@pushchain/core 6.0.26 → 6.0.27-alpha.0

package/src/lib/agentic/codec/rules.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSolanaRule = isSolanaRule;
+exports.isUniversalRule = isUniversalRule;
+exports.ruleChain = ruleChain;
+exports.chainHash = chainHash;
+exports.prepareRules = prepareRules;
+const viem_1 = require("viem");
+const capabilities_1 = require("../capabilities");
+const errors_1 = require("../errors");
+const native_1 = require("./native");
+const session_1 = require("./session");
+const universal_1 = require("./universal");
+const svm_terms_1 = require("./svm-terms");
+const v5_1 = require("../contracts/v5");
+function isSolanaRule(rule) {
+    return (typeof rule.chainNamespace === 'string' &&
+        rule.chainNamespace.startsWith('solana:'));
+}
+function isUniversalRule(rule) {
+    return (rule.chainNamespace !== undefined && !isSolanaRule(rule));
+}
+/** CAIP-2 chain a rule governs: omitted = the connected Push chain. */
+function ruleChain(rule, pushChainNamespace) {
+    return (rule.chainNamespace ?? pushChainNamespace);
+}
+function chainHash(chainNamespace) {
+    return (0, viem_1.keccak256)((0, viem_1.toBytes)(chainNamespace));
+}
+/** Validate before signing. V5 permits several grants for the same agent/chain. */
+function prepareRules(rules, ctx) {
+    if (!Array.isArray(rules)) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'rules must be an array');
+    }
+    return rules.map((rule, i) => {
+        if (!rule || typeof rule !== 'object') {
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `rules[${i}] is not an object`);
+        }
+        if (!(0, viem_1.isAddress)(rule.agent, { strict: false }) ||
+            /^0x0{40}$/i.test(rule.agent)) {
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `rules[${i}].agent must be a non-zero Push address`);
+        }
+        const agent = (0, viem_1.getAddress)(rule.agent);
+        if (ctx.owner && agent === (0, viem_1.getAddress)(ctx.owner)) {
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.AGENT_IS_OWNER, `rules[${i}].agent is the wallet owner; the owner uses the owner door`);
+        }
+        const chainNamespace = ruleChain(rule, ctx.pushChainNamespace);
+        if (isUniversalRule(rule) &&
+            rule.chainNamespace === ctx.pushChainNamespace) {
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `rules[${i}] names the connected Push chain; omit chainNamespace for a native rule`);
+        }
+        if ('ref' in rule) {
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'InternalRule ref is not supported; remove it from the input');
+        }
+        if (isSolanaRule(rule)) {
+            (0, capabilities_1.requireCapability)(ctx.capabilities, capabilities_1.AgenticCapability.UNIVERSAL_SVM_RULES);
+            const terms = ctx.svm?.get(rule);
+            if (!terms || !ctx.gateway)
+                throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'SVM rules require resolved wallet context and validated instruction layouts');
+            return {
+                rule,
+                agent,
+                chainNamespace,
+                svmTerms: terms,
+                session: (0, session_1.buildSession)({
+                    validator: ctx.validator,
+                    rulesPolicy: ctx.rulesPolicy,
+                    agent,
+                    actions: [
+                        {
+                            target: ctx.gateway,
+                            selector: v5_1.SEND_OUTBOUND_SELECTOR,
+                            initData: (0, session_1.encodeEnvelope)(chainNamespace, (0, svm_terms_1.encodeSvmTerms)(terms, ctx.nowSeconds)),
+                        },
+                    ],
+                }),
+            };
+        }
+        if (isUniversalRule(rule)) {
+            return (0, universal_1.encodeUniversalRule)(rule, ctx);
+        }
+        (0, capabilities_1.requireCapability)(ctx.capabilities, capabilities_1.AgenticCapability.NATIVE_RULES);
+        const actions = (0, native_1.nativeRuleToActionTerms)(rule, ctx).map((a) => a.terms);
+        const forbidden = [
+            '0x0000000000000000000000000000000000000000',
+            '0x0000000000000000000000000000000000000001',
+            ...(ctx.forbiddenTargets ?? []),
+        ].map((a) => a.toLowerCase());
+        actions.forEach((terms, j) => {
+            if (forbidden.includes(terms.target.toLowerCase())) {
+                const where = actions.length > 1 ? `rules[${i}].actions[${j}]` : `rules[${i}]`;
+                throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `${where}.target ${terms.target} is a wallet-infrastructure address the contracts refuse as a native target`);
+            }
+        });
+        // One rule, one rule ID: every action is a separate (target, selector)
+        // entry of the same session, each with its own stored terms.
