@rhinestone/sdk 0.0.0-dev-20261008124126 → 0.0.0-dev-20261008125543

package/dist/src/clients/orchestrator/client.js

@@ -3,7 +3,7 @@ import { createOrchestratorAuth } from './auth.js';
 import { ChainCatalog, parseChains } from './chain-catalog.js';
 import { fetchOrchestratorJson } from './fetch.js';
 import { mapIntentRequestToWire, mapIntentStatusFromWire, mapPortfolioFromWire, mapQuoteResponseFromWire, mapSignedIntentToWire, mapSplitRequestToWire, mapSplitResultFromWire, } from './mappers.js';
-const SDK_VERSION = '0.0.0-dev-20261008124126';
+const SDK_VERSION = '0.0.0-dev-20261008125543';
 const API_VERSION = '2026-04.blanc';
 // Bounds how long a killed layer or pulled settlement address stays pinnable.
 const CHAIN_CATALOG_TTL_MS = 10 * 60 * 1000;

package/dist/src/modules/validators/smart-sessions/settlement/eco.d.ts

@@ -1,5 +1,5 @@
 import { type Address } from 'viem';
-import type { ScopedAction } from '../types.js';
+import type { ScopedAction, UniversalActionPolicyParamRule } from '../types.js';
 import type { SettlementCatalog, SettlementContext } from './types.js';
 /**
  * ECO — Eco Routes, `Portal.publishAndFund` with Eco's quoted route bytes
@@ -8,7 +8,16 @@ import type { SettlementCatalog, SettlementContext } from './types.js';
  * The recipient lives inside the vendor route, and the reward's offsets move
  * with the route's length, so the session pins the one shape the orchestrator
  * accepts end to end: an ERC-20 reward and a single `transfer` delivery.
- * Every pointer and length word is pinned so no field can alias another.
+ * Every calldata pointer, the reward's tokens pointer and every count is pinned
+ * so no field can alias another. The route's own pointers and byte length are
+ * not: the destination Portal
+ * (0xEC000769A73b70e16f361a442292500b3BCf4A85, verified source on Base
+ * Blockscout) checks every fill and cancel in `_validateRoute`, which hashes
+ * `abi.encode(route)` and reverts `InvalidHash`, so only canonical bytes are
+ * fillable, and canonical bytes with these counts have exactly the layout the
+ * offsets assume. Any other layout is never filled and refunds to the pinned
+ * creator after the pinned deadline. This assumes EVM destinations and a Portal
+ * that keeps re-encoding.
  */
 export declare const ecoPortalAbi: readonly [{
     readonly name: "publishAndFund";
@@ -108,6 +117,11 @@ export declare const ECO_MIN_VALIDITY_SECONDS: bigint;
  * `refund` revert and locks the reward.
  */
 export declare function proversBetween(settlement: SettlementCatalog, source: number, destination: number): Address[];
+/**
+ * The same check on the same word; a usage-limited rule is never the same, as
+ * hoisted out of the leg OR it would count calls its branch never admits.
+ */
+export declare const sameRule: (a: UniversalActionPolicyParamRule, b: UniversalActionPolicyParamRule) => boolean;
 /** The publish call, pinned to the permit's destinations, provers and prices. */
 export declare function scopeEco(ctx: SettlementContext): ScopedAction;
 //# sourceMappingURL=eco.d.ts.map

package/dist/src/modules/validators/smart-sessions/settlement/eco.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eco.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/settlement/eco.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAQb,MAAM,MAAM,CAAA;AAGb,OAAO,KAAK,EAEV,YAAY,EAEb,MAAM,UAAU,CAAA;AAEjB,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAEnE;;;;;;;;GAQG;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvB,CAAA;AAEF,eAAO,MAAM,yBAAyB,eAAsC,CAAA;AAI5E;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;IAqBlB,4EAA4E;;;;;;;;;;;;CAYpE,CAAA;AAMV;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAuB,CAAA;AAgC5D;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,iBAAiB,EAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,EAAE,CAOX;AAeD,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CA2I7D"}
+{"version":3,"file":"eco.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/settlement/eco.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAQb,MAAM,MAAM,CAAA;AAGb,OAAO,KAAK,EAEV,YAAY,EACZ,8BAA8B,EAC/B,MAAM,UAAU,CAAA;AAEjB,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAEnE;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvB,CAAA;AAEF,eAAO,MAAM,yBAAyB,eAAsC,CAAA;AAI5E;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;IAqBlB,4EAA4E;;;;;;;;;;;;CAYpE,CAAA;AAMV;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAuB,CAAA;AAgC5D;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,iBAAiB,EAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,EAAE,CAOX;AAkBD;;;GAGG;AACH,eAAO,MAAM,QAAQ,GACnB,GAAG,8BAA8B,EACjC,GAAG,8BAA8B,YAMoB,CAAA;AAEvD,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CA4J7D"}

