@rhinestone/sdk 2.0.0-beta.3 → 2.0.0-beta.30

package/dist/src/modules/validators/smart-sessions.js

@@ -1,5 +1,5 @@
 import { LibZip } from 'solady';
-import { concat, createPublicClient, encodeAbiParameters, encodeFunctionData, encodePacked, hashStruct, isHex, keccak256, maxUint256, padHex, size, toFunctionSelector, toHex, zeroAddress, zeroHash, } from 'viem';
+import { concat, createPublicClient, encodeAbiParameters, encodeFunctionData, encodePacked, hashStruct, isAddressEqual, isHex, keccak256, maxUint256, padHex, size, toFunctionSelector, toHex, zeroAddress, zeroHash, } from 'viem';
 import { mainnet } from 'viem/chains';
 import { getAccountProvider } from '../../accounts/index.js';
 import { K1_DEFAULT_VALIDATOR_ADDRESS } from '../../accounts/startale.js';
@@ -9,8 +9,10 @@ import { signTypedData } from '../../execution/utils.js';
 import { getChainById, getWrappedTokenAddress, } from '../../orchestrator/registry.js';
 import smartSessionEmissaryAbi from '../abi/smart-session-emissary.js';
 import { MODULE_TYPE_ID_VALIDATOR } from '../common.js';
-import { getOwnerValidator, getValidator, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, } from './core.js';
-import { resolvePermissions } from './permissions.js';
+import { getOwnerValidator, getValidator, ownerSetUsesEns, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, } from './core.js';
+import { resolveCrossChainPermission } from './cross-chain-permits.js';
+import { FAR_FUTURE_MS, resolvePermissions } from './permissions.js';
+import { getArbitersForSettlementLayers } from './policies/claim/arbiters.js';
 import { encodePermit2ClaimPolicyInitData, PERMIT2_CLAIM_POLICY_ADDRESS, } from './policies/claim/permit2.js';
 const types = {
     PolicyData: [
@@ -68,12 +70,13 @@ const SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSIO
 // intentionally uncommon.
 const DUMMY_PRECLAIMOP_TARGET = '0x0000000000000000000000000000000000000420';
 const DUMMY_PRECLAIMOP_SELECTOR = '0x69123456';
-const SPENDING_LIMITS_POLICY_ADDRESS = '0x00000088d48cf102a8cdb0137a9b173f957c6343';
-const TIME_FRAME_POLICY_ADDRESS = '0x8177451511de0577b911c254e9551d981c26dc72';
-const SUDO_POLICY_ADDRESS = '0x0000003111cd8e92337c100f22b7a9dbf8dee301';
-const UNIVERSAL_ACTION_POLICY_ADDRESS = '0x0000006dda6c463511c4e9b05cfc34c1247fcf1f';
-const USAGE_LIMIT_POLICY_ADDRESS = '0x1f34ef8311345a3a4a4566af321b313052f51493';
-const VALUE_LIMIT_POLICY_ADDRESS = '0x730da93267e7e513e932301b47f2ac7d062abc83';
+const SPENDING_LIMITS_POLICY_ADDRESS = '0x000000000033212E272655D8a22402Db819477A6';
+const TIME_FRAME_POLICY_ADDRESS = '0x0000000000D30f611fA3bf652ac6879428586930';
+const SUDO_POLICY_ADDRESS = '0x0000000000FEEc8D74e3143fBaBbca515358d869';
+const UNIVERSAL_ACTION_POLICY_ADDRESS = '0x0000000000714Cf48FcF88A0bFBa70d313415032';
+const ARG_POLICY_ADDRESS = '0x0000000000167edE64D8751daACDdC0312565a73';
+const USAGE_LIMIT_POLICY_ADDRESS = '0x00000000001d4479FA2A947026204d0283ceDe4B';
+const VALUE_LIMIT_POLICY_ADDRESS = '0x000000000021dC45451291BCDfc9f0B46d6f0278';
 const INTENT_EXECUTION_POLICY_ADDRESS = '0xe9eA54d063975cDee9e06b7636d5563d95a7A23C';
 const INTENT_EXECUTION_POLICY_ADDRESS_DEV = '0xa09b47de6e510cbdc18b97e9239bedcb44fb4901';
 const ACTION_CONDITION_EQUAL = 0;
@@ -83,6 +86,44 @@ const ACTION_CONDITION_GREATER_THAN_OR_EQUAL = 3;
 const ACTION_CONDITION_LESS_THAN_OR_EQUAL = 4;
 const ACTION_CONDITION_NOT_EQUAL = 5;
 const ACTION_CONDITION_IN_RANGE = 6;
+// ArgPolicy expression-tree node packing — must match ArgPolicyTreeLib.sol:
+//   bits  0..1  : node type (0=rule, 1=NOT, 2=AND, 3=OR)
+//   bits  2..9  : rule index (rule nodes only)
+//   bits 10..17 : left/only child index
+//   bits 18..25 : right child index (AND/OR only)
+const ARG_NODE_TYPE_RULE = 0n;
+const ARG_NODE_TYPE_NOT = 1n;
+const ARG_NODE_TYPE_AND = 2n;
+const ARG_NODE_TYPE_OR = 3n;
+const ARG_RULE_INDEX_SHIFT = 2n;
+const ARG_LEFT_CHILD_SHIFT = 10n;
+const ARG_RIGHT_CHILD_SHIFT = 18n;
+// On-chain caps from ArgPolicyTreeLib.sol; fail early instead of letting
+// the deployment revert with `TooManyRules` / `TooManyNodes`.
