@rhinestone/sdk 2.0.0-beta.3 → 2.0.0-beta.31

package/dist/src/jwt-server/jcs.js

@@ -2,7 +2,7 @@
  * RFC 8785 JSON Canonicalization Scheme (JCS).
  *
  * Produces a deterministic JSON serialization by:
- * 1. Sorting object keys lexicographically (Unicode code-point order)
+ * 1. Sorting object keys lexicographically (UTF-16 code-unit order, per RFC 8785 §3.2.3)
  * 2. Using ES2015+ `JSON.stringify` number serialization (IEEE 754 → shortest round-trip)
  * 3. No whitespace
  *
@@ -43,7 +43,9 @@ function serialize(value) {
         const items = value.map((item) => serialize(item));
         return `[${items.join(',')}]`;
     }
-    // Object — sort keys by Unicode code-point order
+    // Object — sort keys by UTF-16 code-unit order (RFC 8785 §3.2.3).
+    // Native String comparison already orders by UTF-16 code unit, which is
+    // exactly what JCS mandates — do not replace with a code-point comparator.
     const obj = value;
     const keys = Object.keys(obj).sort();
     const members = [];

package/dist/src/modules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../modules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,KAAK,EAAuB,MAAM,MAAM,CAAA;AAcpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAKhD,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,MAAM,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,8BAA8B,EAC9B,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACV,MAAM,6BAA6B,CAAA;AAKpC,iBAAS,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CA0EvD;AAED,iBAAS,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAY3D;AAED,iBAAS,yBAAyB,CAAC,KAAK,EAAE,KAAK,WAc9C;AAED,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../modules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,KAAK,EAAuB,MAAM,MAAM,CAAA;AAcpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAKhD,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,MAAM,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,8BAA8B,EAC9B,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACV,MAAM,6BAA6B,CAAA;AAKpC,iBAAS,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAmEvD;AAED,iBAAS,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAY3D;AAED,iBAAS,yBAAyB,CAAC,KAAK,EAAE,KAAK,WAc9C;AAED,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,CAAA"}

package/dist/src/modules/index.js

@@ -4,7 +4,6 @@ import { INTENT_EXECUTOR_ADDRESS, INTENT_EXECUTOR_ADDRESS_DEV, } from './chain-a
 import { getModule, MODULE_TYPE_EXECUTOR, MODULE_TYPE_FALLBACK, MODULE_TYPE_HOOK, MODULE_TYPE_ID_EXECUTOR, MODULE_TYPE_ID_FALLBACK, MODULE_TYPE_VALIDATOR, } from './common.js';
 import { getExecutors, getOwners, getValidators } from './read.js';
 import { getOwnerValidator, getSmartSessionValidator, MULTI_FACTOR_VALIDATOR_ADDRESS, OWNABLE_VALIDATOR_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS, WEBAUTHN_VALIDATOR_ADDRESS, } from './validators/index.js';
-import { getSocialRecoveryValidator } from './validators/core.js';
 import { getSessionDetails, signEnableSession, toSession, } from './validators/smart-sessions.js';
 const SMART_SESSION_COMPATIBILITY_FALLBACK_ADDRESS = '0x000000000052e9685932845660777DF43C2dC496';
 function getSetup(config) {
@@ -14,10 +13,6 @@ function getSetup(config) {
     if (smartSessionValidator) {
         validators.push(smartSessionValidator);
     }
-    if (config.recovery) {
-        const socialRecoveryValidator = getSocialRecoveryValidator(config.recovery.guardians, config.recovery.threshold);
-        validators.push(socialRecoveryValidator);
-    }
     const intentExecutor = getIntentExecutor(config);
     const executors = [intentExecutor];
     const fallbacks = [];

package/dist/src/modules/read.d.ts

@@ -1,10 +1,11 @@
 import { type Address, type Chain } from 'viem';
 import type { AccountType, ProviderConfig } from '../types.js';
 declare function getValidators(accountType: AccountType, account: Address, chain: Chain, provider?: ProviderConfig): Promise<Address[]>;
-declare function getOwners(account: Address, chain: Chain, provider?: ProviderConfig): Promise<{
+declare function getOwners(accountType: AccountType, account: Address, chain: Chain, provider?: ProviderConfig): Promise<{
     accounts: Address[];
     threshold: number;
 } | null>;
 declare function getExecutors(accountType: AccountType, account: Address, chain: Chain, provider?: ProviderConfig): Promise<Address[]>;
-export { getValidators, getExecutors, getOwners };
+declare function isValidatorInitialized(account: Address, chain: Chain, validatorAddress: Address, provider?: ProviderConfig): Promise<boolean>;
+export { getValidators, getExecutors, getOwners, isValidatorInitialized };
 //# sourceMappingURL=read.d.ts.map