+        const session = (0, session_1.buildSession)({
+            validator: ctx.validator,
+            agent,
+            rulesPolicy: ctx.rulesPolicy,
+            actions: actions.map((terms) => ({
+                target: terms.target,
+                selector: terms.selector,
+                initData: (0, session_1.encodeEnvelope)(chainNamespace, (0, native_1.encodeNativeTerms)(terms)),
+            })),
+        });
+        return { rule, agent, chainNamespace, session, nativeTerms: actions };
+    });
+}
+//# sourceMappingURL=rules.js.map

package/src/lib/agentic/codec/selectors.d.ts

@@ -0,0 +1,19 @@
+import { type AbiParameter } from 'viem';
+import type { AgenticHex, Selector } from '../agentic.types';
+/** Selector URP uses for a value-only native rule (empty calldata). */
+export declare const VALUE_ONLY_SELECTOR: "0xffffffff";
+export interface ParsedSelector {
+    /** 4-byte selector, lowercase. */
+    selector: AgenticHex;
+    /** Canonical signature when the caller supplied one. */
+    signature?: string;
+    /** ABI inputs, only available when the caller supplied a signature. */
+    inputs?: readonly AbiParameter[];
+    valueOnly: boolean;
+}
+/**
+ * Parse a public selector (`'0x617ba037'`, `'supply(address,uint256,address,uint16)'`
+ * or `'value-only'`). A signature is required wherever pins, amounts or
+ * beneficiaries need argument positions; a bare hex selector carries none.
+ */
+export declare function parseSelector(input: Selector | 'value-only'): ParsedSelector;

package/src/lib/agentic/codec/selectors.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VALUE_ONLY_SELECTOR = void 0;
+exports.parseSelector = parseSelector;
+const viem_1 = require("viem");
+const errors_1 = require("../errors");
+/** Selector URP uses for a value-only native rule (empty calldata). */
+exports.VALUE_ONLY_SELECTOR = '0xffffffff';
+const HEX_SELECTOR = /^0x[0-9a-fA-F]{8}$/;
+/**
+ * Parse a public selector (`'0x617ba037'`, `'supply(address,uint256,address,uint16)'`
+ * or `'value-only'`). A signature is required wherever pins, amounts or
+ * beneficiaries need argument positions; a bare hex selector carries none.
