@pushchain/core 6.0.26 → 6.0.27-alpha.1

package/src/lib/agentic/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENTIC = exports.AgenticRevertError = exports.AgenticError = exports.AGENTIC_ERROR_CODE = void 0;
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "AGENTIC_ERROR_CODE", { enumerable: true, get: function () { return errors_1.AGENTIC_ERROR_CODE; } });
+Object.defineProperty(exports, "AgenticError", { enumerable: true, get: function () { return errors_1.AgenticError; } });
+Object.defineProperty(exports, "AgenticRevertError", { enumerable: true, get: function () { return errors_1.AgenticRevertError; } });
+var constants_1 = require("./constants");
+Object.defineProperty(exports, "AGENTIC", { enumerable: true, get: function () { return constants_1.AGENTIC; } });
+//# sourceMappingURL=index.js.map

package/src/lib/agentic/management/common.d.ts

@@ -0,0 +1,29 @@
+import { type Address, type Hex, type Log } from 'viem';
+import type { MultiCall, UniversalTxResponse } from '../../orchestrator/orchestrator.types';
+import { PROGRESS_HOOK } from '../../progress-hook/progress-hook.types';
+import type { AgenticGeneration } from '../deployments';
+import type { AgenticRuntime } from '../runtime';
+import type { AgenticProgressHook } from '../agentic.types';
+import { Snapshot } from '../reads/snapshot';
+export declare function emitAgentic(runtime: AgenticRuntime, perCall: AgenticProgressHook | undefined, id: PROGRESS_HOOK, ...args: unknown[]): void;
+export declare function assertCanSign(runtime: AgenticRuntime, operation: string): void;
+/** Owner-only management writes: the connected signer's Push identity must be the stored owner. */
+export declare function assertOwner(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, snap: Snapshot): Promise<Address>;
+/**
+ * Send owner calls through the signer's ordinary transaction path: one call
+ * as a plain transaction, several as the signer's batch (UEA multicall,
+ * EIP-7702 atomic batch, or the documented sequential fallback for a Push EOA
+ * without 7702 — reported through `atomic` / `transactionHashes`).
+ */
+export declare function sendOwnerCalls(runtime: AgenticRuntime, calls: MultiCall[], progressHook: AgenticProgressHook | undefined): Promise<UniversalTxResponse>;
+/**
+ * Wait for every Push transaction the operation produced and return their
+ * logs in submission order. A reverted transaction raises AgenticRevertError
+ * carrying all hashes.
+ */
+export declare function confirmedLogs(runtime: AgenticRuntime, tx: UniversalTxResponse): Promise<{
+    logs: Log[];
+    hashes: Hex[];
+}>;
+/** Normalize a send failure: keep batch hashes and decoded revert data. */
+export declare function wrapSendError(err: unknown): unknown;

