@rhinestone/sdk 2.0.0-beta.43 → 2.0.0-beta.45

package/dist/src/modules/validators/ownable.js

@@ -0,0 +1,84 @@
+import { concat, encodeAbiParameters, hexToBytes, toHex, } from 'viem';
+export const OWNABLE_VALIDATOR_ADDRESS = '0x000000000013fdb5234e4e3162a810f54d9f7e98';
+export const OWNABLE_V0_VALIDATOR_ADDRESS = '0x2483da3a338895199e5e538530213157e931bf06';
+export const OWNABLE_BETA_VALIDATOR_ADDRESS = '0x0000000000e9e6e96bcaa3c113187cdb7e38aed9';
+export const ECDSA_MOCK_SIGNATURE = '0x81d4b4981670cb18f99f0b4a66446df1bf5b204d24cfcb659bf38ba27a4359b5711649ec2423c5e1247245eba2964679b6a1dbb85c992ae40b9b00c6935b02ff1b';
+function moduleAddress(definition) {
+    return definition.module.source === 'explicit'
+        ? definition.module.address
+        : OWNABLE_VALIDATOR_ADDRESS;
+}
+export function resolveOwnableAddresses(input) {
+    return {
+        kind: 'validator',
+        address: input.address ?? OWNABLE_VALIDATOR_ADDRESS,
+        initData: encodeAbiParameters([
+            { name: 'threshold', type: 'uint256' },
+            { name: 'owners', type: 'address[]' },
+        ], [
+            BigInt(input.threshold),
+            input.owners
+                .map((owner) => owner.toLowerCase())
+                .sort(),
+        ]),
+        deInitData: '0x',
+        additionalContext: '0x',
+    };
+}
+export function resolveOwnableValidator(definition) {
+    const owners = definition.owners
+        .map((owner) => {
+        if (owner.kind === 'webauthn') {
+            throw new Error('Ownable validator contains a WebAuthn owner');
+        }
+        return owner.account.address.toLowerCase();
+    })
+        .sort();
+    return resolveOwnableAddresses({
+        owners,
+        threshold: definition.threshold,
+        address: moduleAddress(definition),
+    });
+}
+export function encodeOwnableMockSignature(ownerCount) {
+    return concat(Array.from({ length: ownerCount }, () => ECDSA_MOCK_SIGNATURE));
+}
+export function encodeEcdsaValidatorContribution(input) {
+    if (input.threshold < 1 || input.threshold > input.ownerOrder.length) {
+        throw new Error('Validator threshold is outside the configured owner set');
+    }
+    const configured = new Set(input.ownerOrder);
+    const contributions = new Map();
+    for (const contribution of input.contributions) {
+        if (!configured.has(contribution.ownerId)) {
+            throw new Error(`Unknown validator owner ${contribution.ownerId}`);
+        }
+        if (contributions.has(contribution.ownerId)) {
+            throw new Error(`Duplicate validator owner ${contribution.ownerId}`);
+        }
+        contributions.set(contribution.ownerId, contribution.encoding === 'validator-contribution'
+            ? contribution.signature
+            : encodeEcdsaRecoveryValue(contribution.signature, input.recoveryEncoding));
+    }
+    const ordered = input.ownerOrder.flatMap((ownerId) => {
+        const contribution = contributions.get(ownerId);
+        return contribution ? [contribution] : [];
+    });
+    if (ordered.length < input.threshold) {
+        throw new Error(`Insufficient validator contributions: required ${input.threshold}, received ${ordered.length}`);
+    }
+    return concat(ordered);
+}
+export function encodeEcdsaRecoveryValue(signature, encoding) {
+    const bytes = hexToBytes(signature);
+    if (bytes.length !== 65) {
+        throw new Error('ECDSA signatures must contain 65 bytes');
+    }
+    const recovery = bytes[64];
+    const ethereumRecovery = recovery < 27 ? recovery + 27 : recovery;
+    const encodedRecovery = encoding === 'validator-offset-4' ? ethereumRecovery + 4 : ethereumRecovery;
+    if (encodedRecovery > 255) {
+        throw new Error('ECDSA recovery value does not fit in one byte');
+    }
+    return concat([signature.slice(0, -2), toHex(encodedRecovery)]);
+}