+ */
+function parseSelector(input) {
+    if (input === 'value-only') {
+        return { selector: exports.VALUE_ONLY_SELECTOR, valueOnly: true };
+    }
+    if (typeof input !== 'string') {
+        throw invalid(`selector must be a string, got ${typeof input}`);
+    }
+    if (HEX_SELECTOR.test(input)) {
+        const selector = input.toLowerCase();
+        if (selector === exports.VALUE_ONLY_SELECTOR) {
+            return { selector, valueOnly: true };
+        }
+        return { selector, valueOnly: false };
+    }
+    let item;
+    try {
+        const parsed = (0, viem_1.parseAbiItem)(`function ${input}`);
+        if (parsed.type !== 'function')
+            throw new Error('not a function');
+        item = parsed;
+    }
+    catch (cause) {
+        throw invalid(`selector "${input}" is neither a 4-byte hex selector nor a function signature`, cause);
+    }
+    const selector = (0, viem_1.toFunctionSelector)(item).toLowerCase();
+    if (selector === exports.VALUE_ONLY_SELECTOR) {
+        throw invalid(`selector "${input}" collides with the reserved value-only selector`);
+    }
+    return {
+        selector,
+        signature: `${item.name}(${item.inputs.map(canonicalType).join(',')})`,
+        inputs: item.inputs,
+        valueOnly: false,
+    };
+}
+function canonicalType(p) {
+    if (p.type.startsWith('tuple')) {
+        const components = p.components ?? [];
+        return `(${components.map(canonicalType).join(',')})${p.type.slice(5)}`;
+    }
+    return p.type;
+}
+function invalid(message, cause) {
+    return new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, message, { cause });
+}
+//# sourceMappingURL=selectors.js.map

package/src/lib/agentic/codec/session.d.ts

@@ -0,0 +1,54 @@
+import { type AbiParameter, type Address, type Hex } from 'viem';
+/**
+ * The smartsessions `Session` a grant carries (DataTypes.sol:56-86, pinned
+ * v5). The wallet overwrites `salt` with its grant nonce, so the value
+ * sent is irrelevant; it is always zero here.
+ */
+export interface SessionWire {
+    sessionValidator: Address;
+    sessionValidatorInitData: Hex;
+    salt: Hex;
+    userOpPolicies: readonly {
+        policy: Address;
+        initData: Hex;
+    }[];
+    erc7739Policies: {
+        allowedERC7739Content: readonly {
+            appDomainSeparator: Hex;
+            contentNames: readonly string[];
+        }[];
+        erc1271Policies: readonly {
+            policy: Address;
+            initData: Hex;
+        }[];
+    };
+    actions: readonly {
+        actionTargetSelector: Hex;
+        actionTarget: Address;
+        actionPolicies: readonly {
+            policy: Address;
+            initData: Hex;
+        }[];
+    }[];
+    permitERC4337Paymaster: boolean;
+}
+export declare const SESSION_PARAM: AbiParameter;
+export declare const ENVELOPE_VERSION = 1;
+/** V5 URP envelope: abi.encode(uint16(1), string chainNamespace, bytes body). */
+export declare function encodeEnvelope(chainNamespace: string, body: Hex): Hex;
+export declare function decodeEnvelope(initData: Hex): {
+    chainNamespace: string;
+    body: Hex;
+};
+export declare function buildSession(ctx: {
+    validator: Address;
+    agent: Address;
+    rulesPolicy: Address;
+    actions: {
+        target: Address;
+        selector: Hex;
+        initData: Hex;
+    }[];
+}): SessionWire;
+export declare function encodeSession(session: SessionWire): Hex;
+export declare function decodeSession(bytes: Hex): SessionWire;

package/src/lib/agentic/codec/session.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENVELOPE_VERSION = exports.SESSION_PARAM = void 0;