package/src/lib/agentic/management/common.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitAgentic = emitAgentic;
+exports.assertCanSign = assertCanSign;
+exports.assertOwner = assertOwner;
+exports.sendOwnerCalls = sendOwnerCalls;
+exports.confirmedLogs = confirmedLogs;
+exports.wrapSendError = wrapSendError;
+const tslib_1 = require("tslib");
+const viem_1 = require("viem");
+const errors_1 = require("../../orchestrator/internals/errors");
+const progress_hook_1 = tslib_1.__importDefault(require("../../progress-hook/progress-hook"));
+const errors_2 = require("../errors");
+const revert_1 = require("../revert");
+function emitAgentic(runtime, perCall, id, ...args) {
+    runtime.emit(progress_hook_1.default[id](...args), perCall);
+}
+function assertCanSign(runtime, operation) {
+    if (runtime.isReadOnly) {
+        throw new errors_2.AgenticError(errors_2.AGENTIC_ERROR_CODE.READ_ONLY, `${operation} needs a signer; this client was initialized read-only`);
+    }
+}
+/** Owner-only management writes: the connected signer's Push identity must be the stored owner. */
+async function assertOwner(runtime, gen, wallet, snap) {
+    const owner = (0, viem_1.getAddress)(await snap.read(wallet, gen.contracts.abis.wallet, 'owner'));
+    const signer = runtime.signerPushAccount();
+    if (owner !== signer) {
+        throw new errors_2.AgenticError(errors_2.AGENTIC_ERROR_CODE.NOT_WALLET_OWNER, `${signer} is not the owner of ${wallet} (owner is ${owner})`, {
+            hint: 'Rule and label writes are owner-only. Initialize with the owner signer.',
+        });
+    }
+    return owner;
+}
+/**
+ * Send owner calls through the signer's ordinary transaction path: one call
+ * as a plain transaction, several as the signer's batch (UEA multicall,
+ * EIP-7702 atomic batch, or the documented sequential fallback for a Push EOA
+ * without 7702 — reported through `atomic` / `transactionHashes`).
+ */
+async function sendOwnerCalls(runtime, calls, progressHook) {
+    if (calls.length === 0)
+        throw new Error('sendOwnerCalls needs at least one call');
+    const options = progressHook ? { progressHook } : undefined;
+    if (calls.length === 1) {
+        return runtime.execute({ to: calls[0].to, value: calls[0].value, data: calls[0].data }, options);
+    }
+    return runtime.execute({ to: calls[0].to, value: BigInt(0), data: calls }, options);
+}
+/**
+ * Wait for every Push transaction the operation produced and return their
+ * logs in submission order. A reverted transaction raises AgenticRevertError
+ * carrying all hashes.
+ */
+async function confirmedLogs(runtime, tx) {
+    const hashes = (tx.transactionHashes ?? [tx.hash]);
+    const unavailable = (cause) => new errors_2.AgenticError(errors_2.AGENTIC_ERROR_CODE.RECEIPT_UNAVAILABLE, `submitted ${tx.hash} but could not read its receipt: ${cause instanceof Error ? cause.message : String(cause)}`, {
+        hint: 'The transaction may still land. Check these hashes before retrying.',
+        details: { txHash: tx.hash, transactionHashes: hashes },
+        cause,
+    });
+    let receipt;
+    try {
+        receipt = await tx.wait();
+    }
+    catch (cause) {
+        throw unavailable(cause);
+    }
+    if (hashes.length === 1) {
+        if (receipt.status !== 1) {
+            throw new errors_2.AgenticRevertError(`Push transaction ${tx.hash} reverted`, {
+                cause: { txHash: tx.hash },
+            });
+        }
+        return { logs: receipt.logs, hashes };
+    }
+    const logs = [];
+    for (const hash of hashes) {
+        let r;
+        try {
+            r = await runtime.reader.getTransactionReceipt({ hash });
+        }
+        catch (cause) {
+            throw unavailable(cause);
+        }
+        if (r.status !== 'success') {
+            throw new errors_2.AgenticRevertError(`Push transaction ${hash} reverted`, {
+                cause: { txHash: hash },
+            });
+        }
+        logs.push(...r.logs);
+    }
+    return { logs, hashes };
+}
+/** Normalize a send failure: keep batch hashes and decoded revert data. */
+function wrapSendError(err) {
+    if (err instanceof errors_2.AgenticError || err instanceof errors_2.AgenticRevertError)
+        return err;
+    const decoded = (0, revert_1.decodeAgenticRevert)(err);
+    if (err instanceof errors_1.PushChainBatchExecutionError) {
+        return new errors_2.AgenticRevertError(err.message, {
+            decodedError: decoded ?? err.decodedError,
+            cause: err,
+        });
+    }
+    if (decoded || err instanceof errors_1.PushChainExecutionError) {
+        const e = err;
+        return new errors_2.AgenticRevertError(e?.message ?? decoded?.name ?? 'AGW revert', {
+            decodedError: decoded ?? e?.decodedError,
+            gatewayTxHash: e?.gatewayTxHash,
+            agenticCode: decoded?.name,
+            cause: err,
+        });
+    }
+    return err;
+}
+//# sourceMappingURL=common.js.map

package/src/lib/agentic/management/create.d.ts

@@ -0,0 +1,4 @@
+import type { AgenticRuntime } from '../runtime';
+import type { InternalCreateOptions, CreateResult } from '../agentic.types';
+/** One index-bound v6 factory call deploys and grants atomically for EOA/UEA owners. */
+export declare function createWallet(runtime: AgenticRuntime, label: string, options: InternalCreateOptions): Promise<CreateResult>;

