@pushchain/core 6.0.26 → 6.0.27-alpha.1

package/src/lib/agentic/codec/session.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENVELOPE_VERSION = exports.SESSION_PARAM = void 0;
+exports.encodeEnvelope = encodeEnvelope;
+exports.decodeEnvelope = decodeEnvelope;
+exports.buildSession = buildSession;
+exports.encodeSession = encodeSession;
+exports.decodeSession = decodeSession;
+const viem_1 = require("viem");
+const v6_1 = require("../contracts/abi/v6");
+const ids_1 = require("./ids");
+const errors_1 = require("../errors");
+exports.SESSION_PARAM = (0, viem_1.getAbiItem)({
+    abi: v6_1.AGW_ABI,
+    name: 'grantRules',
+}).inputs[0];
+const ZERO_SALT = `0x${'00'.repeat(32)}`;
+exports.ENVELOPE_VERSION = 1;
+/** V6 URP envelope: abi.encode(uint16(1), string chainNamespace, bytes body). */
+function encodeEnvelope(chainNamespace, body) {
+    return (0, viem_1.encodeAbiParameters)([{ type: 'uint16' }, { type: 'string' }, { type: 'bytes' }], [exports.ENVELOPE_VERSION, chainNamespace, body]);
+}
+function decodeEnvelope(initData) {
+    try {
+        const [version, chainNamespace, body] = (0, viem_1.decodeAbiParameters)([{ type: 'uint16' }, { type: 'string' }, { type: 'bytes' }], initData);
+        if (version !== exports.ENVELOPE_VERSION)
+            throw new Error(`unsupported rules envelope version ${version}`);
+        return { chainNamespace, body };
+    }
+    catch (cause) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RULE_READ_FAILED, 'malformed URP envelope', {
+            cause,
+        });
+    }
+}
+function buildSession(ctx) {
+    return {
+        sessionValidator: ctx.validator,
+        sessionValidatorInitData: (0, ids_1.agentConfig)(ctx.agent),
+        salt: ZERO_SALT,
+        userOpPolicies: [],
+        erc7739Policies: { allowedERC7739Content: [], erc1271Policies: [] },
+        actions: ctx.actions.map((a) => ({
+            actionTargetSelector: a.selector,
+            actionTarget: a.target,
+            actionPolicies: [{ policy: ctx.rulesPolicy, initData: a.initData }],
+        })),
+        permitERC4337Paymaster: false,
+    };
+}
+function encodeSession(session) {
+    return (0, viem_1.encodeAbiParameters)([exports.SESSION_PARAM], [session]);
+}
+function decodeSession(bytes) {
+    try {
+        const [session] = (0, viem_1.decodeAbiParameters)([exports.SESSION_PARAM], bytes);
+        return session;
+    }
+    catch (cause) {
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.RULE_READ_FAILED, 'malformed Session encoding', {
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=session.js.map

package/src/lib/agentic/codec/svm-accounts.d.ts

@@ -0,0 +1,35 @@
+import { type Address, type Hex } from 'viem';
+import type { AssetCapWire } from './universal-terms';
+export declare function svmKey(value: string): Hex;
+/** Gateway is supplied by the selected cluster registry, never a global hard-coded program. */
+export declare function deriveAgwSvmCea(wallet: Address, gatewayProgram: string): {
+    address: Hex;
+    bump: number;
+};
+export interface SvmTokenAccountInput {
+    mint: string;
+    tokenProgram?: string;
+}
+export type ResolvedSvmAsset = {
+    kind: 'native';
+    cap: AssetCapWire;
+} | {
+    kind: 'spl';
+    cap: AssetCapWire;
+    mint: string;
+    tokenProgram?: string;
+};
+/** Every resolved SPL cap contributes an ATA; caller cannot omit a listed mint. */
+export declare function resolveAgwSvmRuleContext(wallet: Address, gatewayProgram: string, assets: readonly ResolvedSvmAsset[], outputs?: readonly SvmTokenAccountInput[]): {
+    assets: AssetCapWire[];
+    expectedCEA: Hex;
+    gatewayProgram: Hex;
+    ceaAccounts: Hex[];
+};
