@rhinestone/sdk 0.0.0-dev-20261008160531 → 0.0.0-dev-20261008160829

package/dist/src/clients/orchestrator/client.js

@@ -3,7 +3,7 @@ import { createOrchestratorAuth } from './auth.js';
 import { ChainCatalog, parseChains } from './chain-catalog.js';
 import { fetchOrchestratorJson } from './fetch.js';
 import { mapIntentRequestToWire, mapIntentStatusFromWire, mapPortfolioFromWire, mapQuoteResponseFromWire, mapSignedIntentToWire, mapSplitRequestToWire, mapSplitResultFromWire, } from './mappers.js';
-const SDK_VERSION = '0.0.0-dev-20261008160531';
+const SDK_VERSION = '0.0.0-dev-20261008160829';
 const API_VERSION = '2026-04.blanc';
 // Bounds how long a killed layer or pulled settlement address stays pinnable.
 const CHAIN_CATALOG_TTL_MS = 10 * 60 * 1000;

package/dist/src/modules/validators/smart-sessions/settlement/lz.d.ts

@@ -1,4 +1,4 @@
-import type { ScopedAction } from '../types.js';
+import type { ScopedAction, UniversalActionPolicyParamRule } from '../types.js';
 import type { SettlementContext } from './types.js';
 /**
  * The most relay fee the key may send LayerZero's receiver, in USDC units: ~10x
@@ -6,6 +6,13 @@ import type { SettlementContext } from './types.js';
  */
 export declare const LZ_CCTP_MAX_RELAY_FEE = 1000000n;
 export declare const LZ_EXECUTE_SELECTOR: `0x${string}`;
+type Rule = UniversalActionPolicyParamRule;
+/**
+ * The same check on the same word. A usage-limited rule is never the same: one
+ * hoisted out of an OR would count on every call, not only when its branch runs.
+ */
+export declare const sameRule: (a: Rule, b: Rule) => boolean;
 /** The execute call, pinned to the permit's destinations, recipients and cap. */
 export declare function scopeLz(ctx: SettlementContext): ScopedAction;
+export {};
 //# sourceMappingURL=lz.d.ts.map

package/dist/src/modules/validators/smart-sessions/settlement/lz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lz.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/settlement/lz.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEV,YAAY,EAEb,MAAM,UAAU,CAAA;AAGjB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAwBhD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,WAAa,CAAA;AAE/C,eAAO,MAAM,mBAAmB,eAE/B,CAAA;AA8ED,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CAkO5D"}
+{"version":3,"file":"lz.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/settlement/lz.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAEV,YAAY,EACZ,8BAA8B,EAC/B,MAAM,UAAU,CAAA;AAGjB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AA4BhD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,WAAa,CAAA;AAE/C,eAAO,MAAM,mBAAmB,eAE/B,CAAA;AAWD,KAAK,IAAI,GAAG,8BAA8B,CAAA;AAmB1C;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,GAAG,IAAI,EAAE,GAAG,IAAI,YAKc,CAAA;AA2DvD,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CAyP5D"}