package/dist/src/modules/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../modules/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,KAAK,EAAsB,MAAM,MAAM,CAAA;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAG3D,iBAAe,aAAa,CAC1B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAiDpB;AAED,iBAAe,SAAS,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAC,CAkER;AAED,iBAAe,YAAY,CACzB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAiDpB;AAED,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../modules/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,KAAK,EAAsB,MAAM,MAAM,CAAA;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAG3D,iBAAe,aAAa,CAC1B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAkDpB;AAED,iBAAe,SAAS,CACtB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAC,CAqER;AAED,iBAAe,YAAY,CACzB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CAkDpB;AAED,iBAAe,sBAAsB,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,gBAAgB,EAAE,OAAO,EACzB,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,OAAO,CAAC,CAwBlB;AAED,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAA"}

package/dist/src/modules/read.js

@@ -1,6 +1,6 @@
 import { createPublicClient } from 'viem';
 import { createTransport } from '../accounts/utils.js';
-import { OWNABLE_VALIDATOR_ADDRESS } from './validators/core.js';
+import { ENS_HCA_MODULE, OWNABLE_VALIDATOR_ADDRESS } from './validators/core.js';
 async function getValidators(accountType, account, chain, provider) {
     const publicClient = createPublicClient({
         chain,
@@ -9,6 +9,7 @@ async function getValidators(accountType, account, chain, provider) {
     switch (accountType) {
         case 'safe':
         case 'startale':
+        case 'hca':
         case 'nexus': {
             const validators = await publicClient.readContract({
                 abi: [
@@ -51,12 +52,14 @@ async function getValidators(accountType, account, chain, provider) {
         }
     }
 }
-async function getOwners(account, chain, provider) {
+async function getOwners(accountType, account, chain, provider) {
     const publicClient = createPublicClient({
         chain,
         transport: createTransport(chain, provider),
     });
-    const moduleAddress = OWNABLE_VALIDATOR_ADDRESS;
+    // HCA accounts hold owner state under the ENS HCA module, which is also
+    // OwnableValidator-based, so the getOwners/threshold reads are identical.
+    const moduleAddress = accountType === 'hca' ? ENS_HCA_MODULE : OWNABLE_VALIDATOR_ADDRESS;
     const [ownerResult, thresholdResult] = await publicClient.multicall({
         contracts: [
             {
@@ -126,6 +129,7 @@ async function getExecutors(accountType, account, chain, provider) {
     switch (accountType) {
         case 'safe':
         case 'startale':
+        case 'hca':
         case 'nexus': {
             const executors = await publicClient.readContract({
                 abi: [
@@ -168,4 +172,29 @@ async function getExecutors(accountType, account, chain, provider) {
         }
     }
 }
-export { getValidators, getExecutors, getOwners };
+async function isValidatorInitialized(account, chain, validatorAddress, provider) {
+    const publicClient = createPublicClient({
+        chain,
+        transport: createTransport(chain, provider),
+    });
+    // `isInitialized` is a plain storage read on the validator singleton and
+    // returns `false` for an uninitialized (or undeployed) account without
+    // reverting. We deliberately let real read failures (provider/ABI errors)
+    // propagate rather than coercing them to `false`, which could otherwise
+    // produce an `onInstall` call for an already-initialized account.
+    return publicClient.readContract({
+        abi: [
+            {
+                name: 'isInitialized',
+                type: 'function',
+                stateMutability: 'view',
+                inputs: [{ name: 'smartAccount', type: 'address' }],
+                outputs: [{ name: '', type: 'bool' }],
+            },
+        ],
+        functionName: 'isInitialized',
+        address: validatorAddress,
+        args: [account],
+    });
+}
+export { getValidators, getExecutors, getOwners, isValidatorInitialized };