+export declare function deriveAgwSvmAta(owner: string, token: SvmTokenAccountInput): Hex;
+/** Includes every listed mint and swap-output mint. Native SOL is already covered by the CEA. */
+export declare function deriveAgwSvmValueAccounts(wallet: Address, gatewayProgram: string, tokens: readonly SvmTokenAccountInput[], outputs?: readonly SvmTokenAccountInput[]): {
+    expectedCEA: Hex;
+    gatewayProgram: Hex;
+    ceaAccounts: Hex[];
+};

package/src/lib/agentic/codec/svm-accounts.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svmKey = svmKey;
+exports.deriveAgwSvmCea = deriveAgwSvmCea;
+exports.resolveAgwSvmRuleContext = resolveAgwSvmRuleContext;
+exports.deriveAgwSvmAta = deriveAgwSvmAta;
+exports.deriveAgwSvmValueAccounts = deriveAgwSvmValueAccounts;
+const web3_js_1 = require("@solana/web3.js");
+const viem_1 = require("viem");
+const svm_terms_1 = require("./svm-terms");
+const SPL_TOKEN = new web3_js_1.PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
+const TOKEN_2022 = new web3_js_1.PublicKey('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
+const ASSOCIATED_TOKEN = new web3_js_1.PublicKey('ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL');
+function svmKey(value) {
+    try {
+        if (value.startsWith('0x')) {
+            (0, svm_terms_1.exactHex)(value, 32, 'pubkey');
+            return (0, viem_1.bytesToHex)(new web3_js_1.PublicKey((0, viem_1.hexToBytes)(value)).toBytes());
+        }
+        return (0, viem_1.bytesToHex)(new web3_js_1.PublicKey(value).toBytes());
+    }
+    catch {
+        throw (0, svm_terms_1.svmInvalid)('invalid Solana public key');
+    }
+}
+function key(value) {
+    return new web3_js_1.PublicKey((0, viem_1.hexToBytes)(svmKey(value)));
+}
+/** Gateway is supplied by the selected cluster registry, never a global hard-coded program. */
+function deriveAgwSvmCea(wallet, gatewayProgram) {
+    if (key(gatewayProgram).equals(web3_js_1.PublicKey.default))
+        throw (0, svm_terms_1.svmInvalid)('gateway program cannot be zero');
+    const [pda, bump] = web3_js_1.PublicKey.findProgramAddressSync([Buffer.from('push_identity'), Buffer.from((0, viem_1.hexToBytes)((0, viem_1.getAddress)(wallet)))], key(gatewayProgram));
+    return { address: (0, viem_1.bytesToHex)(pda.toBytes()), bump };
+}
+/** Every resolved SPL cap contributes an ATA; caller cannot omit a listed mint. */
+function resolveAgwSvmRuleContext(wallet, gatewayProgram, assets, outputs = []) {
+    if (!assets.length || assets.length > svm_terms_1.SVM_LIMITS.assets)
+        throw (0, svm_terms_1.svmInvalid)('resolved assets must contain 1..8 entries');
+    const tokens = assets.flatMap((a) => a.kind === 'spl' ? [{ mint: a.mint, tokenProgram: a.tokenProgram }] : []);
+    return {
+        ...deriveAgwSvmValueAccounts(wallet, gatewayProgram, tokens, outputs),
+        assets: assets.map((a) => a.cap),
+    };
+}
+function deriveAgwSvmAta(owner, token) {
+    const mint = key(token.mint), program = token.tokenProgram ? key(token.tokenProgram) : SPL_TOKEN;
+    if (mint.equals(web3_js_1.PublicKey.default))
+        throw (0, svm_terms_1.svmInvalid)('native SOL uses the CEA, not an ATA');
+    if (!program.equals(SPL_TOKEN) && !program.equals(TOKEN_2022))
+        throw (0, svm_terms_1.svmInvalid)('unsupported token program');
+    const [ata] = web3_js_1.PublicKey.findProgramAddressSync([key(owner).toBuffer(), program.toBuffer(), mint.toBuffer()], ASSOCIATED_TOKEN);
+    return (0, viem_1.bytesToHex)(ata.toBytes());
+}
+/** Includes every listed mint and swap-output mint. Native SOL is already covered by the CEA. */
+function deriveAgwSvmValueAccounts(wallet, gatewayProgram, tokens, outputs = []) {