+exports.encodeEnvelope = encodeEnvelope;
+exports.decodeEnvelope = decodeEnvelope;
+exports.buildSession = buildSession;
+exports.encodeSession = encodeSession;
+exports.decodeSession = decodeSession;
+const viem_1 = require("viem");
+const v5_1 = require("../contracts/abi/v5");
+const ids_1 = require("./ids");
+const errors_1 = require("../errors");
+exports.SESSION_PARAM = (0, viem_1.getAbiItem)({
+    abi: v5_1.AGW_ABI,
+    name: 'grantRules',
+}).inputs[0];
+const ZERO_SALT = `0x${'00'.repeat(32)}`;
+exports.ENVELOPE_VERSION = 1;
+/** V5 URP envelope: abi.encode(uint16(1), string chainNamespace, bytes body). */
+function encodeEnvelope(chainNamespace, body) {
+    return (0, viem_1.encodeAbiParameters)([{ type: 'uint16' }, { type: 'string' }, { type: 'bytes' }], [exports.ENVELOPE_VERSION, chainNamespace, body]);
+}
+function decodeEnvelope(initData) {
+    try {
+        const [version, chainNamespace, body] = (0, viem_1.decodeAbiParameters)([{ type: 'uint16' }, { type: 'string' }, { type: 'bytes' }], initData);
+        if (version !== exports.ENVELOPE_VERSION)
+            throw new Error(`unsupported rules envelope version ${version}`);
+        return { chainNamespace, body };
+    }
+    catch (cause) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RULE_READ_FAILED, 'malformed URP envelope', {
+            cause,
+        });
+    }
+}
+function buildSession(ctx) {
+    return {
+        sessionValidator: ctx.validator,
+        sessionValidatorInitData: (0, ids_1.agentConfig)(ctx.agent),
+        salt: ZERO_SALT,
+        userOpPolicies: [],
+        erc7739Policies: { allowedERC7739Content: [], erc1271Policies: [] },
+        actions: ctx.actions.map((a) => ({
+            actionTargetSelector: a.selector,
+            actionTarget: a.target,
+            actionPolicies: [{ policy: ctx.rulesPolicy, initData: a.initData }],
+        })),
+        permitERC4337Paymaster: false,
+    };
+}
+function encodeSession(session) {
+    return (0, viem_1.encodeAbiParameters)([exports.SESSION_PARAM], [session]);
+}
+function decodeSession(bytes) {
+    try {
+        const [session] = (0, viem_1.decodeAbiParameters)([exports.SESSION_PARAM], bytes);
+        return session;
+    }
+    catch (cause) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RULE_READ_FAILED, 'malformed Session encoding', {
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=session.js.map

package/src/lib/agentic/codec/svm-accounts.d.ts

@@ -0,0 +1,35 @@
+import { type Address, type Hex } from 'viem';
+import type { AssetCapWire } from './universal-terms';
+export declare function svmKey(value: string): Hex;
+/** Gateway is supplied by the selected cluster registry, never a global hard-coded program. */
+export declare function deriveAgwSvmCea(wallet: Address, gatewayProgram: string): {
+    address: Hex;
+    bump: number;
+};
+export interface SvmTokenAccountInput {
+    mint: string;
+    tokenProgram?: string;
+}
+export type ResolvedSvmAsset = {
+    kind: 'native';
+    cap: AssetCapWire;
+} | {
+    kind: 'spl';
+    cap: AssetCapWire;
+    mint: string;
+    tokenProgram?: string;
+};
+/** Every resolved SPL cap contributes an ATA; caller cannot omit a listed mint. */
+export declare function resolveAgwSvmRuleContext(wallet: Address, gatewayProgram: string, assets: readonly ResolvedSvmAsset[], outputs?: readonly SvmTokenAccountInput[]): {
+    assets: AssetCapWire[];
+    expectedCEA: Hex;
+    gatewayProgram: Hex;
+    ceaAccounts: Hex[];
+};
+export declare function deriveAgwSvmAta(owner: string, token: SvmTokenAccountInput): Hex;
+/** Includes every listed mint and swap-output mint. Native SOL is already covered by the CEA. */