+const ARG_MAX_RULES = 128;
+const ARG_MAX_NODES = 256;
+const DEFAULT_POLICY_ADDRESSES = {
+    sudo: SUDO_POLICY_ADDRESS,
+    universalAction: UNIVERSAL_ACTION_POLICY_ADDRESS,
+    argPolicy: ARG_POLICY_ADDRESS,
+    spendingLimits: SPENDING_LIMITS_POLICY_ADDRESS,
+    timeFrame: TIME_FRAME_POLICY_ADDRESS,
+    usageLimit: USAGE_LIMIT_POLICY_ADDRESS,
+    valueLimit: VALUE_LIMIT_POLICY_ADDRESS,
+};
+function resolvePolicyAddresses(overrides) {
+    if (!overrides)
+        return DEFAULT_POLICY_ADDRESSES;
+    return {
+        sudo: overrides.sudo ?? DEFAULT_POLICY_ADDRESSES.sudo,
+        universalAction: overrides.universalAction ?? DEFAULT_POLICY_ADDRESSES.universalAction,
+        argPolicy: overrides.argPolicy ?? DEFAULT_POLICY_ADDRESSES.argPolicy,
+        spendingLimits: overrides.spendingLimits ?? DEFAULT_POLICY_ADDRESSES.spendingLimits,
+        timeFrame: overrides.timeFrame ?? DEFAULT_POLICY_ADDRESSES.timeFrame,
+        usageLimit: overrides.usageLimit ?? DEFAULT_POLICY_ADDRESSES.usageLimit,
+        valueLimit: overrides.valueLimit ?? DEFAULT_POLICY_ADDRESSES.valueLimit,
+    };
+}
 function packSignature(signers, validatorSignature) {
     const session = signers.session;
     const permissionId = getPermissionId(session);
@@ -389,8 +430,77 @@ async function getEnableSessionCall(account, session, enableSessionSignature, ha
         }),
     };
 }
+// SignedPermissionDisable(address account,bytes32 permissionId,bytes12 lockTag,uint256 expires,uint256 nonce)
+// Vendored from contracts/smart-sessions-v2/src/lib/HashLibV2.sol.
+const SIGNED_PERMISSION_DISABLE_TYPEHASH = '0x098b3120e60a8adc9d970dec9c1f8796974a3ab6154f995ad56ee7b9a38d8836';
+// Builds a `removeConfig` call that disables a single smart session.
+//
+// The disable user-signature (`disableData.userSig`) is left empty: the
+// emissary only verifies it when `msg.sender != account`
+// (SignatureLib.verifySignatures), and here the account itself executes the
+// call, so the disable is authorized by the outer transaction the user signs
+// normally. The `disableDigest` leaf still has to match on-chain, so we build
+// it from the current emissary nonce + `expires`. No-allocator flow only
+// (`allocator == zeroAddress`), matching how enable is used today.
+async function getDisableSessionCall(account, session, expires, provider, useDevContracts) {
+    const lockTag = '0x000000000000000000000000';
+    const permissionId = getPermissionId(session);
+    const nonce = await getSessionNonce(account, session, lockTag, provider, useDevContracts);
+    // SmartSessionLens reuses the session multichain wrapper for the disable
+    // digest, plugging this leaf in as `sessionDigest` (HashLibV2.disableDigest).
+    const disableDigest = keccak256(encodeAbiParameters([
+        { type: 'bytes32' },
+        { type: 'address' },
+        { type: 'bytes32' },
+        { type: 'bytes12' },
+        { type: 'uint256' },
+        { type: 'uint256' },
+    ], [
+        SIGNED_PERMISSION_DISABLE_TYPEHASH,
+        account,
+        permissionId,
+        lockTag,
+        expires,
+        nonce,
+    ]));
+    const hashesAndChainIds = [
+        { chainId: BigInt(session.chain.id), sessionDigest: disableDigest },
+    ];
+    return {
+        to: getSmartSessionEmissaryAddress(useDevContracts),
+        data: encodeFunctionData({
+            abi: smartSessionEmissaryAbi,
+            functionName: 'removeConfig',
+            args: [
+                account,
+                {
+                    scope: SCOPE_MULTICHAIN,
+                    resetPeriod: RESET_PERIOD_ONE_WEEK,
+                    allocator: zeroAddress,
+                    permissionId,
+                },
+                {
+                    allocatorSig: '0x',
+                    userSig: '0x',
+                    expires,
+                    session: {
+                        chainDigestIndex: 0,
+                        hashesAndChainIds,
+                    },
+                },
+            ],
+        }),
+    };
+}
 function toSession(definition, options = {}) {
-    const sessionData = resolveSessionData(definition, options.useDevContracts);
+    const addresses = resolvePolicyAddresses(definition.policyAddresses);
+    const sessionData = resolveSessionData(definition, options.useDevContracts, addresses);
+    // Cross-chain permits add synthesized claim policies that must appear
+    // on the returned `Session` too — `getSessionData(session)` re-encodes
+    // from `session.claimPolicies` at signing time, so missing entries
+    // here would diverge from what `resolveSessionData` already baked
+    // into `sessionData.claimPolicies` for the permission-ID hash.