+    const expectedCEA = deriveAgwSvmCea(wallet, gatewayProgram).address;
+    const ceaAccounts = [
+        ...new Set([
+            expectedCEA,
+            ...[...tokens, ...outputs].map((t) => deriveAgwSvmAta(expectedCEA, t)),
+        ]),
+    ];
+    if (ceaAccounts.length > svm_terms_1.SVM_LIMITS.ceaAccounts)
+        throw (0, svm_terms_1.svmInvalid)('derived CEA value-account set exceeds 16');
+    return { expectedCEA, gatewayProgram: svmKey(gatewayProgram), ceaAccounts };
+}
+//# sourceMappingURL=svm-accounts.js.map

package/src/lib/agentic/codec/svm-idl.d.ts

@@ -0,0 +1,11 @@
+/** Compile named Anchor IDL constraints. Unsupported layouts are never guessed. */
+import type { Idl } from '@coral-xyz/anchor';
+import { type Hex } from 'viem';
+import type { SolanaRule } from '../agentic.types';
+import { type SvmTermsWire } from './svm-terms';
+export type SvmResolvedContext = Pick<SvmTermsWire, 'assets' | 'expectedCEA' | 'gatewayProgram' | 'ceaAccounts'> & {
+    /** Verified mint -> wallet ATA mapping, including output mints. */
+    tokenAccounts: ReadonlyMap<Hex, Hex>;
+};
+export declare function svmIdlInstruction(idl: Idl, name: string): import("@coral-xyz/anchor/dist/cjs/idl").IdlInstruction;
+export declare function compileSvmIdlRule(rule: SolanaRule, ctx: SvmResolvedContext, now: number): SvmTermsWire;

package/src/lib/agentic/codec/svm-idl.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svmIdlInstruction = svmIdlInstruction;
+exports.compileSvmIdlRule = compileSvmIdlRule;
+const viem_1 = require("viem");
+const svm_accounts_1 = require("./svm-accounts");
+const svm_terms_1 = require("./svm-terms");
+const widths = {
+    bool: 1,
+    u8: 1,
+    i8: 1,
+    u16: 2,
+    i16: 2,
+    u32: 4,
+    i32: 4,
+    f32: 4,
+    u64: 8,
+    i64: 8,
+    f64: 8,
+    u128: 16,
+    i128: 16,
+    u256: 32,
+    i256: 32,
+    pubkey: 32,
+};
+function width(type) {
+    if (typeof type === 'string' && widths[type])
+        return widths[type];
+    if (type && typeof type === 'object' && 'array' in type) {
+        const a = type.array;
+        if (Array.isArray(a) &&
+            a.length === 2 &&
+            Number.isSafeInteger(a[1]) &&
+            a[1] > 0) {
+            const size = width(a[0]) * a[1];
+            if (size <= 1024)
+                return size;
+        }
+    }
+    throw (0, svm_terms_1.svmInvalid)('IDL field layout is not supported: use fixed-width primitives or fixed arrays');
+}
+function svmIdlInstruction(idl, name) {
+    if (!idl || !Array.isArray(idl.instructions) || typeof name !== 'string')
+        throw (0, svm_terms_1.svmInvalid)('instruction requires an Anchor IDL and name');
+    const found = idl.instructions.filter((i) => i.name === name);
+    if (found.length !== 1)
+        throw (0, svm_terms_1.svmInvalid)(`IDL instruction ${name} must exist exactly once`);
+    const ix = found[0];
+    if (!Array.isArray(ix.discriminator) ||
+        ix.discriminator.length !== 8 ||
+        ix.discriminator.some((b) => !Number.isInteger(b) || b < 0 || b > 255))
+        throw (0, svm_terms_1.svmInvalid)('Anchor IDL discriminator must contain eight bytes');
+    return ix;
+}
+function accountNames(accounts, prefix = '') {
+    return accounts.flatMap((entry) => {
+        if (!entry ||
+            typeof entry !== 'object' ||
+            !('name' in entry) ||
+            typeof entry.name !== 'string')
+            throw (0, svm_terms_1.svmInvalid)('invalid IDL account');
+        const name = prefix + entry.name;
+        if ('accounts' in entry)
+            throw (0, svm_terms_1.svmInvalid)('nested IDL accounts are not supported by the instruction resolver');
+        if ('optional' in entry && entry.optional)