+export declare function deriveAgwSvmValueAccounts(wallet: Address, gatewayProgram: string, tokens: readonly SvmTokenAccountInput[], outputs?: readonly SvmTokenAccountInput[]): {
+    expectedCEA: Hex;
+    gatewayProgram: Hex;
+    ceaAccounts: Hex[];
+};

package/src/lib/agentic/codec/svm-accounts.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svmKey = svmKey;
+exports.deriveAgwSvmCea = deriveAgwSvmCea;
+exports.resolveAgwSvmRuleContext = resolveAgwSvmRuleContext;
+exports.deriveAgwSvmAta = deriveAgwSvmAta;
+exports.deriveAgwSvmValueAccounts = deriveAgwSvmValueAccounts;
+const web3_js_1 = require("@solana/web3.js");
+const viem_1 = require("viem");
+const svm_terms_1 = require("./svm-terms");
+const SPL_TOKEN = new web3_js_1.PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
+const TOKEN_2022 = new web3_js_1.PublicKey('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
+const ASSOCIATED_TOKEN = new web3_js_1.PublicKey('ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL');
+function svmKey(value) {
+    try {
+        if (value.startsWith('0x')) {
+            (0, svm_terms_1.exactHex)(value, 32, 'pubkey');
+            return (0, viem_1.bytesToHex)(new web3_js_1.PublicKey((0, viem_1.hexToBytes)(value)).toBytes());
+        }
+        return (0, viem_1.bytesToHex)(new web3_js_1.PublicKey(value).toBytes());
+    }
+    catch {
+        throw (0, svm_terms_1.svmInvalid)('invalid Solana public key');
+    }
+}
+function key(value) {
+    return new web3_js_1.PublicKey((0, viem_1.hexToBytes)(svmKey(value)));
+}
+/** Gateway is supplied by the selected cluster registry, never a global hard-coded program. */
+function deriveAgwSvmCea(wallet, gatewayProgram) {
+    if (key(gatewayProgram).equals(web3_js_1.PublicKey.default))
+        throw (0, svm_terms_1.svmInvalid)('gateway program cannot be zero');
+    const [pda, bump] = web3_js_1.PublicKey.findProgramAddressSync([Buffer.from('push_identity'), Buffer.from((0, viem_1.hexToBytes)((0, viem_1.getAddress)(wallet)))], key(gatewayProgram));
+    return { address: (0, viem_1.bytesToHex)(pda.toBytes()), bump };
+}
+/** Every resolved SPL cap contributes an ATA; caller cannot omit a listed mint. */
+function resolveAgwSvmRuleContext(wallet, gatewayProgram, assets, outputs = []) {
+    if (!assets.length || assets.length > svm_terms_1.SVM_LIMITS.assets)
+        throw (0, svm_terms_1.svmInvalid)('resolved assets must contain 1..8 entries');
+    const tokens = assets.flatMap((a) => a.kind === 'spl' ? [{ mint: a.mint, tokenProgram: a.tokenProgram }] : []);
+    return {
+        ...deriveAgwSvmValueAccounts(wallet, gatewayProgram, tokens, outputs),
+        assets: assets.map((a) => a.cap),
+    };
+}
+function deriveAgwSvmAta(owner, token) {
+    const mint = key(token.mint), program = token.tokenProgram ? key(token.tokenProgram) : SPL_TOKEN;
+    if (mint.equals(web3_js_1.PublicKey.default))
+        throw (0, svm_terms_1.svmInvalid)('native SOL uses the CEA, not an ATA');
+    if (!program.equals(SPL_TOKEN) && !program.equals(TOKEN_2022))
+        throw (0, svm_terms_1.svmInvalid)('unsupported token program');
+    const [ata] = web3_js_1.PublicKey.findProgramAddressSync([key(owner).toBuffer(), program.toBuffer(), mint.toBuffer()], ASSOCIATED_TOKEN);
+    return (0, viem_1.bytesToHex)(ata.toBytes());
+}
+/** Includes every listed mint and swap-output mint. Native SOL is already covered by the CEA. */
+function deriveAgwSvmValueAccounts(wallet, gatewayProgram, tokens, outputs = []) {
+    const expectedCEA = deriveAgwSvmCea(wallet, gatewayProgram).address;
+    const ceaAccounts = [
+        ...new Set([