package/src/lib/agentic/management/create.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWallet = createWallet;
+const duplicates_1 = require("./duplicates");
+const viem_1 = require("viem");
+const progress_hook_types_1 = require("../../progress-hook/progress-hook.types");
+const capabilities_1 = require("../capabilities");
+const deployments_1 = require("../deployments");
+const ids_1 = require("../codec/ids");
+const prepare_1 = require("./prepare");
+const label_1 = require("./label");
+const errors_1 = require("../errors");
+const snapshot_1 = require("../reads/snapshot");
+const wallets_1 = require("../reads/wallets");
+const common_1 = require("./common");
+/** One index-bound v6 factory call deploys and grants atomically for EOA/UEA owners. */
+async function createWallet(runtime, label, options) {
+    const hook = options?.progressHook;
+    (0, label_1.assertLabel)(label);
+    if (!options || !Array.isArray(options.rules)) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'options.rules is required (use [] for a bare wallet)');
+    }
+    (0, common_1.assertCanSign)(runtime, 'agentic.create');
+    const gen = (0, deployments_1.currentGeneration)(runtime.network);
+    (0, capabilities_1.requireCapability)(gen.capabilities, capabilities_1.AgenticCapability.WALLET_READS);
+    await (0, deployments_1.verifyFactoryWiring)(runtime.reader, gen);
+    const owner = runtime.signerPushAccount();
+    const snap = await snapshot_1.Snapshot.at(runtime.reader);
+    const index = await (0, wallets_1.walletCount)(snap, gen, owner);
+    const [predicted, deployed] = await snap.read(gen.addresses.factory, gen.contracts.abis.factory, 'predictWallet', [owner, index]);
+    const wallet = (0, viem_1.getAddress)(predicted);
+    const mirror = (0, ids_1.deriveWallet)({
+        factory: gen.addresses.factory,
+        walletImplementation: gen.addresses.walletImplementation,
+        owner,
+        index,
+    });
+    if (wallet !== mirror || deployed || (await snap.code(wallet))) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INDEX_RACE, `next wallet slot ${index} for ${owner} is not a fresh counterfactual address`, { details: { wallet, mirror, deployed } });
+    }
+    const prepared = await (0, prepare_1.prepareWalletRules)(runtime, gen, owner, wallet, options.rules, snap);
+    (0, duplicates_1.assertNoDuplicateRules)(prepared);
+    const selfTarget = prepared.findIndex((p) => p.nativeTerms?.some((t) => t.target === wallet));
+    if (selfTarget >= 0) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `rules[${selfTarget}].target is the wallet being created; the contracts refuse it as a native target`);
+    }
+    (0, common_1.emitAgentic)(runtime, hook, progress_hook_types_1.PROGRESS_HOOK.AGENTIC_TX_101, wallet, Number(index), false);
+    // A fresh wallet's grant nonce starts at 0 and increments per grant.
+    const predictedIds = prepared.map((p, i) => (0, ids_1.rulesId)({
+        validator: gen.addresses.sessionValidator,
+        agent: p.agent,
+        grantNonce: BigInt(i),
+    }));
+    if (prepared.length > 8)
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'create accepts at most eight initial rules');
+    const calls = [
+        {
+            to: gen.addresses.factory,
+            value: BigInt(0),
+            data: gen.contracts.encodeCreateWalletAt(owner, index, wallet, label, prepared.map((p) => p.session)),
+        },
+    ];
+    (0, common_1.emitAgentic)(runtime, hook, progress_hook_types_1.PROGRESS_HOOK.AGENTIC_TX_102, wallet, 'single');
+    let tx;
+    try {
+        tx = await (0, common_1.sendOwnerCalls)(runtime, calls, hook);
+    }
+    catch (err) {
+        const wrapped = atomicCreateFailure(err);
+        emitFailure(runtime, hook, wrapped);
+        throw wrapped;
+    }
+    let logs;
+    try {
+        ({ logs } = await (0, common_1.confirmedLogs)(runtime, tx));
+    }
+    catch (err) {
+        const wrapped = atomicCreateFailure(err);
+        emitFailure(runtime, hook, wrapped);
+        throw wrapped;
+    }
+    const deployedEv = gen.contracts.parseWalletDeployed(logs, gen.addresses.factory);
+    const granted = gen.contracts
+        .parseRulesGranted(logs, wallet)
+        .map((g) => g.rulesId);
+    if (deployedEv.length !== 1 ||
+        deployedEv[0].wallet !== wallet ||
+        deployedEv[0].index !== index) {
+        const err = new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RECEIPT_MISMATCH, `createWallet produced ${deployedEv.map((d) => `${d.wallet}#${d.index}`).join(', ') ||
+            'no wallet'}, expected ${wallet}#${index}; grants targeted ${wallet}`, {
+            hint: 'The receipt does not describe the requested atomic creation. Inspect the submitted hash before retrying.',
+            details: {
+                expected: wallet,
+                deployed: deployedEv,
+                grantedRulesIds: granted,
+                txHash: tx.hash,
+            },
+        });
+        emitFailure(runtime, hook, err);
+        throw err;
+    }
+    if (!sameIds(granted, predictedIds)) {
+        const err = new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RECEIPT_MISMATCH, 'RulesGranted events do not match the requested rules in order', { details: { granted, predicted: predictedIds, txHash: tx.hash } });
+        emitFailure(runtime, hook, err);
+        throw err;
+    }
+    if (granted.length > 0)
+        (0, common_1.emitAgentic)(runtime, hook, progress_hook_types_1.PROGRESS_HOOK.AGENTIC_TX_104, granted);
+    (0, common_1.emitAgentic)(runtime, hook, progress_hook_types_1.PROGRESS_HOOK.AGENTIC_TX_199_01, 'create', tx.hash);
+    return {
+        wallet,
+        index: Number(index),
+        rulesIds: granted,
+        tx,
+    };
+}
+function sameIds(a, b) {
+    return (a.length === b.length &&
+        a.every((x, i) => x.toLowerCase() === b[i].toLowerCase()));
+}
+function atomicCreateFailure(error) {
+    const wrapped = (0, common_1.wrapSendError)(error);
+    if (['IndexMismatch', 'IntentWalletMismatch'].includes(wrapped?.decodedError?.name ?? ''))
+        return new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INDEX_RACE, 'the predicted wallet slot changed; atomic creation committed nothing', {
+            cause: wrapped,
+            details: {
+                committed: false,
+                walletDeployed: false,
+                grantedRulesIds: [],
+            },
+        });
+    return wrapped;
+}
+function emitFailure(runtime, hook, err) {
+    const e = err;
+    (0, common_1.emitAgentic)(runtime, hook, progress_hook_types_1.PROGRESS_HOOK.AGENTIC_TX_199_02, 'create', e?.code ?? 'UNKNOWN', e?.message ?? String(err), e?.decodedError);
+}
+//# sourceMappingURL=create.js.map

