@pushchain/core 6.0.27-alpha.4 → 6.0.27-alpha.5

package/AGW.md

@@ -353,3 +353,11 @@ Uniswap uses destination WETH/Circle USDC; Aave uses its faucet LINK. Their gene
 The additional opt-in group `agw-presets-expanded` covers EigenLayer deposits on Sepolia; Uniswap swaps on Base/Arbitrum Sepolia; PancakeSwap plus Venus on BNB testnet; and Aave plus Moonwell on Base Sepolia. Use the same preflight/run commands with `--group agw-presets-expanded`. Each scenario funds a fresh wallet with at most 100 PC and checks any required destination-native PRC20 before transfer. Native-wrap cases use 10^12 raw native-token units. These are deposit/swap/redemption checks, not borrow/repay or every-market coverage.
 
 AGW token resolution uses the destination chain for ordinary token objects: an explicit Base or Arbitrum ETH token must not select Sepolia's PRC20 merely because its symbol/address is identical. An explicit Push PRC20 reference must name the same source chain as the destination; a mismatch fails before signing.
+
+### Creation UI: apps, tokens and preset availability
+
+A rule requires at least one allowed function, even when tokens and limits are selected. A tokens-only rule returns `INVALID_RULE`, with `details.reason = 'ALLOWED_FUNCTION_REQUIRED'` and actionable `userMessage`. App selection can only be hidden if the application explicitly supplies the intended function permissions; the SDK does not invent transfer recipients or permissions.
+
+`assets: []` remains valid for a universal rule with allowed calls. It grants no token transfers from Push; it never means all tokens. Allowed calls may still interact with destination-held assets under their configured constraints. There is no all-token wildcard. List each permitted token and cap explicitly (at most eight assets).
+
+For presets, check `readiness.ready` before enabling Create. Display the per-chain issues and the affected token address. Empty selections explain that transfers from Push are disabled. `BRIDGE_ASSET_UNAVAILABLE` identifies an unverified SDK route, not proof that no deployment exists anywhere. Do not substitute a routed token solely because its symbol matches: the protocol must support that exact address, and swaps need compatible liquidity. A transfer-only helper and additional token routes are not included in this update.

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+@pushchain/core@6.0.27-alpha.5 (2026-10-20)
+
+- fix: clarify agentic creation permissions and route guidance
+
+---
+
 @pushchain/core@6.0.27-alpha.4 (2026-10-20)
 
 - fix: remove preset funding mode and preserve asset limits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushchain/core",
-  "version": "6.0.27-alpha.4",
+  "version": "6.0.27-alpha.5",
   "homepage": "https://push.org",
   "keywords": [
     "pushchain",

package/src/lib/agentic/error-messages.js

@@ -43,6 +43,8 @@ function agenticUserMessage(code, diagnostic, details) {
     }
     if (code !== 'INVALID_RULE')
         return MESSAGES[code];
+    if (details?.['reason'] === 'ALLOWED_FUNCTION_REQUIRED')
+        return 'Add at least one allowed function. Selecting tokens and limits alone does not authorize transfers.';
     if (/validUntil|expiry|expired|future.*timestamp/i.test(diagnostic))
         return 'Choose an expiry date in the future.';
     if (/label.*(64|length|most)/i.test(diagnostic))

package/src/lib/agentic/errors.js

@@ -144,7 +144,7 @@ function tokenRouteUnavailable(cause, token, chainNamespace, assetIndex) {
     const message = `This token cannot be sent from Push to ${network}. Choose a token with a supported Push route.`;
     return new AgenticError(exports.AGENTIC_ERROR_CODE.TOKEN_ROUTE_UNAVAILABLE, message, {
         userMessage: message,
-        hint: 'Choose a supported token on this network, or wait for a verified PRC20 route for this exact token address. Token symbols alone do not identify a route.',
+        hint: 'Choose a supported token on this network, or wait for a verified PRC20 route for this exact token address. The selected app must also support that exact token address; matching symbols are not sufficient.',
         details: {
             token,
             chainNamespace,

package/src/lib/agentic/presets/index.js

@@ -313,7 +313,7 @@ function buildPresetApi(catalog) {
                 if (!selectedAssets.length)
                     issues.push({
                         code: 'ASSETS_REQUIRED',
-                        message: 'Choose tokens and their limits, then regenerate this preset.',
+                        message: 'No tokens selected: transfers from Push are disabled, not unrestricted. Choose explicit tokens and limits, then regenerate this preset.',
                     });
                 if (chain.swapRouters?.length && selectedAssets.length < 2)
                     issues.push({

package/src/lib/agentic/presets/routes.js

@@ -40,7 +40,7 @@ function presetRoutes(chain, assets, network) {
             issues.push({
                 code: 'BRIDGE_ASSET_UNAVAILABLE',
                 token,
-                message: `No SDK PRC20 mapping for ${chain}:${token} on ${network}. Choose a supported asset. This exact token needs a verified Push PRC20 route before it can be used.`,
+                message: `No SDK PRC20 mapping for ${chain}:${token} on ${network}. This preset cannot be created with this token until its Push route is verified. Choose a routed token only if the selected app supports that exact token address.`,
             });
             return { token, status: 'unavailable' };
         }

package/src/lib/agentic/public-rule.js

@@ -117,6 +117,11 @@ async function normalizePublicRule(input, wallet, runtime) {
         r.validUntil <= runtime.nowSeconds() ||
         r.validUntil >= 2 ** 48)
         throw invalid('validUntil must be a future uint48 timestamp');
+    if (r.allowedCalls === undefined ||
+        (Array.isArray(r.allowedCalls) && !r.allowedCalls.length))
+        throw new errors_1.AgenticError(errors_1.AGENTIC_ERROR_CODE.INVALID_RULE, 'Add at least one allowed function. Selecting tokens and limits alone does not authorize transfers.', {
+            details: { reason: 'ALLOWED_FUNCTION_REQUIRED', field: 'allowedCalls' },
+        });
     if (!Array.isArray(r.allowedCalls) ||
         r.allowedCalls.length < 1 ||
         r.allowedCalls.length > 32)