+            expectedCEA,
+            ...[...tokens, ...outputs].map((t) => deriveAgwSvmAta(expectedCEA, t)),
+        ]),
+    ];
+    if (ceaAccounts.length > svm_terms_1.SVM_LIMITS.ceaAccounts)
+        throw (0, svm_terms_1.svmInvalid)('derived CEA value-account set exceeds 16');
+    return { expectedCEA, gatewayProgram: svmKey(gatewayProgram), ceaAccounts };
+}
+//# sourceMappingURL=svm-accounts.js.map

package/src/lib/agentic/codec/svm-idl.d.ts

@@ -0,0 +1,11 @@
+/** Compile named Anchor IDL constraints. Unsupported layouts are never guessed. */
+import type { Idl } from '@coral-xyz/anchor';
+import { type Hex } from 'viem';
+import type { SolanaRule } from '../agentic.types';
+import { type SvmTermsWire } from './svm-terms';
+export type SvmResolvedContext = Pick<SvmTermsWire, 'assets' | 'expectedCEA' | 'gatewayProgram' | 'ceaAccounts'> & {
+    /** Verified mint -> wallet ATA mapping, including output mints. */
+    tokenAccounts: ReadonlyMap<Hex, Hex>;
+};
+export declare function svmIdlInstruction(idl: Idl, name: string): import("@coral-xyz/anchor/dist/cjs/idl").IdlInstruction;
+export declare function compileSvmIdlRule(rule: SolanaRule, ctx: SvmResolvedContext, now: number): SvmTermsWire;

package/src/lib/agentic/codec/svm-idl.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svmIdlInstruction = svmIdlInstruction;
+exports.compileSvmIdlRule = compileSvmIdlRule;
+const viem_1 = require("viem");
+const svm_accounts_1 = require("./svm-accounts");
+const svm_terms_1 = require("./svm-terms");
+const widths = {
+    bool: 1,
+    u8: 1,
+    i8: 1,
+    u16: 2,
+    i16: 2,
+    u32: 4,
+    i32: 4,
+    f32: 4,
+    u64: 8,
+    i64: 8,
+    f64: 8,
+    u128: 16,
+    i128: 16,
+    u256: 32,
+    i256: 32,
+    pubkey: 32,
+};
+function width(type) {
+    if (typeof type === 'string' && widths[type])
+        return widths[type];
+    if (type && typeof type === 'object' && 'array' in type) {
+        const a = type.array;
+        if (Array.isArray(a) &&
+            a.length === 2 &&
+            Number.isSafeInteger(a[1]) &&
+            a[1] > 0) {
+            const size = width(a[0]) * a[1];
+            if (size <= 1024)
+                return size;
+        }
+    }
+    throw (0, svm_terms_1.svmInvalid)('IDL field layout is not supported: use fixed-width primitives or fixed arrays');
+}
+function svmIdlInstruction(idl, name) {
+    if (!idl || !Array.isArray(idl.instructions) || typeof name !== 'string')
+        throw (0, svm_terms_1.svmInvalid)('instruction requires an Anchor IDL and name');
+    const found = idl.instructions.filter((i) => i.name === name);
+    if (found.length !== 1)
+        throw (0, svm_terms_1.svmInvalid)(`IDL instruction ${name} must exist exactly once`);
+    const ix = found[0];
+    if (!Array.isArray(ix.discriminator) ||
+        ix.discriminator.length !== 8 ||
+        ix.discriminator.some((b) => !Number.isInteger(b) || b < 0 || b > 255))
+        throw (0, svm_terms_1.svmInvalid)('Anchor IDL discriminator must contain eight bytes');
+    return ix;
+}
+function accountNames(accounts, prefix = '') {
+    return accounts.flatMap((entry) => {
+        if (!entry ||
+            typeof entry !== 'object' ||
+            !('name' in entry) ||
+            typeof entry.name !== 'string')
+            throw (0, svm_terms_1.svmInvalid)('invalid IDL account');
+        const name = prefix + entry.name;
+        if ('accounts' in entry)
+            throw (0, svm_terms_1.svmInvalid)('nested IDL accounts are not supported by the instruction resolver');
+        if ('optional' in entry && entry.optional)