package/src/lib/agentic/management/duplicates.d.ts

@@ -0,0 +1,4 @@
+import type { PreparedRule } from '../codec/rules';
+import type { ActiveRule } from '../reads/rules';
+/** SDK creation policy; existing contract overlaps still use AMBIGUOUS_RULE at send. */
+export declare function assertNoDuplicateRules(prepared: readonly PreparedRule[], existing?: readonly ActiveRule[]): void;

package/src/lib/agentic/management/duplicates.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoDuplicateRules = assertNoDuplicateRules;
+const viem_1 = require("viem");
+const rules_1 = require("../codec/rules");
+const errors_1 = require("../errors");
+/** SDK creation policy; existing contract overlaps still use AMBIGUOUS_RULE at send. */
+function assertNoDuplicateRules(prepared, existing = []) {
+    const keys = new Set(existing.map((r) => `${(0, viem_1.getAddress)(r.agent)}:${r.chainHash}`));
+    for (const rule of prepared) {
+        const key = `${(0, viem_1.getAddress)(rule.agent)}:${(0, rules_1.chainHash)(rule.chainNamespace)}`;
+        if (keys.has(key))
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.DUPLICATE_RULE, `an enabled rule already names ${rule.agent} for ${rule.chainNamespace}`, {
+                hint: 'Put multiple allowed calls in one rule or update the existing rule.',
+                details: { agent: rule.agent, chainNamespace: rule.chainNamespace },
+            });
+        keys.add(key);
+    }
+}
+//# sourceMappingURL=duplicates.js.map

package/src/lib/agentic/management/label.d.ts

@@ -0,0 +1,3 @@
+/** AGW MAX_LABEL_BYTES. Empty resets the default; lengths count UTF-8 bytes. */
+export declare const MAX_LABEL_BYTES = 64;
+export declare function assertLabel(label: string): void;