+    const expandedCrossChainClaims = (definition.crossChainPermits ?? []).map((p) => expandCrossChainPermit(p, options.useDevContracts).claim);
     return {
         chain: definition.chain,
         owners: definition.owners,
@@ -401,8 +511,174 @@ function toSession(definition, options = {}) {
         salt: sessionData.salt,
         erc7739Policies: sessionData.erc7739Policies,
         actions: sessionData.actions,
-        claimPolicies: definition.claimPolicies ?? [],
+        claimPolicies: [
+            ...(definition.claimPolicies ?? []),
+            ...expandedCrossChainClaims,
+        ],
+    };
+}
+/**
+ * Expands one {@link CrossChainPermit} into:
+ *
+ * - a {@link Permit2ClaimPolicy} for `SessionDefinition.claimPolicies`
+ *   (gates Permit2 arbiter settlement) — settlement layers are resolved
+ *   to canonical arbiter addresses via
+ *   {@link getArbitersForSettlementLayers}.
+ * - optional {@link SpendingLimitsPolicy} / {@link TimeFramePolicy}
+ *   entries for the session's fallback action — the claim policy itself
+ *   doesn't enforce amounts or expiry on-chain, so we lift those
+ *   guarantees into action-level policies that do.
+ *
+ * An Intent Executor policy is intentionally NOT synthesized: the
+ * params-bearing on-chain contract is still being designed in
+ * smart-sessions-v2 (PR #46). Once it lands, this helper grows a second
+ * branch that emits matching constraints there.
+ */
+function expandCrossChainPermit(input, useDevContracts) {
+    const permit = resolveCrossChainPermission(input);
+    // `from`/`to` are optional: an absent leg list means "no token/chain
+    // restriction on that side" — we emit `undefined` so the underlying
+    // Permit2 policy skips the check entirely (matching how every other
+    // policy field treats undefined as unrestricted).
+    const sourceTokens = permit.from?.length
+        ? permit.from.map(({ chain, token }) => ({ chain, address: token }))
+        : undefined;
+    const destinationTokens = permit.to?.length
+        ? permit.to.map(({ chain, token }) => ({ chain, address: token }))
+        : undefined;
+    // Only emit a `recipients` whitelist when at least one destination
+    // leg pins a concrete recipient (or the explicit `'any'` sentinel).
+    // Leaving the field undefined disables the on-chain recipient check
+    // entirely; emitting `['any', ...]` would force the contract into
+    // recipient-check mode without actually restricting anything.
+    const recipientsList = (permit.to ?? [])
+        .filter((t) => t.recipient !== undefined)
+        .map((t) => ({
+        chain: t.chain,
+        address: t.recipient,
+    }));
+    const recipients = recipientsList.length ? recipientsList : undefined;
+    const permitDeadline = permit.validAfter !== undefined || permit.validUntil !== undefined
+        ? { min: permit.validAfter, max: permit.validUntil }
+        : undefined;
+    // Resolve the dev-friendly settlement-layer selectors into the actual
+    // Permit2 arbiter addresses the on-chain policy enforces. Empty or
+    // undefined ⇒ union of all supported layers (never an empty
+    // whitelist that disables the on-chain check).
+    const spenders = getArbitersForSettlementLayers(permit.settlementLayers, useDevContracts);
+    const claim = {
+        type: 'permit2',
+        spenders,
+        sourceTokens,
+        destinationTokens,
+        recipients,
+        recipientIsAccount: permit.recipientIsAccount,
+        permitDeadline,
+        fillDeadline: permit.fillDeadline,
     };
+    const fallbackPolicies = [];
+    // Per-origin amount caps: the Permit2 claim policy doesn't enforce
+    // amounts on-chain, so we lift those caps into a separate
+    // `SpendingLimitsPolicy` on the fallback action. This keeps the
+    // user-facing promise ("at most X of token Y") honest.
+    const limits = (permit.from ?? [])
+        .filter((f) => f.maxAmount !== undefined)
+        .map((f) => ({ token: f.token, amount: f.maxAmount }));
+    if (limits.length) {
+        fallbackPolicies.push({ type: 'spending-limits', limits });
+    }
+    // Time-frame: the on-chain TimeFramePolicy expects millisecond inputs
+    // (see `case 'time-frame'` in getPolicyData), while CrossChainPermit
+    // uses unix-seconds bigints — matching the Permit2 deadline
+    // convention. We convert at the boundary so both encoders see their
+    // preferred unit.