package/dist/src/modules/validators/smart-sessions/settlement/lz.js

@@ -8,12 +8,16 @@ import { SettlementLayerRefusal, served } from './served.js';
  * quoteId)`, whose nested calls pull the tokens, bridge them and sweep the rest
  * back. LZMultiCall runs any call it is handed, so every nested call is pinned:
  * the array length, each element offset, target, data pointer and
- * length-plus-selector, and each argument the key could redirect. The API picks
- * one of three routes, so the policy accepts exactly these layouts:
+ * length-plus-selector, and each argument the key could redirect, except what
+ * LZMultiCall or the target already refuses (see `batch` and `pull`). The policy
+ * accepts two of the API's routes, in three layouts:
  *
- * - Stargate TAXI or BUS: delegateTransferFrom, approve(pool), pool.send, sweep.
  * - CCTP: delegateTransferFrom, transfer(fee), approve(TokenMessengerV2),
  *   depositForBurn, sweep; to Plasma without the fee transfer.
+ * - Stargate TAXI: delegateTransferFrom, approve(pool), pool.send, sweep; only
+ *   into a leg no CCTP route reaches. Where both exist CCTP is cheaper and
+ *   faster, and the orchestrator must not plan Stargate. BUS, which the
+ *   orchestrator does not plan, is refused.
  */
 /**
  * Circle's TokenMessengerV2, which the API's CCTP route approves and burns
@@ -33,6 +37,16 @@ const TRANSFER = toFunctionSelector('transfer(address,uint256)');
 const DEPOSIT_FOR_BURN = toFunctionSelector('depositForBurn(uint256,uint32,bytes32,address,bytes32,uint256,uint32)');
 const SWEEP = toFunctionSelector('sweep(address[],address)');
 const ceil32 = (n) => BigInt(Math.ceil(n / 32) * 32);
+const and = (terms) => terms.reduceRight((right, left) => ({ type: 'and', left, right }));
+/**
+ * The same check on the same word. A usage-limited rule is never the same: one
+ * hoisted out of an OR would count on every call, not only when its branch runs.
+ */
+export const sameRule = (a, b) => a.usageLimit === undefined &&
+    b.usageLimit === undefined &&
+    a.condition === b.condition &&
+    a.calldataOffset === b.calldataOffset &&
+    BigInt(a.referenceValue) === BigInt(b.referenceValue);
 /**
  * The pins of an `execute` batch under the canonical encoding, below the
  * `calls` pointer every route shares, and each call's argument accessor.
@@ -45,10 +59,17 @@ function batch(calls) {
         const start = 0x60n + relative;
         const data = start + 128n;
         const at = (offset) => data + 4n + offset;
-        rules.push(pinValue(0x60n + BigInt(i) * 32n, relative), pin(start, call.target), ...(call.payable ? [] : [pinValue(start + 32n, 0n)]), pinValue(start + 64n, 0x60n), 
+        // No call's value is pinned: the send's is the messaging fee, and every
+        // other target reverts on value (a non-payable solc function, checked on
+        // every LZ source chain), which LZMultiCall bubbles.
+        rules.push(pinValue(0x60n + BigInt(i) * 32n, relative), pin(start, call.target), pinValue(start + 64n, 0x60n), 
         // The word ending at the selector: the length's low 28 bytes, then the
         // selector. A length above 2^224 fails to decode, so this pins both.
-        pinValue(data - 28n, (BigInt(call.length) << 32n) | BigInt(call.selector)), ...call.args(at));
+        ...(call.shapeChecked
+            ? []
+            : [
+                pinValue(data - 28n, (BigInt(call.length) << 32n) | BigInt(call.selector)),
+            ]), ...call.args(at));
         args.push(at);
         relative += 128n + ceil32(call.length);
     });
@@ -70,15 +91,15 @@ export function scopeLz(ctx) {
     const cap = (offset) => ctx.cap === undefined ? [] : [cumulativeCap(offset, ctx.cap)];
     const crossChain = (leg) => leg.chainId !== ctx.chainId;
     const recipient = (offset, leg) => leg.recipient === undefined ? [] : [pinWord(offset, pad(leg.recipient))];
+    // LZMultiCall routes a call to its own TransferDelegate through
+    // `_handleTransfer`, which reverts unless the data is 132 bytes of
+    // `delegateTransferFrom` pulling from the caller, the account.
     const pull = {
         target: transferDelegate,
         selector: DELEGATE_TRANSFER_FROM,
         length: 132,
-        args: (at) => [
-            pin(at(0n), token),
-            pin(at(32n), account),
-            pin(at(64n), multiCall),
-        ],
+        shapeChecked: true,
+        args: (at) => [pin(at(0n), token), pin(at(64n), multiCall)],
     };
     const sweep = {
         target: multiCall,
@@ -99,13 +120,22 @@ export function scopeLz(ctx) {
         args: (at) => [pin(at(0n), spender)],
     });
     const routes = [];
+    const cctp = source.cctp;
+    const cctpFrom = cctp !== undefined && isAddressEqual(token, cctp.token);
+    // A route exists where both chains carry its block.
+    const cctpLinks = (leg) => cctpFrom && crossChain(leg) && servedLz(leg)?.cctp !== undefined;
+    // A leg whose token CCTP does not mint, such as a Stargate USDC, stays
+    // Stargate's.
+    const cctpReaches = (leg) => {
+        const dst = servedLz(leg)?.cctp;
+        return cctpLinks(leg) && !!dst && isAddressEqual(leg.token, dst.token);
+    };
     const stargate = source.stargateUsdc;
     if (stargate !== undefined && isAddressEqual(token, stargate.token)) {
         const send = {
             target: stargate.pool,
             selector: OFT_SEND_SELECTOR,
             length: 484,
-            payable: true,
             args: (at) => [
                 pinValue(at(SEND.sendParamPointer), 0x80n),
                 // The fee is native only; the refund returns to LZMultiCall, whose
@@ -124,28 +154,15 @@ export function scopeLz(ctx) {
         const calls = [pull, approve(stargate.pool), send, sweep];