package/dist/src/modules/validators/permissions.d.ts

@@ -1,4 +1,4 @@
-import type { Permission, ScopedAction } from '../../types.js';
+import type { Permission, ScopedAction } from './smart-sessions/types.js';
 export declare const FAR_FUTURE_MS = 4102444800000;
 declare function resolvePermission(permission: Permission): ScopedAction[];
 declare function resolvePermissions(permissions: readonly Permission[]): ScopedAction[];

package/dist/src/modules/validators/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,UAAU,EAEV,YAAY,EAEb,MAAM,aAAa,CAAA;AAiHpB,eAAO,MAAM,aAAa,gBAAoB,CAAA;AAE9C,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA0NjE;AAkBD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAwBhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,UAAU,EACV,YAAY,EAGb,MAAM,wBAAwB,CAAA;AAiH/B,eAAO,MAAM,aAAa,gBAAoB,CAAA;AAE9C,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA0NjE;AAkBD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAwBhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/src/modules/validators/policies/claim/arbiters.d.ts

@@ -1,18 +1,15 @@
 import type { Address } from 'viem';
-import type { CrossChainSettlementLayer } from '../../../../types.js';
+import type { CrossChainSettlementLayer } from '../../smart-sessions/types.js';
 /**
- * Collects every distinct arbiter address that any chain in the registry
- * has deployed for the given settlement layers. The resulting whitelist
- * is what the Permit2 claim policy enforces on-chain — a session signed
- * once with this whitelist is valid against any of those arbiters.
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
  *
- * **"Any" means any of the *supported* settlement layers**, not any
- * address on earth. When `layers` is empty or undefined, this resolver
- * expands to the union of every layer in
- * {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter check
- * stays meaningful (the worst case is still a Rhinestone-blessed
- * arbiter). To get a truly unrestricted whitelist a caller would have
- * to bypass this helper entirely.
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
  *
  * @param layers   Settlement layers the session is permitted to use.
  *                 Empty/undefined ⇒ all supported layers.

package/dist/src/modules/validators/policies/claim/arbiters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAiBlE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA8BvB"}
+{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAoD3E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA6BvB"}