+    //
+    // One-sided bounds get always-passing defaults, mirroring the
+    // permission resolver: an unset `validUntil` defaults to the year-2100
+    // sentinel (NOT 0 — that would make the policy expired the moment
+    // `validAfter` is reached), and an unset `validAfter` defaults to 0.
+    if (permitDeadline) {
+        const validUntilMs = permit.validUntil !== undefined
+            ? Number(permit.validUntil * 1000n)
+            : FAR_FUTURE_MS;
+        const validAfterMs = permit.validAfter !== undefined ? Number(permit.validAfter * 1000n) : 0;
+        fallbackPolicies.push({
+            type: 'time-frame',
+            validUntil: validUntilMs,
+            validAfter: validAfterMs,
+        });
+    }
+    return { claim, fallbackPolicies };
+}
+/**
+ * True when `message` satisfies every dimension `policy` constrains. Used to
+ * pick the correct claim policy at Permit2-signing time when a session holds
+ * more than one (e.g. a user claim policy plus one or more cross-chain
+ * permits).
+ *
+ * The on-chain emissary validates a Permit2 claim against the matching claim
+ * policy, and `buildPermit2ClaimPolicyCalldata` expands the message
+ * differently per policy (the calldata layout depends on which mode bits a
+ * policy enables). Signing calldata for the wrong policy decodes incorrectly
+ * on-chain and fails ERC-1271 validation — hence we must match.
+ *
+ * Only constrained dimensions are checked; an unset policy field imposes no
+ * requirement (mirrors the contract's "skip the check" semantics). Source
+ * tokens are matched by address alone because the Permit2 message carries no
+ * origin chain id; destination tokens / recipients are scoped to the
+ * mandate's `targetChain`.
+ */
+function permit2ClaimPolicyMatchesMessage(policy, message) {
+    // Spender (arbiter) — the primary discriminator between settlement layers.
+    if (policy.spenders?.length) {
+        if (!policy.spenders.some((s) => isAddressEqual(s, message.spender))) {
+            return false;
+        }
+    }
+    // Source tokens: every permitted token must be allow-listed (by address).
+    if (policy.sourceTokens?.length) {
+        const allowed = new Set(policy.sourceTokens.map((t) => t.address.toLowerCase()));
+        if (!message.permitted.every((p) => allowed.has(p.token.toLowerCase()))) {
+            return false;
+        }
+    }
+    const targetChain = message.mandate.target.targetChain;
+    // Destination tokens: every mandate output token must be allow-listed for
+    // the destination chain.
+    if (policy.destinationTokens?.length) {
+        const allowed = new Set(policy.destinationTokens
+            .filter((t) => BigInt(t.chain.id) === targetChain)
+            .map((t) => t.address.toLowerCase()));
+        if (!message.mandate.target.tokenOut.every((o) => allowed.has(o.token.toLowerCase()))) {
+            return false;
+        }
+    }
+    // Recipient: scoped to the destination chain. An `'any'` entry for that
+    // chain accepts any recipient.
+    if (policy.recipients?.length) {
+        const entries = policy.recipients.filter((r) => BigInt(r.chain.id) === targetChain);
+        if (entries.length) {
+            const recipient = message.mandate.target.recipient;
+            const matches = entries.some((r) => r.address === 'any' || isAddressEqual(r.address, recipient));
+            if (!matches)
+                return false;
+        }
+    }
+    return true;
+}
+/**
+ * Selects the claim policy whose constraints the given Permit2 message
+ * satisfies. With 0–1 policies the choice is trivial; with several, returns
+ * the first match in list order (aligns with the contract iterating its
+ * stored claim policies). Falls back to the first policy when nothing matches
+ * so behaviour is never worse than the previous always-`[0]` logic — the
+ * resulting on-chain failure is then identical to before.
+ */
+function selectPermit2ClaimPolicyForMessage(claimPolicies, message) {
+    if (claimPolicies.length <= 1)
+        return claimPolicies[0];
+    return (claimPolicies.find((p) => permit2ClaimPolicyMatchesMessage(p, message)) ??
+        claimPolicies[0]);
 }
 function resolvePermit2ClaimPolicy(policy) {
     return {
@@ -429,7 +705,13 @@ function resolvePermit2ClaimPolicy(policy) {
         })),
     };
 }
-function resolveSessionData(session, useDevContracts) {
+function resolveSessionData(session, useDevContracts, addresses = DEFAULT_POLICY_ADDRESSES) {
+    // ENS validation is HCA-only, and HCA accounts cannot install the smart
+    // session validator, so an ENS session owner would silently resolve to the
+    // HCA module and sign/enable against a validator the account does not have.