package/dist/src/modules/validators/core.d.ts

@@ -1,4 +1,4 @@
-import { type Account, type Address, type Hex } from 'viem';
+import { type Address, type Hex } from 'viem';
 import type { ENSValidatorConfig, OwnableValidatorConfig, OwnerSet, RhinestoneAccountConfig, WebauthnValidatorConfig } from '../../types.js';
 import { type Module } from '../common.js';
 declare const SMART_SESSION_EMISSARY_ADDRESS_DEV: Address;
@@ -13,19 +13,19 @@ interface WebauthnCredential {
     authenticatorId: string;
 }
 declare const OWNABLE_VALIDATOR_ADDRESS: Address;
-declare const ENS_VALIDATOR_ADDRESS: Address;
+declare const ENS_HCA_MODULE: Address;
 declare const WEBAUTHN_VALIDATOR_ADDRESS: Address;
 declare const MULTI_FACTOR_VALIDATOR_ADDRESS: Address;
 declare const WEBAUTHN_V0_VALIDATOR_ADDRESS: Address;
+declare function ownerSetUsesEns(owners: OwnerSet): boolean;
 declare function getOwnerValidator(config: RhinestoneAccountConfig): Module;
 declare function getMockSignature(ownerSet: OwnerSet): Hex;
 declare function getValidator(owners: OwnerSet): Module;
 declare function getOwnableValidator(threshold: number, owners: Address[], address?: Address): Module;
-declare function getENSValidator(threshold: number, owners: Address[], ownerExpirations: number[], address?: Address): Module;
+declare function getENSValidator(threshold: number, owners: Address[], expirations: (Date | undefined)[], address?: Address): Module;
 declare function getWebAuthnValidator(threshold: number, webAuthnCredentials: WebauthnCredential[], address?: Address): Module;
 declare function getMultiFactorValidator(threshold: number, validators: (OwnableValidatorConfig | ENSValidatorConfig | WebauthnValidatorConfig | null)[]): Module;
-declare function getSocialRecoveryValidator(guardians: Account[], threshold?: number): Module;
 declare function supportsEip712(validator: Module): boolean;
-export { OWNABLE_VALIDATOR_ADDRESS, ENS_VALIDATOR_ADDRESS, WEBAUTHN_VALIDATOR_ADDRESS, MULTI_FACTOR_VALIDATOR_ADDRESS, WEBAUTHN_V0_VALIDATOR_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, getOwnerValidator, getOwnableValidator, getENSValidator, getWebAuthnValidator, getMultiFactorValidator, getSocialRecoveryValidator, getValidator, getMockSignature, supportsEip712, };
+export { OWNABLE_VALIDATOR_ADDRESS, ENS_HCA_MODULE, WEBAUTHN_VALIDATOR_ADDRESS, MULTI_FACTOR_VALIDATOR_ADDRESS, WEBAUTHN_V0_VALIDATOR_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, getOwnerValidator, getOwnableValidator, getENSValidator, getWebAuthnValidator, getMultiFactorValidator, getValidator, getMockSignature, supportsEip712, ownerSetUsesEns, };
 export type { WebauthnCredential };
 //# sourceMappingURL=core.d.ts.map