+            throw (0, svm_terms_1.svmInvalid)('optional IDL accounts are not supported for rules');
+        return [name];
+    });
+}
+function resolveAccount(ref, ctx) {
+    if (!ref || typeof ref !== 'object')
+        throw (0, svm_terms_1.svmInvalid)('invalid named account reference');
+    if (ref.kind === 'walletCEA')
+        return ctx.expectedCEA;
+    if (ref.kind === 'address')
+        return (0, svm_accounts_1.svmKey)(ref.address);
+    if (ref.kind === 'walletATA') {
+        const ata = ctx.tokenAccounts.get((0, svm_accounts_1.svmKey)(ref.token));
+        if (!ata)
+            throw (0, svm_terms_1.svmInvalid)('walletATA mint must be listed in assets or outputTokens');
+        return ata;
+    }
+    throw (0, svm_terms_1.svmInvalid)('unknown named account reference');
+}
+function unsigned(f) {
+    if (typeof f.type !== 'string' || !/^u(8|16|32|64)$/.test(f.type))
+        throw (0, svm_terms_1.svmInvalid)('range/ratio constraints require unsigned integer fields of at most eight bytes');
+}
+function bound(v, len) {
+    if (typeof v !== 'bigint' ||
+        v < BigInt(0) ||
+        v >= BigInt(1) << BigInt(len * 8))
+        throw (0, svm_terms_1.svmInvalid)('field constraint exceeds its unsigned width');
+    return `0x${v.toString(16).padStart(64, '0')}`;
+}
+function compileSvmIdlRule(rule, ctx, now) {
+    if (!Array.isArray(rule.allowedInstructions) ||
+        !rule.allowedInstructions.length ||
+        rule.allowedInstructions.length > 32)
+        throw (0, svm_terms_1.svmInvalid)('allowedInstructions must contain 1..32 entries');
+    const terms = {
+        validUntil: rule.validUntil,
+        maxGasPerCall: rule.maxGasPerCall,
+        assets: ctx.assets,
+        expectedCEA: ctx.expectedCEA,
+        gatewayProgram: ctx.gatewayProgram,
+        ceaAccounts: ctx.ceaAccounts,
+        programs: [],
+        pins: [],
+        dataPins: [],
+    };
+    const programs = [], pins = [], dataPins = [];
+    for (const [ruleIndex, entry] of rule.allowedInstructions.entries()) {
+        const ix = svmIdlInstruction(entry.instruction?.idl, entry.instruction?.name);
+        const program = (0, svm_accounts_1.svmKey)(entry.program);
+        if ((0, svm_accounts_1.svmKey)(entry.instruction.idl.address) !== program)
+            throw (0, svm_terms_1.svmInvalid)('IDL address differs from rule program');
+        if (!Array.isArray(ix.accounts) || !Array.isArray(entry.accounts))
+            throw (0, svm_terms_1.svmInvalid)('instruction accounts are required');
+        const names = accountNames(ix.accounts);
+        if (new Set(names).size !== names.length)
+            throw (0, svm_terms_1.svmInvalid)('duplicate IDL account names');
+        programs.push({
+            program,
+            discriminator: (0, viem_1.bytesToHex)(Uint8Array.from([
+                ...ix.discriminator,
+                ...Array(8 - ix.discriminator.length).fill(0),
+            ])),
+            discriminatorLen: ix.discriminator.length,
+            dataless: false,
+            maxAccounts: entry.maxAccounts ?? names.length,
+        });
+        for (const a of entry.accounts) {
+            const accountIndex = names.indexOf(a.name);
+            if (accountIndex < 0)
+                throw (0, svm_terms_1.svmInvalid)(`unknown IDL account ${a.name}`);
+            pins.push({
+                ruleIndex,
+                accountIndex,
+                expected: resolveAccount(a.expected, ctx),
+            });
+        }
+        const fields = new Map();
+        let offset = ix.discriminator.length;
+        // Reject variable/nested-defined layouts rather than claiming a reliable offset.