package/dist/src/modules/validators/policies/claim/arbiters.js

@@ -1,9 +1,7 @@
-import { contractAddresses, contractAddressesDev, } from '@rhinestone/shared-configs';
 /**
- * The contract registry keys (per `shared-configs/contracts.{,dev}.js`)
- * that each settlement layer expands to. `ACROSS` whitelists both arbiter
- * impls so a session is permissioned for the 7579 and multicall paths
- * regardless of which one the orchestrator picks at intent time.
+ * The arbiter contract keys that each settlement layer expands to. `ACROSS`
+ * whitelists both arbiter impls so a session is permissioned for the 7579 and
+ * multicall paths regardless of which one the orchestrator picks at intent time.
  */
 const SETTLEMENT_LAYER_CONTRACT_KEYS = {
     SAME_CHAIN: ['samechainArbiter'],
@@ -11,18 +9,47 @@ const SETTLEMENT_LAYER_CONTRACT_KEYS = {
     ACROSS: ['across7579Arbiter', 'acrossMulticallArbiter'],
 };
 /**
- * Collects every distinct arbiter address that any chain in the registry
- * has deployed for the given settlement layers. The resulting whitelist
- * is what the Permit2 claim policy enforces on-chain — a session signed
- * once with this whitelist is valid against any of those arbiters.
+ * Bundled arbiter allow-set — the deployed arbiter addresses per key, per
+ * environment (the union across chains).
  *
- * **"Any" means any of the *supported* settlement layers**, not any
- * address on earth. When `layers` is empty or undefined, this resolver
- * expands to the union of every layer in
- * {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter check
- * stays meaningful (the worst case is still a Rhinestone-blessed
- * arbiter). To get a truly unrestricted whitelist a caller would have
- * to bypass this helper entirely.
+ * v2: this is a small, signed-path **constant** bundled in the SDK rather than
+ * read from `@rhinestone/shared-configs`. The arbiter is baked into the user's
+ * Permit2 session signature, so it must stay **client-trusted** — never sourced
+ * from the orchestrator you transact against. Rhinestone's arbiters are CREATE2
+ * and near-uniform across chains, so this is a handful of addresses per key
+ * (e.g. `ecoArbiter` has a mainnet and a testnet address). A new *chain* reuses
+ * these; only a contract redeploy or a new settlement layer changes them.
+ */
+const ARBITER_ADDRESSES = {
+    prod: {
+        samechainArbiter: ['0x000000000006e2569CaF8Ff021810790e0A0D740'],
+        ecoArbiter: [
+            '0x2e7627CCfAe4eDb336eEb5a70f08415B0F1a2b8C',
+            '0xA212A6ACCC8db0e4cdf4394D0A851c70Fc27A8F0',
+        ],
+        across7579Arbiter: ['0x28a4D41776968c1201A807ec51fFB405362B8882'],
+        acrossMulticallArbiter: ['0xA162fabb9a0EeF2736485A587aAAB3d015e14224'],
+    },
+    dev: {
+        samechainArbiter: ['0x8fA7720Eee299223f25De8DC03C68A28541dCD10'],
+        ecoArbiter: [
+            '0x1BeBAfb3D05d84A5Bfd94800c88d1342f755d8AB',
+            '0x8A061029AE4c5Cf69b5368119B3b0C80B31F55fE',
+        ],
+        across7579Arbiter: ['0x1b19973F7a29E950ad4FaF8872745B6378005517'],
+        acrossMulticallArbiter: ['0x8343FBBA0526deC1c952A098057021027648bcf9'],
+    },
+};
+/**
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
+ *
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
  *
  * @param layers   Settlement layers the session is permitted to use.
  *                 Empty/undefined ⇒ all supported layers.
@@ -32,20 +59,18 @@ export function getArbitersForSettlementLayers(layers, useDevContracts) {
     const effectiveLayers = !layers || layers.length === 0
         ? Object.keys(SETTLEMENT_LAYER_CONTRACT_KEYS)
         : layers;
-    const registry = useDevContracts ? contractAddressesDev : contractAddresses;
+    const book = ARBITER_ADDRESSES[useDevContracts ? 'dev' : 'prod'];
     const keys = effectiveLayers.flatMap((l) => SETTLEMENT_LAYER_CONTRACT_KEYS[l]);
     const seen = new Set();
     const addresses = [];
-    // shared-configs is shaped Record<chainId, Record<contractKey, Address>>.
-    // The same logical arbiter often shares an address across chains, but a
-    // given key may also have multiple addresses live in the wild (e.g.
-    // post-redeploy). We collect every unique address we see for the keys
-    // the caller asked for, deduplicated case-insensitively.
-    for (const chainContracts of Object.values(registry)) {
-        for (const key of keys) {
-            const addr = chainContracts[key];
-            if (!addr)
-                continue;
+    // The same logical arbiter often shares an address across chains, but a given
+    // key may have multiple addresses live (e.g. a mainnet + testnet deployment).
+    // Collect every unique address for the requested keys, deduped
+    // case-insensitively.
+    for (const key of keys) {
+        // `keys` are `SETTLEMENT_LAYER_CONTRACT_KEYS` values, so `book` always has
+        // an entry for each — no missing-key fallback needed.
+        for (const addr of book[key]) {
             const norm = addr.toLowerCase();
             if (seen.has(norm))
                 continue;

package/dist/src/modules/validators/resolve.d.ts

@@ -0,0 +1,5 @@
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition, ResolvedValidatorDefinition } from './types.js';
+export declare function resolveAtomicValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+export declare function resolveValidator(definition: ResolvedValidatorDefinition): ResolvedModule;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/src/modules/validators/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../modules/validators/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,SAAS,CAAA;AAGhB,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAYhB;AAED,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,2BAA2B,GACtC,cAAc,CAIhB"}