package/dist/src/modules/validators/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../../modules/validators/core.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,KAAK,GAAG,EAKT,MAAM,MAAM,CAAA;AAGb,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,QAAQ,EACR,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AAEjE,QAAA,MAAM,kCAAkC,EAAE,OACI,CAAA;AAC9C,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAE9C,UAAU,SAAS;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,SAAS,GAAG,GAAG,GAAG,UAAU,CAAA;IACpC,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,QAAA,MAAM,yBAAyB,EAAE,OACa,CAAA;AAC9C,QAAA,MAAM,qBAAqB,EAAE,OACiB,CAAA;AAC9C,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAG9C,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAO9C,QAAA,MAAM,6BAA6B,EAAE,OACS,CAAA;AAO9C,iBAAS,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,UAKzD;AAED,iBAAS,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAmDjD;AAED,iBAAS,YAAY,CAAC,MAAM,EAAE,QAAQ,UA2BrC;AAED,iBAAS,mBAAmB,CAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EAAE,EACjB,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CAiBR;AAED,iBAAS,eAAe,CACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EAAE,EACjB,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CAsCR;AAED,iBAAS,oBAAoB,CAC3B,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,kBAAkB,EAAE,EACzC,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CA4DR;AAED,iBAAS,uBAAuB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,CACR,sBAAsB,GACtB,kBAAkB,GAClB,uBAAuB,GACvB,IAAI,CACP,EAAE,GACF,MAAM,CAgDR;AAED,iBAAS,0BAA0B,CACjC,SAAS,EAAE,OAAO,EAAE,EACpB,SAAS,SAAI,GACZ,MAAM,CAsBR;AAeD,iBAAS,cAAc,CAAC,SAAS,EAAE,MAAM,WAUxC;AAED,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,CAAA;AACD,YAAY,EAAE,kBAAkB,EAAE,CAAA"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../../modules/validators/core.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAKZ,KAAK,GAAG,EAKT,MAAM,MAAM,CAAA;AAMb,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,QAAQ,EACR,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AAEjE,QAAA,MAAM,kCAAkC,EAAE,OACI,CAAA;AAC9C,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAE9C,UAAU,SAAS;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,SAAS,GAAG,GAAG,GAAG,UAAU,CAAA;IACpC,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,QAAA,MAAM,yBAAyB,EAAE,OACa,CAAA;AAC9C,QAAA,MAAM,cAAc,EAAE,OAAsD,CAAA;AAC5E,QAAA,MAAM,0BAA0B,EAAE,OACY,CAAA;AAC9C,QAAA,MAAM,8BAA8B,EAAE,OACQ,CAAA;AAO9C,QAAA,MAAM,6BAA6B,EAAE,OACS,CAAA;AAU9C,iBAAS,eAAe,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAMlD;AAED,iBAAS,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,UA2BzD;AAED,iBAAS,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAsDjD;AAED,iBAAS,YAAY,CAAC,MAAM,EAAE,QAAQ,UA2BrC;AAED,iBAAS,mBAAmB,CAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EAAE,EACjB,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CAiBR;AAED,iBAAS,eAAe,CACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,EAAE,EACjB,WAAW,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC,EAAE,EACjC,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CA8CR;AAED,iBAAS,oBAAoB,CAC3B,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,kBAAkB,EAAE,EACzC,OAAO,CAAC,EAAE,OAAO,GAChB,MAAM,CA4DR;AAED,iBAAS,uBAAuB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,CACR,sBAAsB,GACtB,kBAAkB,GAClB,uBAAuB,GACvB,IAAI,CACP,EAAE,GACF,MAAM,CAgDR;AAeD,iBAAS,cAAc,CAAC,SAAS,EAAE,MAAM,WAUxC;AAED,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,CAAA;AACD,YAAY,EAAE,kBAAkB,EAAE,CAAA"}