+    if (ownerSetUsesEns(session.owners)) {
+        throw new Error('ENS owners are not supported for smart sessions');
+    }
     const validator = getValidator(session.owners);
     const allowedContent = [
         {
@@ -441,7 +723,7 @@ function resolveSessionData(session, useDevContracts) {
         allowedERC7739Content: allowedContent,
         erc1271Policies: [
             {
-                policy: SUDO_POLICY_ADDRESS,
+                policy: addresses.sudo,
                 initData: '0x',
             },
         ],
@@ -451,7 +733,7 @@ function resolveSessionData(session, useDevContracts) {
         actionTarget: SMART_SESSIONS_FALLBACK_TARGET_FLAG,
         actionPolicies: [
             {
-                policy: SUDO_POLICY_ADDRESS,
+                policy: addresses.sudo,
                 initData: '0x',
             },
         ],
@@ -459,6 +741,14 @@ function resolveSessionData(session, useDevContracts) {
     const userActions = session.permissions?.length
         ? resolvePermissions(session.permissions)
         : [];
+    // Expand every cross-chain permit into a (claim, fallbackPolicies)
+    // pair. The claim policies go onto `session.claimPolicies` (Permit2
+    // settlement); the fallback policies (SpendingLimits / TimeFrame
+    // derived from maxAmount / validUntil) are appended to the injected
+    // fallback action below.
+    const expandedPermits = (session.crossChainPermits ?? []).map((p) => expandCrossChainPermit(p, useDevContracts));
+    const extraClaimPolicies = expandedPermits.map((e) => e.claim);
+    const permitFallbackPolicies = expandedPermits.flatMap((e) => e.fallbackPolicies);
     const injectedActions = [
         // Native token wrapping
         {
@@ -471,8 +761,17 @@ function resolveSessionData(session, useDevContracts) {
                 stateMutability: 'payable',
             }),
         },
-        // Intent-execution fallback for any non-scoped call.
-        { policies: [{ type: 'intent-execution' }] },
+        // Intent-execution fallback for any non-scoped call. Cross-chain
+        // permits attach their synthesized SpendingLimits / TimeFrame
+        // guardrails to this same fallback so the on-chain emissary applies
+        // them when the orchestrator drives a bridge through the fallback
+        // action path.
+        {
+            policies: [
+                { type: 'intent-execution' },
+                ...permitFallbackPolicies,
+            ],
+        },
         // Dummy action: allows the filler to call verifyExecution in ENABLE mode using
         // an injected dummy preclaimop so any session can be enabled on-chain without
         // a separate UserOp, regardless of whether it has claim or action policies.
@@ -483,7 +782,12 @@ function resolveSessionData(session, useDevContracts) {
         },
     ];
     const allActions = [...userActions, ...injectedActions];
-    const actions = userActions.length
+    // When there are cross-chain permits but no explicit user actions, we
+    // still want the injected fallback (with its synthesized guardrails)
+    // to land on-chain — otherwise the legacy `[sudoAction]` path drops
+    // the SpendingLimits / TimeFrame the user explicitly asked for.
+    const needsInjection = userActions.length || permitFallbackPolicies.length;
+    const actions = needsInjection
         ? allActions.map((action) => ({
             actionTargetSelector: 'selector' in action
                 ? action.selector
@@ -491,24 +795,33 @@ function resolveSessionData(session, useDevContracts) {
             actionTarget: 'target' in action
                 ? action.target
                 : SMART_SESSIONS_FALLBACK_TARGET_FLAG,
-            actionPolicies: action.policies?.map((policy) => getPolicyData(policy, useDevContracts)) ?? [
+            actionPolicies: action.policies?.map((policy) => getPolicyData(policy, useDevContracts, addresses)) ?? [
                 {
-                    policy: SUDO_POLICY_ADDRESS,
+                    policy: addresses.sudo,
                     initData: '0x',
                 },
             ],
         }))
         : [sudoAction];
+    // Concatenate user-supplied claim policies with the ones synthesized
+    // from cross-chain permits. Order is not security-sensitive — the
+    // on-chain contract iterates the full list — but we keep user
+    // policies first for deterministic permission IDs across SDK
+    // releases that add permit expansion.