+            throw (0, svm_terms_1.svmInvalid)('optional IDL accounts are not supported for rules');
+        return [name];
+    });
+}
+function resolveAccount(ref, ctx) {
+    if (!ref || typeof ref !== 'object')
+        throw (0, svm_terms_1.svmInvalid)('invalid named account reference');
+    if (ref.kind === 'walletCEA')
+        return ctx.expectedCEA;
+    if (ref.kind === 'address')
+        return (0, svm_accounts_1.svmKey)(ref.address);
+    if (ref.kind === 'walletATA') {
+        const ata = ctx.tokenAccounts.get((0, svm_accounts_1.svmKey)(ref.token));
+        if (!ata)
+            throw (0, svm_terms_1.svmInvalid)('walletATA mint must be listed in assets or outputTokens');
+        return ata;
+    }
+    throw (0, svm_terms_1.svmInvalid)('unknown named account reference');
+}
+function unsigned(f) {
+    if (typeof f.type !== 'string' || !/^u(8|16|32|64)$/.test(f.type))
+        throw (0, svm_terms_1.svmInvalid)('range/ratio constraints require unsigned integer fields of at most eight bytes');
+}
+function bound(v, len) {
+    if (typeof v !== 'bigint' ||
+        v < BigInt(0) ||
+        v >= BigInt(1) << BigInt(len * 8))
+        throw (0, svm_terms_1.svmInvalid)('field constraint exceeds its unsigned width');
+    return `0x${v.toString(16).padStart(64, '0')}`;
+}
+function compileSvmIdlRule(rule, ctx, now) {
+    if (!Array.isArray(rule.allowedInstructions) ||
+        !rule.allowedInstructions.length ||
+        rule.allowedInstructions.length > 32)
+        throw (0, svm_terms_1.svmInvalid)('allowedInstructions must contain 1..32 entries');
+    const terms = {
+        validUntil: rule.validUntil,
+        maxGasPerCall: rule.maxGasPerCall,
+        assets: ctx.assets,
+        expectedCEA: ctx.expectedCEA,
+        gatewayProgram: ctx.gatewayProgram,
+        ceaAccounts: ctx.ceaAccounts,
+        programs: [],
+        pins: [],
+        dataPins: [],
+    };
+    const programs = [], pins = [], dataPins = [];
+    for (const [ruleIndex, entry] of rule.allowedInstructions.entries()) {
+        const ix = svmIdlInstruction(entry.instruction?.idl, entry.instruction?.name);
+        const program = (0, svm_accounts_1.svmKey)(entry.program);
+        if ((0, svm_accounts_1.svmKey)(entry.instruction.idl.address) !== program)
+            throw (0, svm_terms_1.svmInvalid)('IDL address differs from rule program');
+        if (!Array.isArray(ix.accounts) || !Array.isArray(entry.accounts))
+            throw (0, svm_terms_1.svmInvalid)('instruction accounts are required');
+        const names = accountNames(ix.accounts);
+        if (new Set(names).size !== names.length)
+            throw (0, svm_terms_1.svmInvalid)('duplicate IDL account names');
+        programs.push({
+            program,
+            discriminator: (0, viem_1.bytesToHex)(Uint8Array.from([
+                ...ix.discriminator,
+                ...Array(8 - ix.discriminator.length).fill(0),
+            ])),
+            discriminatorLen: ix.discriminator.length,
+            dataless: false,
+            maxAccounts: entry.maxAccounts ?? names.length,
+        });
+        for (const a of entry.accounts) {
+            const accountIndex = names.indexOf(a.name);
+            if (accountIndex < 0)
+                throw (0, svm_terms_1.svmInvalid)(`unknown IDL account ${a.name}`);
+            pins.push({
+                ruleIndex,
+                accountIndex,
+                expected: resolveAccount(a.expected, ctx),
+            });
+        }
+        const fields = new Map();
+        let offset = ix.discriminator.length;
+        // Reject variable/nested-defined layouts rather than claiming a reliable offset.