package/dist/src/modules/validators/core.js

@@ -1,12 +1,11 @@
 import { bytesToHex, concat, encodeAbiParameters, encodePacked, hexToBytes, maxUint48, pad, toHex, } from 'viem';
-import { OwnersFieldRequiredError } from '../../accounts/error.js';
+import { AccountConfigurationNotSupportedError, OwnersFieldRequiredError, } from '../../accounts/error.js';
 import { MODULE_TYPE_ID_VALIDATOR } from '../common.js';
 const SMART_SESSION_EMISSARY_ADDRESS_DEV = '0x60731de80d78548875f8a67c4fec2a8660194e0c';
 const SMART_SESSION_EMISSARY_ADDRESS = '0xad568b3f825a8d5ffc06dd3253526b64d810ae89';
 const OWNABLE_VALIDATOR_ADDRESS = '0x000000000013fdb5234e4e3162a810f54d9f7e98';
-const ENS_VALIDATOR_ADDRESS = '0xdc38f07b060374b6480c4bf06231e7d10955bca4';
+const ENS_HCA_MODULE = '0x5049ecBd4d961aE6DFEED9b7ccCe7f026454970E';
 const WEBAUTHN_VALIDATOR_ADDRESS = '0x0000000000578c4cb0e472a5462da43c495c3f33';
-const SOCIAL_RECOVERY_VALIDATOR_ADDRESS = '0xa04d053b3c8021e8d5bf641816c42daa75d8b597';
 const MULTI_FACTOR_VALIDATOR_ADDRESS = '0xf6bdf42c9be18ceca5c06c42a43daf7fbbe7896b';
 // Legacy
 const OWNABLE_V0_VALIDATOR_ADDRESS = '0x2483da3a338895199e5e538530213157e931bf06';
@@ -14,21 +13,46 @@ const OWNABLE_BETA_VALIDATOR_ADDRESS = '0x0000000000e9e6e96bcaa3c113187cdb7e38ae
 const WEBAUTHN_V0_VALIDATOR_ADDRESS = '0x0000000000578c4cb0e472a5462da43c495c3f33';
 const ECDSA_MOCK_SIGNATURE = '0x81d4b4981670cb18f99f0b4a66446df1bf5b204d24cfcb659bf38ba27a4359b5711649ec2423c5e1247245eba2964679b6a1dbb85c992ae40b9b00c6935b02ff1b';
 const WEBAUTHN_MOCK_SIGNATURE = '0x0000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001b9b86eb98fda3ed4d797d9e690588dfadf17b329a76a47cec935bebf92d7ddc80000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000001700000000000000000000000000000000000000000000000000000000000000019b2e9410bb6850f9f660a03d609d5a844fb96bcdc87a15139b03ee22c70f469100d2b865a215c3bf786387064effa8fcedcb1d625b5148f8a1236d5e3ff11acf000000000000000000000000000000000000000000000000000000000000002549960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763050000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000867b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22396a4546696a75684557724d34534f572d7443684a625545484550343456636a634a2d42716f3166544d38222c226f726967696e223a22687474703a2f2f6c6f63616c686f73743a38303830222c2263726f73734f726967696e223a66616c73657d0000000000000000000000000000000000000000000000000000';
+// ENS validation is only available on HCA accounts (its validator default is
+// the HCA module). True for a direct ENS owner set or an ENS sub-validator
+// nested in a multi-factor config.
+function ownerSetUsesEns(owners) {
+    return (owners.type === 'ens' ||
+        (owners.type === 'multi-factor' &&
+            owners.validators.some((validator) => validator.type === 'ens')));
+}
 function getOwnerValidator(config) {
     if (!config.owners) {
         throw new OwnersFieldRequiredError();
     }
+    // ENS owners resolve to the HCA module, which is only valid for HCA accounts.
+    // Other account types would silently install/sign against the wrong validator.
+    if (ownerSetUsesEns(config.owners) && config.account?.type !== 'hca') {
+        throw new AccountConfigurationNotSupportedError('ENS owners are only supported on HCA accounts', config.account?.type ?? 'nexus');
+    }
+    // HCA accounts use the ENS validator baked into the implementation; a custom
+    // owners.module would never be installed yet would drive signing/nonce
+    // selection, producing signatures for a validator the account does not have.
+    if (config.account?.type === 'hca' &&
+        config.owners.type === 'ens' &&
+        config.owners.module &&
+        config.owners.module.toLowerCase() !== ENS_HCA_MODULE.toLowerCase()) {
+        throw new AccountConfigurationNotSupportedError('HCA accounts do not support a custom ENS owners.module', 'hca');
+    }
     return getValidator(config.owners);
 }
 function getMockSignature(ownerSet) {
     switch (ownerSet.type) {
-        case 'ecdsa':
-        case 'ens': {
-            // ENS validator uses same mock signature format as ECDSA for UserOps
+        case 'ecdsa': {
             const owners = ownerSet.accounts.map((account) => account.address);
             const signatures = owners.map(() => ECDSA_MOCK_SIGNATURE);
             return concat(signatures);
         }
+        case 'ens': {