+    const allClaimPolicies = [
+        ...(session.claimPolicies ?? []),
+        ...extraClaimPolicies,
+    ];
     return {
         sessionValidator: validator.address,
         salt: zeroHash,
         sessionValidatorInitData: validator.initData,
         erc7739Policies: erc7739Data,
         actions,
-        claimPolicies: session.claimPolicies?.map((policy) => ({
+        claimPolicies: allClaimPolicies.map((policy) => ({
             policy: PERMIT2_CLAIM_POLICY_ADDRESS,
             initData: encodePermit2ClaimPolicyInitData(resolvePermit2ClaimPolicy(policy)),
-        })) ?? [],
+        })),
     };
 }
 function getSessionData(session) {
@@ -547,11 +860,88 @@ function getPermissionIdFromData(sessionData) {
         sessionData.salt,
     ]));
 }
-function getPolicyData(policy, useDevContracts) {
+function getActionConditionId(condition) {
+    switch (condition) {
+        case 'equal':
+            return ACTION_CONDITION_EQUAL;
+        case 'greaterThan':
+            return ACTION_CONDITION_GREATER_THAN;
+        case 'lessThan':
+            return ACTION_CONDITION_LESS_THAN;
+        case 'greaterThanOrEqual':
+            return ACTION_CONDITION_GREATER_THAN_OR_EQUAL;
+        case 'lessThanOrEqual':
+            return ACTION_CONDITION_LESS_THAN_OR_EQUAL;
+        case 'notEqual':
+            return ACTION_CONDITION_NOT_EQUAL;
+        case 'inRange':
+            return ACTION_CONDITION_IN_RANGE;
+    }
+}
+function encodeActionParamRule(rule) {
+    const ref = isHex(rule.referenceValue)
+        ? padHex(rule.referenceValue)
+        : toHex(rule.referenceValue, { size: 32 });
+    return {
+        condition: getActionConditionId(rule.condition),
+        offset: rule.calldataOffset,
+        isLimited: rule.usageLimit !== undefined,
+        ref,
+        usage: {
+            limit: rule.usageLimit ?? 0n,
+            used: 0n,
+        },
+    };
+}
+// Compile an ArgPolicyExpression AST into the on-chain wire format
+// (flat rules[] + bit-packed nodes[] + rootNodeIndex). Post-order walk:
+// children get appended before their parent so a parent's child indices
+// always reference earlier slots.
+function compileArgPolicyExpression(expr) {
+    const rules = [];
+    const nodes = [];
+    function walk(e) {
+        switch (e.type) {
+            case 'rule': {
+                const ruleIdx = rules.length;
+                rules.push(encodeActionParamRule(e.rule));
+                const nodeIdx = nodes.length;
+                nodes.push(ARG_NODE_TYPE_RULE | (BigInt(ruleIdx) << ARG_RULE_INDEX_SHIFT));
+                return nodeIdx;
+            }
+            case 'not': {
+                const childIdx = walk(e.child);
+                const nodeIdx = nodes.length;
+                nodes.push(ARG_NODE_TYPE_NOT | (BigInt(childIdx) << ARG_LEFT_CHILD_SHIFT));
+                return nodeIdx;
+            }
+            case 'and':
+            case 'or': {
+                const leftIdx = walk(e.left);
+                const rightIdx = walk(e.right);
+                const nodeIdx = nodes.length;
+                const nodeType = e.type === 'and' ? ARG_NODE_TYPE_AND : ARG_NODE_TYPE_OR;
+                nodes.push(nodeType |
+                    (BigInt(leftIdx) << ARG_LEFT_CHILD_SHIFT) |
+                    (BigInt(rightIdx) << ARG_RIGHT_CHILD_SHIFT));
+                return nodeIdx;
+            }
+        }
+    }
+    const rootNodeIndex = walk(expr);
+    if (rules.length > ARG_MAX_RULES) {
+        throw new Error(`ArgPolicy expression has ${rules.length} rules, max is ${ARG_MAX_RULES}`);
+    }
+    if (nodes.length > ARG_MAX_NODES) {
+        throw new Error(`ArgPolicy expression has ${nodes.length} nodes, max is ${ARG_MAX_NODES}`);
+    }
+    return { rules, packedNodes: nodes, rootNodeIndex };
+}
+function getPolicyData(policy, useDevContracts, addresses = DEFAULT_POLICY_ADDRESSES) {
     switch (policy.type) {
         case 'sudo':
             return {
-                policy: SUDO_POLICY_ADDRESS,
+                policy: addresses.sudo,
                 initData: '0x',
             };
         case 'intent-execution':
@@ -562,24 +952,6 @@ function getPolicyData(policy, useDevContracts) {
                 initData: '0x',
             };
         case 'universal-action': {
-            function getCondition(condition) {
-                switch (condition) {
-                    case 'equal':
-                        return ACTION_CONDITION_EQUAL;
-                    case 'greaterThan':
-                        return ACTION_CONDITION_GREATER_THAN;
-                    case 'lessThan':
-                        return ACTION_CONDITION_LESS_THAN;
-                    case 'greaterThanOrEqual':
-                        return ACTION_CONDITION_GREATER_THAN_OR_EQUAL;
-                    case 'lessThanOrEqual':
-                        return ACTION_CONDITION_LESS_THAN_OR_EQUAL;
-                    case 'notEqual':
-                        return ACTION_CONDITION_NOT_EQUAL;
-                    case 'inRange':
-                        return ACTION_CONDITION_IN_RANGE;
-                }
-            }
             const MAX_RULES = 16;
             const rules = createFixedArray(MAX_RULES, () => ({
                 condition: ACTION_CONDITION_EQUAL,
@@ -589,23 +961,10 @@ function getPolicyData(policy, useDevContracts) {
                 usage: { limit: 0n, used: 0n },
             }));
             for (let i = 0; i < policy.rules.length; i++) {
-                const rule = policy.rules[i];
-                const ref = isHex(rule.referenceValue)
-                    ? padHex(rule.referenceValue)
-                    : toHex(rule.referenceValue, { size: 32 });
-                rules[i] = {
-                    condition: getCondition(rule.condition),
-                    offset: rule.calldataOffset,
