface AgenticPresets {
+    list(options?: {
+        type?: 'CATEGORY';
+    }): {
+        presets: Preset[];
+    };
+    get(preset: PresetCategory, options: ReadyPresetOptions): {
+        rules: Rule[];
+    };
+    get(preset: PresetCategory, options?: PresetOptions): {
+        rules: PresetRuleTemplate[];
+    };
+}

package/src/lib/agentic/presets/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/src/lib/agentic/public-rule.d.ts

@@ -0,0 +1,9 @@
+import { type Address } from 'viem';
+import type { Rule, RuleInput, InternalRule } from './agentic.types';
+import type { AgenticRuntime } from './runtime';
+export declare const WALLET: "agentic:wallet";
+/** Mark authored inputs for normalization after the wallet address is fixed. */
+export declare function publicRules(rules: readonly RuleInput[]): InternalRule[];
+export declare function isPublicRule(rule: InternalRule): boolean;
+export declare function evmPinOffset(selector: Rule['allowedCalls'][number]['selector'], arg: number): number;
+export declare function normalizePublicRule(input: InternalRule, wallet: Address, runtime: AgenticRuntime): Promise<InternalRule>;