+            // ENS validator uses same mock signature format as ECDSA for UserOps
+            const signatures = ownerSet.owners.map(() => ECDSA_MOCK_SIGNATURE);
+            return concat(signatures);
+        }
         case 'passkey':
             return WEBAUTHN_MOCK_SIGNATURE;
         case 'multi-factor': {
@@ -67,7 +91,7 @@ function getValidator(owners) {
         case 'ecdsa':
             return getOwnableValidator(owners.threshold ?? 1, owners.accounts.map((account) => account.address), owners.module);
         case 'ens':
-            return getENSValidator(owners.threshold ?? 1, owners.accounts.map((account) => account.address), owners.ownerExpirations, owners.module);
+            return getENSValidator(owners.threshold ?? 1, owners.owners.map((o) => o.account.address), owners.owners.map((o) => o.expiration), owners.module);
         case 'passkey':
             return getWebAuthnValidator(owners.threshold ?? 1, owners.accounts.map((account) => ({
                 pubKey: account.publicKey,
@@ -93,13 +117,20 @@ function getOwnableValidator(threshold, owners, address) {
         type: MODULE_TYPE_ID_VALIDATOR,
     };
 }
-function getENSValidator(threshold, owners, ownerExpirations, address) {
+function getENSValidator(threshold, owners, expirations, address) {
     // format: (uint256 threshold, Owner[] owners)
     // where Owner is a tuple of (address addr, uint48 expiration)
-    const ownerPairs = owners.map((owner, index) => ({
-        addr: owner.toLowerCase(),
-        expiration: ownerExpirations[index] ?? maxUint48,
-    }));
+    const ownerPairs = owners.map((owner, index) => {
+        const expiration = expirations[index];
+        return {
+            addr: owner.toLowerCase(),
+            // maxUint48 is the on-chain "never expires" sentinel; it's outside the
+            // representable Date range, so an omitted expiry maps to it directly.
+            expiration: expiration !== undefined
+                ? Math.floor(expiration.getTime() / 1000)
+                : Number(maxUint48),
+        };
+    });
     // Sort by address to match ENS validator's expectations
     const sortedPairs = ownerPairs.sort((a, b) => a.addr.localeCompare(b.addr));
     const ownersWithExpiration = sortedPairs;
@@ -114,7 +145,7 @@ function getENSValidator(threshold, owners, ownerExpirations, address) {
             ],
         },
     ], [BigInt(threshold), ownersWithExpiration]);
-    const moduleAddress = address ?? ENS_VALIDATOR_ADDRESS;
+    const moduleAddress = address ?? ENS_HCA_MODULE;
     return {
         address: moduleAddress,
         initData,
@@ -221,26 +252,6 @@ function getMultiFactorValidator(threshold, validators) {
         type: MODULE_TYPE_ID_VALIDATOR,
     };
 }
-function getSocialRecoveryValidator(guardians, threshold = 1) {
-    const guardianAddresses = guardians.map((guardian) => guardian.address);
-    guardianAddresses.sort();
-    return {
-        type: MODULE_TYPE_ID_VALIDATOR,
-        address: SOCIAL_RECOVERY_VALIDATOR_ADDRESS,
-        initData: encodeAbiParameters([
-            {
-                type: 'uint256',
-                name: 'threshold',
-            },
-            {
-                type: 'address[]',
-                name: 'guardians',
-            },
-        ], [BigInt(threshold), guardianAddresses]),
-        deInitData: '0x',
-        additionalContext: '0x',
-    };
-}
 function parsePublicKey(publicKey) {
     const bytes = typeof publicKey === 'string' ? hexToBytes(publicKey) : publicKey;
     const offset = bytes.length === 65 ? 1 : 0;
@@ -263,4 +274,4 @@ function supportsEip712(validator) {
             return true;
     }
 }
-export { OWNABLE_VALIDATOR_ADDRESS, ENS_VALIDATOR_ADDRESS, WEBAUTHN_VALIDATOR_ADDRESS, MULTI_FACTOR_VALIDATOR_ADDRESS, WEBAUTHN_V0_VALIDATOR_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, getOwnerValidator, getOwnableValidator, getENSValidator, getWebAuthnValidator, getMultiFactorValidator, getSocialRecoveryValidator, getValidator, getMockSignature, supportsEip712, };
+export { OWNABLE_VALIDATOR_ADDRESS, ENS_HCA_MODULE, WEBAUTHN_VALIDATOR_ADDRESS, MULTI_FACTOR_VALIDATOR_ADDRESS, WEBAUTHN_V0_VALIDATOR_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS, SMART_SESSION_EMISSARY_ADDRESS_DEV, getOwnerValidator, getOwnableValidator, getENSValidator, getWebAuthnValidator, getMultiFactorValidator, getValidator, getMockSignature, supportsEip712, ownerSetUsesEns, };