-                    isLimited: rule.usageLimit !== undefined,
-                    ref,
-                    usage: {
-                        limit: rule.usageLimit ? rule.usageLimit : 0n,
-                        used: 0n,
-                    },
-                };
+                rules[i] = encodeActionParamRule(policy.rules[i]);
             }
             return {
-                policy: UNIVERSAL_ACTION_POLICY_ADDRESS,
+                policy: addresses.universalAction,
                 initData: encodeAbiParameters([
                     {
                         components: [
@@ -674,17 +1033,69 @@ function getPolicyData(policy, useDevContracts) {
                 ]),
             };
         }
+        case 'arg-policy': {
+            const { rules, packedNodes, rootNodeIndex } = compileArgPolicyExpression(policy.expression);
+            return {
+                policy: addresses.argPolicy,
+                initData: encodeAbiParameters([
+                    {
+                        components: [
+                            { name: 'valueLimitPerUse', type: 'uint256' },
+                            {
+                                components: [
+                                    { name: 'rootNodeIndex', type: 'uint8' },
+                                    {
+                                        components: [
+                                            { name: 'condition', type: 'uint8' },
+                                            { name: 'offset', type: 'uint64' },
+                                            { name: 'isLimited', type: 'bool' },
+                                            { name: 'ref', type: 'bytes32' },
+                                            {
+                                                components: [
+                                                    { name: 'limit', type: 'uint256' },
+                                                    { name: 'used', type: 'uint256' },
+                                                ],
+                                                name: 'usage',
+                                                type: 'tuple',
+                                            },
+                                        ],
+                                        name: 'rules',
+                                        type: 'tuple[]',
+                                    },
+                                    { name: 'packedNodes', type: 'uint256[]' },
+                                ],
+                                name: 'paramRules',
+                                type: 'tuple',
+                            },
+                        ],
+                        name: 'ActionConfig',
+                        type: 'tuple',
+                    },
+                ], [
+                    {
+                        valueLimitPerUse: policy.valueLimitPerUse ?? 0n,
+                        paramRules: {
+                            rootNodeIndex,
+                            rules,
+                            packedNodes,
+                        },
+                    },
+                ]),
+            };
+        }
         case 'spending-limits': {
             const tokens = policy.limits.map(({ token }) => token);
             const limits = policy.limits.map(({ amount }) => amount);
             return {
-                policy: SPENDING_LIMITS_POLICY_ADDRESS,
+                policy: addresses.spendingLimits,
                 initData: encodeAbiParameters([{ type: 'address[]' }, { type: 'uint256[]' }], [tokens, limits]),
             };
         }
         case 'time-frame': {
+            // Deployed TimeFramePolicy slices initData[0:12] and unpacks as
+            // uint48 validUntil || uint48 validAfter (high 48 bits || low 48 bits).
             return {
-                policy: TIME_FRAME_POLICY_ADDRESS,
+                policy: addresses.timeFrame,
                 initData: encodePacked(['uint48', 'uint48'], [
                     Math.floor(policy.validUntil / 1000),
                     Math.floor(policy.validAfter / 1000),
@@ -693,13 +1104,13 @@ function getPolicyData(policy, useDevContracts) {
         }
         case 'usage-limit': {
             return {
-                policy: USAGE_LIMIT_POLICY_ADDRESS,
+                policy: addresses.usageLimit,
                 initData: encodePacked(['uint128'], [policy.limit]),
             };
         }
         case 'value-limit': {
             return {
-                policy: VALUE_LIMIT_POLICY_ADDRESS,
+                policy: addresses.valueLimit,
                 initData: encodeAbiParameters([{ type: 'uint256' }], [policy.limit]),
             };
         }
@@ -726,41 +1137,47 @@ function getSmartSessionEmissaryAddress(useDevContracts) {
         ? SMART_SESSION_EMISSARY_ADDRESS_DEV
         : SMART_SESSION_EMISSARY_ADDRESS;
 }
-/**
- * Builds a mockSignature for SSX validation gas estimation.
- * Format: emissaryAddress (20 bytes) + enable-mode sigData.
- * Uses real session data (policies/actions from the user's session config) with dummy
- * sigs and hashes — the mock emissary skips sig verification and only writes storage.
- * The orchestrator slices off the first 20 bytes to identify the validator, then
- * simulates verifyExecution with the mock emissary to estimate gas before the user signs.
- */
-function buildMockSignature(session, useDevContracts, chainCount = 1, targetChainId) {
+function buildMockSignature(session, useDevContracts, chainCount = 1, targetChainId, 
+// Defaults to the historical first-use ENABLE shape.
+shape = 'enable') {
+    // packSignature keys ENABLE vs USE on enableData *presence* within the
+    // verifyExecutions branch, and takes the ERC-1271 branch when verifyExecutions
+    // is false — so derive both from the requested shape.