+        for (const arg of ix.args) {
+            if (fields.has(arg.name))
+                throw (0, svm_terms_1.svmInvalid)('duplicate IDL field name');
+            const len = width(arg.type);
+            fields.set(arg.name, { offset, len, type: arg.type });
+            offset += len;
+        }
+        if (offset > 1024)
+            throw (0, svm_terms_1.svmInvalid)('IDL instruction data exceeds the policy limit');
+        const field = (name) => {
+            const f = fields.get(name);
+            if (!f)
+                throw (0, svm_terms_1.svmInvalid)(`unknown IDL field ${name}`);
+            return f;
+        };
+        if (entry.fields !== undefined && !Array.isArray(entry.fields))
+            throw (0, svm_terms_1.svmInvalid)('fields must be an array');
+        for (const constraint of entry.fields ?? []) {
+            const keys = ['equals', 'min', 'max', 'minRatio'].filter((k) => k in constraint);
+            if (keys.length !== 1)
+                throw (0, svm_terms_1.svmInvalid)('each field constraint must specify exactly one comparison');
+            const f = field('numerator' in constraint ? constraint.numerator : constraint.name);
+            const p = {
+                ruleIndex,
+                fromEnd: false,
+                offset: f.offset,
+                offsetB: 0,
+                len: f.len,
+                mode: svm_terms_1.SvmDataPinMode.EQ,
+                expected: `0x${'00'.repeat(32)}`,
+                num: BigInt(0),
+                den: BigInt(0),
+            };
+            if ('minRatio' in constraint) {
+                unsigned(f);
+                const b = field(constraint.denominator);
+                unsigned(b);
+                if (f.len !== b.len)
+                    throw (0, svm_terms_1.svmInvalid)('ratio fields must have the same width');
+                Object.assign(p, {
+                    mode: svm_terms_1.SvmDataPinMode.RATIO_GTE_LE,
+                    offsetB: b.offset,
+                    num: constraint.minRatio.num,
+                    den: constraint.minRatio.den,
+                });
+            }
+            else if ('min' in constraint || 'max' in constraint) {
+                unsigned(f);
+                const min = 'min' in constraint;
+                p.mode = min ? svm_terms_1.SvmDataPinMode.GTE_LE : svm_terms_1.SvmDataPinMode.LTE_LE;
+                p.expected = bound(min ? constraint.min : constraint.max, f.len);
+            }
+            else {
+                let bytes;
+                if (typeof constraint.equals === 'bigint') {
+                    unsigned(f);
+                    bound(constraint.equals, f.len);
+                    bytes = Uint8Array.from({ length: f.len }, (_, i) => Number((constraint.equals >> BigInt(8 * i)) & BigInt(255)));
+                }
+                else if (typeof constraint.equals === 'boolean') {
+                    if (f.type !== 'bool')
+                        throw (0, svm_terms_1.svmInvalid)('boolean equality requires a bool field');
+                    bytes = Uint8Array.of(constraint.equals ? 1 : 0);
+                }
+                else {
+                    if (!/^0x(?:[a-fA-F0-9]{2})*$/.test(constraint.equals))
+                        throw (0, svm_terms_1.svmInvalid)('equality requires exact hex bytes');
+                    bytes = (0, viem_1.hexToBytes)(constraint.equals);
+                }
+                if (bytes.length !== f.len || f.len > 32)
+                    throw (0, svm_terms_1.svmInvalid)('equality value must match field width (at most 32 bytes)');
+                p.expected = `0x${(0, viem_1.bytesToHex)(bytes).slice(2).padEnd(64, '0')}`;
+            }
+            dataPins.push(p);
+        }
+    }
+    Object.assign(terms, { programs, pins, dataPins });
+    (0, svm_terms_1.validateSvmTerms)(terms, now);
+    return terms;
+}
+//# sourceMappingURL=svm-idl.js.map

package/src/lib/agentic/codec/svm-terms.d.ts

@@ -0,0 +1,157 @@
+/** Internal v6 SVM wire representation; not a proposed public Rule API. */
+import { type Hex } from 'viem';
+import { AgenticError } from '../errors';
+import type { AssetCapWire } from './universal-terms';
+export declare enum SvmDataPinMode {
+    EQ = 0,
+    GTE_LE = 1,
+    LTE_LE = 2,
+    RATIO_GTE_LE = 3
+}
+export interface AllowedProgramWire {
+    program: Hex;
+    discriminator: Hex;