package/dist/src/modules/validators/resolve.js

@@ -0,0 +1,22 @@
+import { resolveEnsValidator } from './ens.js';
+import { resolveMultiFactorValidator } from './multi-factor.js';
+import { resolveOwnableValidator } from './ownable.js';
+import { resolveWebauthnValidator } from './webauthn.js';
+export function resolveAtomicValidator(definition) {
+    switch (definition.kind) {
+        case 'ecdsa':
+            return resolveOwnableValidator(definition);
+        case 'ens':
+            return resolveEnsValidator(definition);
+        case 'passkey':
+            return resolveWebauthnValidator(definition);
+        case 'k1':
+        case 'smart-session':
+            throw new Error(`Validator ${definition.kind} requires feature input`);
+    }
+}
+export function resolveValidator(definition) {
+    return definition.kind === 'multi-factor'
+        ? resolveMultiFactorValidator(definition, resolveAtomicValidator)
+        : resolveAtomicValidator(definition);
+}

package/dist/src/modules/validators/signer-id.d.ts

@@ -0,0 +1,5 @@
+import type { Account, Address, Hex } from 'viem';
+import type { WebAuthnAccount } from 'viem/account-abstraction';
+export declare function ecdsaSignerId(account: Account | Address): string;
+export declare function webauthnSignerId(account: WebAuthnAccount | Hex): string;
+//# sourceMappingURL=signer-id.d.ts.map

package/dist/src/modules/validators/signer-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-id.d.ts","sourceRoot":"","sources":["../../../../modules/validators/signer-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAGhE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,GAAG,GAAG,MAAM,CAGvE"}

package/dist/src/modules/validators/signer-id.js

@@ -0,0 +1,8 @@
+export function ecdsaSignerId(account) {
+    const address = typeof account === 'string' ? account : account.address;
+    return `ecdsa:${address.toLowerCase()}`;
+}
+export function webauthnSignerId(account) {
+    const publicKey = typeof account === 'string' ? account : account.publicKey;
+    return `webauthn:${publicKey.toLowerCase()}`;
+}

package/dist/src/modules/validators/smart-session-signature-types.d.ts

@@ -0,0 +1,35 @@
+import type { Address, Hex } from 'viem';
+interface SmartSessionPolicyData {
+    readonly policy: Address;
+    readonly initData: Hex;
+}
+interface SmartSessionActionData {
+    readonly actionTargetSelector: Hex;
+    readonly actionTarget: Address;
+    readonly actionPolicies: readonly SmartSessionPolicyData[];
+}
+interface SmartSessionErc7739PolicyData {
+    readonly allowedERC7739Content: readonly {
+        readonly appDomainSeparator: Hex;
+        readonly contentNames: readonly string[];
+    }[];
+    readonly erc1271Policies: readonly SmartSessionPolicyData[];
+}
+export interface SmartSessionEnableContributionData {
+    readonly userSignature: Hex;
+    readonly hashesAndChainIds: readonly {
+        readonly chainId: bigint;
+        readonly sessionDigest: Hex;
+    }[];
+    readonly sessionToEnableIndex: number;
+    readonly session: {
+        readonly sessionValidator: Address;
+        readonly sessionValidatorInitData: Hex;
+        readonly salt: Hex;
+        readonly erc7739Policies: SmartSessionErc7739PolicyData;
+        readonly actions: readonly SmartSessionActionData[];
+        readonly claimPolicies: readonly SmartSessionPolicyData[];
+    };
+}
+export {};
+//# sourceMappingURL=smart-session-signature-types.d.ts.map

package/dist/src/modules/validators/smart-session-signature-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-session-signature-types.d.ts","sourceRoot":"","sources":["../../../../modules/validators/smart-session-signature-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAExC,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAA;CACvB;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAA;IAClC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC3D;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QACvC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAA;QAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KACzC,EAAE,CAAA;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC5D;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS;QACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;KAC5B,EAAE,CAAA;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;QAClC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAA;QACtC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;QAClB,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAA;QACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAA;QACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;KAC1D,CAAA;CACF"}

package/dist/src/modules/validators/smart-session-signature-types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/modules/validators/smart-sessions/authorization.d.ts