         const { rules, args } = batch(calls);
         const s = args[2];
-        // TAXI: extraOptions 0x0003, composeMsg and oftCmd empty. BUS: extraOptions
-        // and composeMsg empty, oftCmd 0x01. No native drop, no compose.
-        const taxi = [
-            pinValue(s(SEND.composeMsgPointer), 0x120n),
-            pinValue(s(SEND.oftCmdPointer), 0x140n),
-            pinValue(s(0x160n), 2n),
-            pinValue(s(0x180n), 0x0003n << 240n),
-            pinValue(s(0x1a0n), 0n),
-            pinValue(s(0x1c0n), 0n),
-        ];
-        const bus = [
-            pinValue(s(SEND.composeMsgPointer), 0x100n),
-            pinValue(s(SEND.oftCmdPointer), 0x120n),
-            pinValue(s(0x160n), 0n),
-            pinValue(s(0x180n), 0n),
-            pinValue(s(0x1a0n), 1n),
-            pinValue(s(0x1c0n), 0x01n << 248n),
-        ];
-        const reaches = (leg) => crossChain(leg) && servedLz(leg)?.stargateUsdc !== undefined;
+        // TAXI: extraOptions 0x0003, composeMsg and oftCmd empty. No native drop,
+        // no compose.
+        rules.push(pinValue(s(SEND.composeMsgPointer), 0x120n), pinValue(s(SEND.oftCmdPointer), 0x140n), pinValue(s(0x160n), 2n), pinValue(s(0x180n), 0x0003n << 240n), pinValue(s(0x1a0n), 0n), pinValue(s(0x1c0n), 0n));
+        const reaches = (leg) => crossChain(leg) &&
+            servedLz(leg)?.stargateUsdc !== undefined &&
+            !cctpReaches(leg);
         routes.push({
             rules,
-            modes: [taxi, bus],
+            calls: calls.length,
             reaches,
             leg: (leg) => {
                 const dst = servedLz(leg)?.stargateUsdc;
@@ -159,14 +176,15 @@ export function scopeLz(ctx) {
             limits: cap(args[0](96n)),
         });
     }
-    const cctp = source.cctp;
-    if (cctp !== undefined && isAddressEqual(token, cctp.token)) {
+    if (cctpFrom) {
         const burn = {
             target: LZ_CCTP_TOKEN_MESSENGER,
             selector: DEPOSIT_FOR_BURN,
             length: 228,
+            // `burnToken` is not pinned: the pull and the sweep are pinned to this
+            // token and the account, so another burn token can only spend what a
+            // third party left in LZMultiCall, and the pull is swept back.
             args: (at) => [
-                pin(at(96n), token),
                 // A non-zero destinationCaller restricts who may mint; the API never
                 // sets one.
                 pinValue(at(128n), 0n),
@@ -187,11 +205,10 @@ export function scopeLz(ctx) {
                 : [pull, fee, approve(LZ_CCTP_TOKEN_MESSENGER), burn, sweep];
             const { rules, args } = batch(calls);
             const b = args[calls.indexOf(burn)];
-            const reaches = (leg) => crossChain(leg) &&
-                servedLz(leg)?.cctp !== undefined &&
-                (servedLz(leg)?.cctp?.feeless === true) === feeless;
+            const reaches = (leg) => cctpLinks(leg) && (servedLz(leg)?.cctp?.feeless === true) === feeless;
             routes.push({
                 rules,
+                calls: calls.length,
                 reaches,
                 leg: (leg) => {
                     const dst = servedLz(leg)?.cctp;
@@ -230,17 +247,30 @@ export function scopeLz(ctx) {
         if (pinned.length === 0)
             return [];
         return [
-            [
-                allOf(route.rules),
-                ...(route.modes ? [anyOf(route.modes.map(allOf))] : []),
-                anyOf(pinned.map(allOf)),
-                ...(route.limits.length ? [allOf(route.limits)] : []),
-            ].reduceRight((right, left) => ({ type: 'and', left, right })),
+            {
+                route,
+                rest: [
+                    anyOf(pinned.map(allOf)),
+                    ...(route.limits.length ? [allOf(route.limits)] : []),
+                ],
+            },
         ];
     });
     if (branches.length === 0) {
         throw new SettlementLayerRefusal(`crossChainPermits: LZ has no route from chain ${ctx.chainId} to any \`to\` chain`);
     }
+    // A pure pin that every branch of a group carries (`group.every`) is checked
+    // once, ahead of their OR; that alone makes it sound. Grouping by call count
+    // only picks the batches likely to share pins.
+    const groups = [...new Set(branches.map(({ route }) => route.calls))].map((calls) => {
+        const group = branches.filter(({ route }) => route.calls === calls);
+        const shared = group[0].route.rules.filter((rule) => group.every(({ route }) => route.rules.some((r) => sameRule(r, rule))));
+        const own = group.map(({ route, rest }) => {
+            const left = route.rules.filter((r) => !shared.some((s) => sameRule(s, r)));
+            return and([...(left.length ? [allOf(left)] : []), ...rest]);
+        });
+        return and([...(shared.length ? [allOf(shared)] : []), anyOf(own)]);
+    });
     return {
         target: multiCall,
         selector: LZ_EXECUTE_SELECTOR,
@@ -258,7 +288,7 @@ export function scopeLz(ctx) {
                     // stale TransferDelegate allowance could fund a second route, and a
                     // second Stargate send would pay another native fee.
                     left: allOf([{ ...pinValue(0n, 0x40n), usageLimit: 0x40n }]),
-                    right: anyOf(branches),
+                    right: anyOf(groups),
                 },
             },
         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinestone/sdk",
-  "version": "0.0.0-dev-20261008160531",
+  "version": "0.0.0-dev-20261008160829",
   "description": "Smart wallets and multichain transactions for your application",
   "author": {
     "name": "Rhinestone",