+        for (const arg of ix.args) {
+            if (fields.has(arg.name))
+                throw (0, svm_terms_1.svmInvalid)('duplicate IDL field name');
+            const len = width(arg.type);
+            fields.set(arg.name, { offset, len, type: arg.type });
+            offset += len;
+        }
+        if (offset > 1024)
+            throw (0, svm_terms_1.svmInvalid)('IDL instruction data exceeds the policy limit');
+        const field = (name) => {
+            const f = fields.get(name);
+            if (!f)
+                throw (0, svm_terms_1.svmInvalid)(`unknown IDL field ${name}`);
+            return f;
+        };
+        if (entry.fields !== undefined && !Array.isArray(entry.fields))
+            throw (0, svm_terms_1.svmInvalid)('fields must be an array');
+        for (const constraint of entry.fields ?? []) {
+            const keys = ['equals', 'min', 'max', 'minRatio'].filter((k) => k in constraint);
+            if (keys.length !== 1)
+                throw (0, svm_terms_1.svmInvalid)('each field constraint must specify exactly one comparison');
+            const f = field('numerator' in constraint ? constraint.numerator : constraint.name);
+            const p = {
+                ruleIndex,
+                fromEnd: false,
+                offset: f.offset,
+                offsetB: 0,
+                len: f.len,
+                mode: svm_terms_1.SvmDataPinMode.EQ,
+                expected: `0x${'00'.repeat(32)}`,
+                num: BigInt(0),
+                den: BigInt(0),
+            };
+            if ('minRatio' in constraint) {
+                unsigned(f);
+                const b = field(constraint.denominator);
+                unsigned(b);
+                if (f.len !== b.len)
+                    throw (0, svm_terms_1.svmInvalid)('ratio fields must have the same width');
+                Object.assign(p, {
+                    mode: svm_terms_1.SvmDataPinMode.RATIO_GTE_LE,
+                    offsetB: b.offset,
+                    num: constraint.minRatio.num,
+                    den: constraint.minRatio.den,
+                });
+            }
+            else if ('min' in constraint || 'max' in constraint) {
+                unsigned(f);
+                const min = 'min' in constraint;
+                p.mode = min ? svm_terms_1.SvmDataPinMode.GTE_LE : svm_terms_1.SvmDataPinMode.LTE_LE;
+                p.expected = bound(min ? constraint.min : constraint.max, f.len);
+            }
+            else {
+                let bytes;
+                if (typeof constraint.equals === 'bigint') {
+                    unsigned(f);
+                    bound(constraint.equals, f.len);
+                    bytes = Uint8Array.from({ length: f.len }, (_, i) => Number((constraint.equals >> BigInt(8 * i)) & BigInt(255)));
+                }
+                else if (typeof constraint.equals === 'boolean') {
+                    if (f.type !== 'bool')
+                        throw (0, svm_terms_1.svmInvalid)('boolean equality requires a bool field');
+                    bytes = Uint8Array.of(constraint.equals ? 1 : 0);
+                }
+                else {
+                    if (!/^0x(?:[a-fA-F0-9]{2})*$/.test(constraint.equals))
+                        throw (0, svm_terms_1.svmInvalid)('equality requires exact hex bytes');
+                    bytes = (0, viem_1.hexToBytes)(constraint.equals);
+                }
+                if (bytes.length !== f.len || f.len > 32)
+                    throw (0, svm_terms_1.svmInvalid)('equality value must match field width (at most 32 bytes)');
+                p.expected = `0x${(0, viem_1.bytesToHex)(bytes).slice(2).padEnd(64, '0')}`;
+            }
+            dataPins.push(p);
+        }
+    }
+    Object.assign(terms, { programs, pins, dataPins });
+    (0, svm_terms_1.validateSvmTerms)(terms, now);
+    return terms;
+}
+//# sourceMappingURL=svm-idl.js.map