@@ -0,0 +1,99 @@
+import { type Address } from 'viem';
+import type { Session, SessionDetails } from './types.js';
+export declare const SESSION_LOCK_TAG: "0x000000000000000000000000";
+export declare const types: {
+    readonly PolicyData: readonly [{
+        readonly name: "policy";
+        readonly type: "address";
+    }, {
+        readonly name: "initData";
+        readonly type: "bytes";
+    }];
+    readonly ActionData: readonly [{
+        readonly name: "actionTargetSelector";
+        readonly type: "bytes4";
+    }, {
+        readonly name: "actionTarget";
+        readonly type: "address";
+    }, {
+        readonly name: "actionPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly ERC7739Context: readonly [{
+        readonly name: "appDomainSeparator";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "contentName";
+        readonly type: "string[]";
+    }];
+    readonly ERC7739Data: readonly [{
+        readonly name: "allowedERC7739Content";
+        readonly type: "ERC7739Context[]";
+    }, {
+        readonly name: "erc1271Policies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly LockTagData: readonly [{
+        readonly name: "lockTag";
+        readonly type: "bytes12";
+    }, {
+        readonly name: "claimPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly SignedPermissions: readonly [{
+        readonly name: "actions";
+        readonly type: "ActionData[]";
+    }, {
+        readonly name: "erc7739Policies";
+        readonly type: "ERC7739Data";
+    }, {
+        readonly name: "lockTagPolicies";
+        readonly type: "LockTagData";
+    }, {
+        readonly name: "permitGenericPolicy";
+        readonly type: "bool";
+    }];
+    readonly SignedSession: readonly [{
+        readonly name: "account";
+        readonly type: "address";
+    }, {
+        readonly name: "expires";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "permissions";
+        readonly type: "SignedPermissions";
+    }, {
+        readonly name: "salt";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "sessionValidator";
+        readonly type: "address";
+    }, {
+        readonly name: "sessionValidatorInitData";
+        readonly type: "bytes";
+    }, {
+        readonly name: "smartSessionEmissary";
+        readonly type: "address";
+    }];
+    readonly ChainSession: readonly [{
+        readonly name: "chainId";
+        readonly type: "uint64";
+    }, {
+        readonly name: "session";
+        readonly type: "SignedSession";
+    }];
+    readonly MultiChainSession: readonly [{
+        readonly name: "sessionsAndChainIds";
+        readonly type: "ChainSession[]";
+    }];
+};
+export declare function getSessionDetails(input: {
+    readonly account: Address;
+    readonly sessions: readonly Session[];
+    readonly environment: 'production' | 'development';
+    readonly readNonce: (session: Session) => Promise<bigint>;
+}): Promise<SessionDetails>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/src/modules/validators/smart-sessions/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,MAAM,CAAA;AAOb,OAAO,KAAK,EAAE,OAAO,EAAe,cAAc,EAAE,MAAM,SAAS,CAAA;AAEnE,eAAO,MAAM,gBAAgB,EAAG,4BAAqC,CAAA;AAErE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CR,CAAA;AAyCV,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,cAAc,CAAC,CA8B1B"}