package/src/lib/agentic/management/label.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_LABEL_BYTES = void 0;
+exports.assertLabel = assertLabel;
+const errors_1 = require("../errors");
+/** AGW MAX_LABEL_BYTES. Empty resets the default; lengths count UTF-8 bytes. */
+exports.MAX_LABEL_BYTES = 64;
+function assertLabel(label) {
+    if (typeof label !== 'string') {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'label must be a string');
+    }
+    const length = new TextEncoder().encode(label).length;
+    if (length > exports.MAX_LABEL_BYTES) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `label must be at most ${exports.MAX_LABEL_BYTES} UTF-8 bytes (received ${length})`, { details: { length, maxLength: exports.MAX_LABEL_BYTES } });
+    }
+}
+//# sourceMappingURL=label.js.map

package/src/lib/agentic/management/prepare.d.ts

@@ -0,0 +1,7 @@
+import { type Address } from 'viem';
+import { type AgenticGeneration } from '../deployments';
+import type { InternalRule } from '../agentic.types';
+import type { AgenticRuntime } from '../runtime';
+import { Snapshot } from '../reads/snapshot';
+/** Resolve wallet-dependent wire inputs without signing or mutating authority. */
+export declare function prepareWalletRules(runtime: AgenticRuntime, gen: AgenticGeneration, owner: Address, wallet: Address, inputs: readonly InternalRule[], snap: Snapshot): Promise<import("../codec/rules").PreparedRule[]>;

package/src/lib/agentic/management/prepare.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareWalletRules = prepareWalletRules;
+const public_rule_1 = require("../public-rule");
+const svm_public_1 = require("./svm-public");
+const viem_1 = require("viem");
+const enums_1 = require("../../constants/enums");
+const chain_1 = require("../../constants/chain");
+const defaults_1 = require("../codec/defaults");
+const rules_1 = require("../codec/rules");
+const universal_1 = require("../codec/universal");
+const deployments_1 = require("../deployments");
+const capabilities_1 = require("../capabilities");
+const errors_1 = require("../errors");
+const prc20_metadata_1 = require("../contracts/prc20-metadata");
+/** Resolve wallet-dependent wire inputs without signing or mutating authority. */
+async function prepareWalletRules(runtime, gen, owner, wallet, inputs, snap) {
+    const rules = await Promise.all(inputs.map((rule) => (0, public_rule_1.isPublicRule)(rule) ? (0, public_rule_1.normalizePublicRule)(rule, wallet, runtime) : rule));
+    if (rules.length)
+        await (0, deployments_1.verifyPolicyVersion)(runtime.reader, gen);
+    const svm = new Map();
+    const universal = new Map();
+    for (const rule of rules) {
+        if (rule && (0, rules_1.isSolanaRule)(rule)) {
+            (0, capabilities_1.requireCapability)(gen.capabilities, capabilities_1.AgenticCapability.UNIVERSAL_SVM_RULES);
+            svm.set(rule, await (0, svm_public_1.preparePublicSvmRule)(runtime, snap, wallet, rule));
+            continue;
+        }
+        if (!(0, rules_1.isUniversalRule)(rule))
+            continue;
+        if (rule.chainNamespace.startsWith('solana:'))
+            (0, capabilities_1.requireCapability)(gen.capabilities, capabilities_1.AgenticCapability.UNIVERSAL_SVM_RULES);
+        (0, universal_1.validateUniversalRuleShape)(rule, runtime.nowSeconds());
+        (0, capabilities_1.requireCapability)(gen.capabilities, rule.chainNamespace.startsWith('solana:')
+            ? capabilities_1.AgenticCapability.UNIVERSAL_SVM_RULES
+            : capabilities_1.AgenticCapability.UNIVERSAL_EVM_RULES);
+        const chain = rule.chainNamespace;
+        if (chain_1.CHAIN_INFO[chain]?.vm !== enums_1.VM.EVM)
+            throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `unsupported EVM rule chain ${chain}`);
+        const { cea } = await runtime.resolveCEA(wallet, chain);
+        const assets = rule.assets.length
+            ? rule.assets.map((a) => ({
+                token: typeof a.token === 'string' && (0, viem_1.getAddress)(a.token) === viem_1.zeroAddress
+                    ? undefined
+                    : a.token,
+                maxPerCall: a.maxPerCall,
+                maxTotal: (0, defaults_1.withDefault)(a.maxTotal, defaults_1.AGENTIC_DEFAULTS.universal.assetMaxTotal),
+            }))
+            : [{ token: undefined, maxPerCall: BigInt(0), maxTotal: BigInt(0) }];
+        const resolved = [];
+        for (const asset of assets) {
+            const token = asset.token === undefined
+                ? await (0, prc20_metadata_1.readGasPrc20)(snap, chain)
+                : runtime.resolvePrc20(asset.token, chain);
+            if (token === viem_1.zeroAddress)
+                throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `no gas PRC20 registered for ${chain}`);
+            const namespace = await snap.read(token, prc20_metadata_1.PRC20_SOURCE_ABI, 'SOURCE_CHAIN_NAMESPACE');
+            if (namespace !== chain)
+                throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.ASSET_CHAIN_MISMATCH, `PRC20 ${token} belongs to ${namespace}, not ${chain}`);
+            if (asset.token !== undefined) {
+                const expected = typeof asset.token === 'string'
+                    ? (0, viem_1.getAddress)(asset.token)
+                    : (0, viem_1.getAddress)(asset.token.address);
+                if (expected === viem_1.zeroAddress) {
+                    if ((await (0, prc20_metadata_1.readGasPrc20)(snap, chain)) !== (0, viem_1.getAddress)(token))
+                        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'resolved token is not the registered native gas token');
+                }
+                else {
+                    const source = await (0, prc20_metadata_1.readOriginToken)(snap, token, chain);
+                    if (source !== expected)
+                        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, `PRC20 ${token} represents ${source}, not requested token ${expected}`);
+                }
+            }
+            resolved.push({
+                token: (0, viem_1.getAddress)(token),
+                maxPerCall: asset.maxPerCall,
+                maxTotal: asset.maxTotal,
+            });
+        }
+        universal.set(rule, { expectedCEA: (0, viem_1.getAddress)(cea), assets: resolved });
+    }
+    return (0, rules_1.prepareRules)(rules, {
+        owner,
+        pushChainNamespace: runtime.pushChainNamespace,
+        validator: gen.addresses.sessionValidator,
+        rulesPolicy: gen.addresses.rulesPolicy,
+        gateway: gen.addresses.gateway,
+        capabilities: gen.capabilities,
+        nowSeconds: runtime.nowSeconds(),
+        forbiddenTargets: (0, deployments_1.forbiddenTargets)(gen, wallet),
+        universal,
+        svm,
+    });
+}
+//# sourceMappingURL=prepare.js.map