package/dist/src/modules/validators/cross-chain-permits.d.ts

@@ -0,0 +1,11 @@
+import type { CrossChainPermissionInput, CrossChainPermit } from '../../types.js';
+/**
+ * Resolve a {@link CrossChainPermissionInput} into a {@link CrossChainPermit}:
+ * normalise single/array legs, resolve `TokenSymbol`s to per-chain ERC-20
+ * addresses, and convert `Date` validity bounds to unix-seconds.
+ *
+ * @internal Used by `expandCrossChainPermit`; not part of the public API.
+ */
+declare function resolveCrossChainPermission(input: CrossChainPermissionInput): CrossChainPermit;
+export { resolveCrossChainPermission };
+//# sourceMappingURL=cross-chain-permits.d.ts.map

package/dist/src/modules/validators/cross-chain-permits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-chain-permits.d.ts","sourceRoot":"","sources":["../../../../modules/validators/cross-chain-permits.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,yBAAyB,EACzB,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAyBpB;;;;;;GAMG;AACH,iBAAS,2BAA2B,CAClC,KAAK,EAAE,yBAAyB,GAC/B,gBAAgB,CA0DlB;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAA"}

package/dist/src/modules/validators/cross-chain-permits.js

@@ -0,0 +1,76 @@
+import { isAddress } from 'viem';
+import { getTokenAddress } from '../../orchestrator/registry.js';
+function dateToUnixSeconds(input) {
+    // Date.getTime() returns milliseconds since epoch; the on-chain policy
+    // expects unix-seconds. Integer division matches the Permit2 deadline
+    // convention.
+    return BigInt(Math.floor(input.getTime() / 1000));
+}
+function resolveTokenForChain(token, chainId) {
+    return isAddress(token) ? token : getTokenAddress(token, chainId);
+}
+// Normalise the single-object / array / omitted shapes into arrays. An
+// omitted side stays `undefined` (no restriction), mirroring how the
+// underlying Permit2 policy treats an absent token list.
+function normalizeLegs(legs) {
+    if (legs === undefined)
+        return undefined;
+    const arr = Array.isArray(legs) ? legs : [legs];
+    return arr.length ? arr : undefined;
+}
+/**
+ * Resolve a {@link CrossChainPermissionInput} into a {@link CrossChainPermit}:
+ * normalise single/array legs, resolve `TokenSymbol`s to per-chain ERC-20
+ * addresses, and convert `Date` validity bounds to unix-seconds.
+ *
+ * @internal Used by `expandCrossChainPermit`; not part of the public API.
+ */
+function resolveCrossChainPermission(input) {
+    const fromLegs = normalizeLegs(input.from);
+    const toLegs = normalizeLegs(input.to);
+    const from = fromLegs?.map((leg) => ({
+        chain: leg.chain,
+        token: resolveTokenForChain(leg.token, leg.chain.id),
+        maxAmount: leg.maxAmount,
+    }));
+    const to = toLegs?.map((leg) => ({
+        chain: leg.chain,
+        token: resolveTokenForChain(leg.token, leg.chain.id),
+        recipient: leg.recipient,
+    }));
+    const validUntil = input.validUntil !== undefined
+        ? dateToUnixSeconds(input.validUntil)
+        : undefined;
+    const validAfter = input.validAfter !== undefined
+        ? dateToUnixSeconds(input.validAfter)
+        : undefined;
+    // Detect an obviously-broken time window early. The on-chain policy
+    // would reject any intent in this state anyway; surfacing it at build
+    // time saves a round-trip to chain.
+    if (validUntil !== undefined &&
+        validAfter !== undefined &&
+        validAfter > validUntil) {
+        throw new Error(`crossChainPermits: validAfter (${validAfter}) is greater than validUntil (${validUntil})`);
+    }
+    const fillDeadline = input.fillDeadline?.map(({ chain, min, max }) => ({
+        chain,
+        min: min !== undefined ? dateToUnixSeconds(min) : undefined,
+        max: max !== undefined ? dateToUnixSeconds(max) : undefined,
+    }));
+    return {
+        from,
+        to,
+        validUntil,
+        validAfter,
+        fillDeadline,
+        // Inverted default: callers must opt out of bridge-to-self
+        // explicitly. This stops a session key from quietly bridging to an
+        // attacker-controlled recipient.
+        recipientIsAccount: !input.allowRecipientNotAccount,
+        // Passed through verbatim. `getArbitersForSettlementLayers` expands
+        // undefined/empty to "all supported layers" at session-data build
+        // time.
+        settlementLayers: input.settlementLayers,
+    };
+}
+export { resolveCrossChainPermission };

package/dist/src/modules/validators/permissions.d.ts

@@ -1,4 +1,5 @@
 import type { Permission, ScopedAction } from '../../types.js';
+export declare const FAR_FUTURE_MS = 4102444800000;
 declare function resolvePermission(permission: Permission): ScopedAction[];
 declare function resolvePermissions(permissions: readonly Permission[]): ScopedAction[];
 export { resolvePermissions, resolvePermission };

package/dist/src/modules/validators/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EAEb,MAAM,aAAa,CAAA;AA0CpB,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA+FjE;AAED,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAEhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,UAAU,EAEV,YAAY,EAEb,MAAM,aAAa,CAAA;AAiHpB,eAAO,MAAM,aAAa,gBAAoB,CAAA;AAE9C,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA0NjE;AAED,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAEhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}