+    const verifyExecutions = shape !== 'erc1271';
+    const includeEnableData = shape === 'enable';
     const emissaryAddress = getSmartSessionEmissaryAddress(useDevContracts);
-    // Use targetChainId when provided (per-chain mockSignatures path) so the
-    // mock emissary's chainId check passes on the correct chain. Falls back to
-    // session.chain.id for the global mockSignature (single-chain path).
-    const primaryChainId = targetChainId ?? session.chain.id;
-    // Normalize chainCount to a finite positive integer. Guards against
-    // accidental NaN/undefined from caller (e.g. `sourceChains?.length` when
-    // sourceChains is undefined) which would otherwise make Array.from produce
-    // an empty array and silently drop the ChainId check.
-    const safeChainCount = Number.isFinite(chainCount) && chainCount > 0 ? Math.floor(chainCount) : 1;
-    // Build one entry per chain — first entry is the real chain ID (for the ChainId check),
-    // remaining entries use chainId 0 as placeholders. Hash mismatch is skipped by the
-    // mock emissary, so sessionDigest can be zeroHash throughout.
-    const hashesAndChainIds = Array.from({ length: safeChainCount }, (_, i) => ({
-        chainId: i === 0 ? BigInt(primaryChainId) : 0n,
-        sessionDigest: zeroHash,
-    }));
-    const dummySigners = {
-        type: 'experimental_session',
-        session,
-        verifyExecutions: true,
-        enableData: {
+    // Include enableData only when the session is actually being enabled (ENABLE
+    // shape) — its presence is what makes packSignature emit 0x01 vs 0x00, and it's
+    // ignored entirely by the USE / ERC-1271 shapes. Built lazily so steady-state
+    // shapes skip the chainId-entry allocation.
+    let enableData;
+    if (includeEnableData) {
+        // Use targetChainId when provided (per-chain mockSignatures path) so the mock
+        // emissary's chainId check passes on the correct chain. Falls back to
+        // session.chain.id for the global mockSignature (single-chain path).
+        const primaryChainId = targetChainId ?? session.chain.id;
+        // Normalize chainCount to a finite positive integer — guards against NaN/
+        // undefined from callers (e.g. `sourceChains?.length`) that would otherwise
+        // produce an empty array and silently drop the ChainId check.
+        const safeChainCount = Number.isFinite(chainCount) && chainCount > 0 ? Math.floor(chainCount) : 1;
+        // First entry is the real chain ID (for the ChainId check), the rest are
+        // chainId 0 placeholders. Hash mismatch is skipped by the mock emissary, so
+        // sessionDigest can be zeroHash throughout.
+        const hashesAndChainIds = Array.from({ length: safeChainCount }, (_, i) => ({
+            chainId: i === 0 ? BigInt(primaryChainId) : 0n,
+            sessionDigest: zeroHash,
+        }));
+        enableData = {
             userSignature: `0x${'00'.repeat(65)}`,
             hashesAndChainIds,
             sessionToEnableIndex: 0,
-        },
+        };
+    }
+    const dummySigners = {
+        type: 'experimental_session',
+        session,
+        verifyExecutions,
+        ...(enableData && { enableData }),
     };
     const dummyValidatorSignature = `0x${'00'.repeat(65)}`;
     const sigData = packSignature(dummySigners, dummyValidatorSignature);
@@ -769,4 +1186,4 @@ function buildMockSignature(session, useDevContracts, chainCount = 1, targetChai
 function createFixedArray(length, getValue) {
     return Array.from({ length }, (_, i) => getValue(i));
 }
-export { SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSION, DUMMY_PRECLAIMOP_TARGET, DUMMY_PRECLAIMOP_SELECTOR, SPENDING_LIMITS_POLICY_ADDRESS, TIME_FRAME_POLICY_ADDRESS, SUDO_POLICY_ADDRESS, UNIVERSAL_ACTION_POLICY_ADDRESS, USAGE_LIMIT_POLICY_ADDRESS, VALUE_LIMIT_POLICY_ADDRESS, INTENT_EXECUTION_POLICY_ADDRESS, packSignature, toSession, resolvePermit2ClaimPolicy, getSessionData, getPolicyData, getEnableSessionCall, getPermissionId, getSmartSessionValidator, getSessionDetails, isSessionEnabled, signEnableSession, buildMockSignature, };
+export { SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSION, DUMMY_PRECLAIMOP_TARGET, DUMMY_PRECLAIMOP_SELECTOR, SPENDING_LIMITS_POLICY_ADDRESS, TIME_FRAME_POLICY_ADDRESS, SUDO_POLICY_ADDRESS, UNIVERSAL_ACTION_POLICY_ADDRESS, ARG_POLICY_ADDRESS, USAGE_LIMIT_POLICY_ADDRESS, VALUE_LIMIT_POLICY_ADDRESS, INTENT_EXECUTION_POLICY_ADDRESS, packSignature, toSession, resolvePermit2ClaimPolicy, selectPermit2ClaimPolicyForMessage, getSessionData, getPolicyData, getEnableSessionCall, getDisableSessionCall, getPermissionId, getSmartSessionValidator, getSessionDetails, isSessionEnabled, signEnableSession, buildMockSignature, };