package/dist/src/modules/validators/smart-sessions/settlement/eco.js

@@ -9,7 +9,16 @@ import { SettlementLayerRefusal, served } from './served.js';
  * The recipient lives inside the vendor route, and the reward's offsets move
  * with the route's length, so the session pins the one shape the orchestrator
  * accepts end to end: an ERC-20 reward and a single `transfer` delivery.
- * Every pointer and length word is pinned so no field can alias another.
+ * Every calldata pointer, the reward's tokens pointer and every count is pinned
+ * so no field can alias another. The route's own pointers and byte length are
+ * not: the destination Portal
+ * (0xEC000769A73b70e16f361a442292500b3BCf4A85, verified source on Base
+ * Blockscout) checks every fill and cancel in `_validateRoute`, which hashes
+ * `abi.encode(route)` and reverts `InvalidHash`, so only canonical bytes are
+ * fillable, and canonical bytes with these counts have exactly the layout the
+ * offsets assume. Any other layout is never filled and refunds to the pinned
+ * creator after the pinned deadline. This assumes EVM destinations and a Portal
+ * that keeps re-encoding.
  */
 export const ecoPortalAbi = parseAbi([
     'function publishAndFund(uint64 destination, bytes route, (uint64 deadline,address creator,address prover,uint256 nativeAmount,(address token,uint256 amount)[] tokens) reward, bool allowPartial) payable returns (bytes32 intentHash, address vault)',
@@ -96,6 +105,16 @@ const allOf = (rules) => rules
     .map((rule) => ({ type: 'rule', rule }))
     .reduceRight((right, left) => ({ type: 'and', left, right }));
 const anyOf = (branches) => branches.reduce((left, right) => ({ type: 'or', left, right }));
+const allOfExpressions = (parts) => parts.reduceRight((right, left) => ({ type: 'and', left, right }));
+/**
+ * The same check on the same word; a usage-limited rule is never the same, as
+ * hoisted out of the leg OR it would count calls its branch never admits.
+ */
+export const sameRule = (a, b) => a.usageLimit === undefined &&
+    b.usageLimit === undefined &&
+    a.condition === b.condition &&
+    a.calldataOffset === b.calldataOffset &&
+    BigInt(a.referenceValue) === BigInt(b.referenceValue);
 /** The publish call, pinned to the permit's destinations, provers and prices. */
 export function scopeEco(ctx) {
     if (ctx.sourceTokens.length !== 1) {
@@ -135,15 +154,9 @@ export function scopeEco(ctx) {
         pinValue(PUBLISH.routePointer, 0x80n),
         pinValue(PUBLISH.rewardPointer, 0x300n),
         pinValue(PUBLISH.allowPartial, 0n),
-        pinValue(PUBLISH.routeLength, 0x260n),
-        pinValue(PUBLISH.routeTuplePointer, 0x20n),
         pinValue(PUBLISH.routeNativeAmount, 0n),
-        pinValue(PUBLISH.routeTokensPointer, 0xc0n),
-        pinValue(PUBLISH.routeCallsPointer, 0x120n),
         pinValue(PUBLISH.routeTokensLength, 1n),
         pinValue(PUBLISH.callsLength, 1n),
-        pinValue(PUBLISH.callPointer, 0x20n),
-        pinValue(PUBLISH.callDataPointer, 0x60n),
         pinValue(PUBLISH.callValue, 0n),
         pinValue(PUBLISH.callDataLength, 0x44n),
         pin(PUBLISH.rewardCreator, ctx.account),
@@ -192,14 +205,31 @@ export function scopeEco(ctx) {
                 referenceValue: floor,
             },
         ];
-        // The prover OR nests inside its leg, so the rule count grows with legs
-        // plus provers rather than their product.
-        return {
-            type: 'and',
-            left: allOf(legRules),
-            right: anyOf(provers.map((prover) => allOf([pin(PUBLISH.rewardProver, prover)]))),
-        };
+        return { rules: legRules, provers };
     });
+    // What every leg pins moves out of the OR, stored once instead of per leg:
+    // (A and X) or (A and Y) is A and (X or Y).
+    const shared = legs[0].rules.filter((rule) => legs.every((leg) => leg.rules.some((other) => sameRule(other, rule))));
+    const sharedProvers = legs.every((leg) => leg.provers.length === legs[0].provers.length &&
+        leg.provers.every((prover, i) => prover === legs[0].provers[i]));
+    // The prover OR nests inside its leg, so the rule count grows with legs
+    // plus provers rather than their product.
+    const proverOr = (provers) => anyOf(provers.map((prover) => allOf([pin(PUBLISH.rewardProver, prover)])));
+    const branches = legs.map((leg) => {
+        const own = leg.rules.filter((rule) => !shared.some((other) => sameRule(other, rule)));
+        return [
+            ...(own.length ? [allOf(own)] : []),
+            ...(sharedProvers ? [] : [proverOr(leg.provers)]),
+        ];
+    });
+    const expression = [
+        allOf([...rules, ...shared]),
+        ...(sharedProvers ? [proverOr(legs[0].provers)] : []),
+        // A leg left with nothing of its own admits everything the others do.
+        ...(branches.some((branch) => branch.length === 0)
+            ? []
+            : [anyOf(branches.map(allOfExpressions))]),
+    ];
     return {
         target: ctx.target,
         selector: PUBLISH_AND_FUND_SELECTOR,
@@ -207,7 +237,7 @@ export function scopeEco(ctx) {
             {
                 type: 'arg-policy',
                 valueLimitPerUse: 0n,
-                expression: { type: 'and', left: allOf(rules), right: anyOf(legs) },
+                expression: allOfExpressions(expression),
             },
             ...ctx.timeFrame,
         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinestone/sdk",
-  "version": "0.0.0-dev-20261008124126",
+  "version": "0.0.0-dev-20261008125543",
   "description": "Smart wallets and multichain transactions for your application",
   "author": {
     "name": "Rhinestone",