+    discriminatorLen: number;
+    dataless: boolean;
+    maxAccounts: number;
+}
+export interface SvmAccountPinWire {
+    ruleIndex: number;
+    accountIndex: number;
+    expected: Hex;
+}
+export interface SvmDataPinWire {
+    ruleIndex: number;
+    fromEnd: boolean;
+    offset: number;
+    offsetB: number;
+    len: number;
+    mode: SvmDataPinMode;
+    expected: Hex;
+    num: bigint;
+    den: bigint;
+}
+export interface SvmTermsWire {
+    validUntil: number;
+    expectedCEA: Hex;
+    gatewayProgram: Hex;
+    assets: readonly AssetCapWire[];
+    maxGasPerCall: bigint;
+    ceaAccounts: readonly Hex[];
+    programs: readonly AllowedProgramWire[];
+    pins: readonly SvmAccountPinWire[];
+    dataPins: readonly SvmDataPinWire[];
+}
+export declare const SVM_LIMITS: {
+    readonly assets: 8;
+    readonly programs: 32;
+    readonly pins: 16;
+    readonly dataPins: 8;
+    readonly ceaAccounts: 16;
+    readonly accounts: 64;
+    readonly ixData: 1024;
+};
+export declare const UINT64_MAX: bigint;
+export declare const FORBIDDEN_SVM_PROGRAMS: readonly Hex[];
+export declare const SVM_TERMS_PARAM: {
+    readonly type: "tuple";
+    readonly components: readonly [{
+        readonly name: "validUntil";
+        readonly type: "uint48";
+    }, {
+        readonly name: "expectedCEA";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "gatewayProgram";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "assets";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "token";
+            readonly type: "address";
+        }, {
+            readonly name: "maxPerCall";
+            readonly type: "uint256";
+        }, {
+            readonly name: "maxTotal";
+            readonly type: "uint256";
+        }];
+    }, {
+        readonly name: "maxGasPerCall";
+        readonly type: "uint256";
+    }, {
+        readonly name: "ceaAccounts";
+        readonly type: "bytes32[]";
+    }, {
+        readonly name: "programs";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "program";
+            readonly type: "bytes32";
+        }, {
+            readonly name: "discriminator";
+            readonly type: "bytes8";
+        }, {
+            readonly name: "discriminatorLen";
+            readonly type: "uint8";
+        }, {
+            readonly name: "dataless";
+            readonly type: "bool";
+        }, {
+            readonly name: "maxAccounts";
+            readonly type: "uint8";
+        }];
+    }, {
+        readonly name: "pins";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "ruleIndex";
+            readonly type: "uint8";
+        }, {
+            readonly name: "accountIndex";
+            readonly type: "uint8";
+        }, {
+            readonly name: "expected";
+            readonly type: "bytes32";
+        }];
+    }, {
+        readonly name: "dataPins";
+        readonly type: "tuple[]";
+        readonly components: readonly [{
+            readonly name: "ruleIndex";
+            readonly type: "uint8";
+        }, {
+            readonly name: "fromEnd";
+            readonly type: "bool";
+        }, {
+            readonly name: "offset";
+            readonly type: "uint16";
+        }, {
+            readonly name: "offsetB";
+            readonly type: "uint16";
+        }, {
+            readonly name: "len";
+            readonly type: "uint8";
+        }, {
+            readonly name: "mode";
+            readonly type: "uint8";
+        }, {
+            readonly name: "expected";
+            readonly type: "bytes32";
+        }, {
+            readonly name: "num";
+            readonly type: "uint64";
+        }, {
+            readonly name: "den";
+            readonly type: "uint64";
+        }];
+    }];
+};
+export declare function svmInvalid(message: string): AgenticError;
+export declare function exactHex(value: unknown, bytes: number, field: string): asserts value is Hex;
+export declare function isForbiddenSvmProgram(program: Hex, terms: Pick<SvmTermsWire, 'expectedCEA' | 'gatewayProgram'>): boolean;
+/** Grant-time structural rules. Chain/token/mint correctness requires resolved on-chain inputs. */
+export declare function validateSvmTerms(t: SvmTermsWire, nowSeconds: number): void;
+export declare function encodeSvmTerms(terms: SvmTermsWire, nowSeconds: number): Hex;
+export declare function decodeSvmTerms(body: Hex): SvmTermsWire;