package/src/lib/agentic/management/rules-write.d.ts

@@ -0,0 +1,42 @@
+import type { Address } from 'viem';
+import type { UniversalTxResponse } from '../../orchestrator/orchestrator.types';
+import { type AgenticGeneration } from '../deployments';
+import type { AgenticRuntime } from '../runtime';
+import type { AgenticHex, AgenticProgressHook, InternalRule } from '../agentic.types';
+/** w.rules.add(rules): owner grants on an existing wallet, IDs in input order. */
+export declare function addRules(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, rules: readonly InternalRule[], hook?: AgenticProgressHook): Promise<{
+    rulesIds: AgenticHex[];
+    tx: UniversalTxResponse;
+}>;
+/** Bare revoke (no IDs, empty list, or anything but { all: true }) is refused. */
+export declare function assertRevokeTarget(target: unknown): {
+    all: boolean;
+    ids?: AgenticHex[];
+};
+/** w.rules.delete(ids) / w.rules.delete({ all: true }). Bare revoke is refused. */
+export declare function revokeRules(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, target: AgenticHex[] | {
+    all: true;
+    progressHook?: AgenticProgressHook;
+} | undefined, hook?: AgenticProgressHook): Promise<UniversalTxResponse>;
+/**
+ * w.rules.update({ rules: [{ rulesId, rule }] }): for every pair, inside ONE
+ * owner `execute` batch: assertSpent(expected) → revokeRules(old) →
+ * grantRules(new). Never falls back to sequential sends. An agent spending
+ * between the read and inclusion makes the whole batch revert; retry needs a
+ * fresh read and a new owner signature. New counters start at zero.
+ */
+export declare function updateRules(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, params: {
+    rules: {
+        rulesId: AgenticHex;
+        rule: InternalRule;
+    }[];
+    progressHook?: AgenticProgressHook;
+}): Promise<{
+    rules: {
+        rulesId: AgenticHex;
+        replaced: AgenticHex;
+    }[];
+    tx: UniversalTxResponse;
+}>;
+/** Direct owner rename; empty resets the default label without a checkpoint. */
+export declare function setLabel(runtime: AgenticRuntime, gen: AgenticGeneration, wallet: Address, label: string, hook?: AgenticProgressHook): Promise<UniversalTxResponse>;