package/dist/src/modules/validators/smart-sessions/authorization.js

@@ -0,0 +1,101 @@
+import { hashStruct, maxUint256, } from 'viem';
+import { getSessionData } from './digest.js';
+import { getSmartSessionEmissaryAddress } from './module.js';
+import { SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, } from './resolve.js';
+export const SESSION_LOCK_TAG = '0x000000000000000000000000';
+export const types = {
+    PolicyData: [
+        { name: 'policy', type: 'address' },
+        { name: 'initData', type: 'bytes' },
+    ],
+    ActionData: [
+        { name: 'actionTargetSelector', type: 'bytes4' },
+        { name: 'actionTarget', type: 'address' },
+        { name: 'actionPolicies', type: 'PolicyData[]' },
+    ],
+    ERC7739Context: [
+        { name: 'appDomainSeparator', type: 'bytes32' },
+        { name: 'contentName', type: 'string[]' },
+    ],
+    ERC7739Data: [
+        { name: 'allowedERC7739Content', type: 'ERC7739Context[]' },
+        { name: 'erc1271Policies', type: 'PolicyData[]' },
+    ],
+    LockTagData: [
+        { name: 'lockTag', type: 'bytes12' },
+        { name: 'claimPolicies', type: 'PolicyData[]' },
+    ],
+    SignedPermissions: [
+        { name: 'actions', type: 'ActionData[]' },
+        { name: 'erc7739Policies', type: 'ERC7739Data' },
+        { name: 'lockTagPolicies', type: 'LockTagData' },
+        { name: 'permitGenericPolicy', type: 'bool' },
+    ],
+    SignedSession: [
+        { name: 'account', type: 'address' },
+        { name: 'expires', type: 'uint256' },
+        { name: 'nonce', type: 'uint256' },
+        { name: 'permissions', type: 'SignedPermissions' },
+        { name: 'salt', type: 'bytes32' },
+        { name: 'sessionValidator', type: 'address' },
+        { name: 'sessionValidatorInitData', type: 'bytes' },
+        { name: 'smartSessionEmissary', type: 'address' },
+    ],
+    ChainSession: [
+        { name: 'chainId', type: 'uint64' },
+        { name: 'session', type: 'SignedSession' },
+    ],
+    MultiChainSession: [{ name: 'sessionsAndChainIds', type: 'ChainSession[]' }],
+};
+function signedSession(account, data, nonce, environment) {
+    return {
+        account,
+        permissions: {
+            permitGenericPolicy: data.actions.some((action) => action.actionTarget === SMART_SESSIONS_FALLBACK_TARGET_FLAG &&
+                action.actionTargetSelector ===
+                    SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG),
+            lockTagPolicies: {
+                lockTag: SESSION_LOCK_TAG,
+                claimPolicies: data.claimPolicies,
+            },
+            erc7739Policies: {
+                allowedERC7739Content: data.erc7739Policies.allowedERC7739Content.map((content) => ({
+                    contentName: content.contentNames,
+                    appDomainSeparator: content.appDomainSeparator,
+                })),
+                erc1271Policies: data.erc7739Policies.erc1271Policies,
+            },
+            actions: data.actions,
+        },
+        sessionValidator: data.sessionValidator,
+        sessionValidatorInitData: data.sessionValidatorInitData,
+        salt: data.salt,
+        smartSessionEmissary: getSmartSessionEmissaryAddress(environment),
+        expires: maxUint256,
+        nonce,
+    };
+}
+export async function getSessionDetails(input) {
+    const nonces = await Promise.all(input.sessions.map(input.readNonce));
+    const signed = input.sessions.map((session, index) => signedSession(input.account, getSessionData(session), nonces[index], input.environment));
+    const hashesAndChainIds = signed.map((session, index) => ({
+        chainId: BigInt(input.sessions[index].chain.id),
+        sessionDigest: hashStruct({
+            types,
+            primaryType: 'SignedSession',
+            data: session,
+        }),
+    }));
+    const data = {
+        domain: { name: 'SmartSessionEmissary', version: '1' },
+        types,
+        primaryType: 'MultiChainSession',
+        message: {
+            sessionsAndChainIds: signed.map((session, index) => ({
+                chainId: BigInt(input.sessions[index].chain.id),
+                session,
+            })),
+        },
+    };
+    return { nonces, hashesAndChainIds, data };
+}

package/dist/src/modules/validators/smart-sessions/calls.d.ts

@@ -0,0 +1,19 @@
+import { type Address, type Hex } from 'viem';
+import type { Call } from '../../../calls/types.js';
+import type { ChainDigest, Session } from './types.js';
+export declare function encodeEnableSessionCall(input: {
+    readonly account: Address;
+    readonly session: Session;
+    readonly userSignature: Hex;
+    readonly hashesAndChainIds: readonly ChainDigest[];
+    readonly sessionToEnableIndex: number;
+    readonly environment: 'production' | 'development';
+}): Call;
+export declare function encodeDisableSessionCall(input: {
+    readonly account: Address;
+    readonly session: Session;
+    readonly expires: bigint;
+    readonly nonce: bigint;
+    readonly environment: 'production' | 'development';
+}): Call;
+//# sourceMappingURL=calls.d.ts.map

package/dist/src/modules/validators/smart-sessions/calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/calls.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,GAAG,EAKT,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAKhD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAgBnD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,WAAW,EAAE,CAAA;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;CACnD,GAAG,IAAI,CAwBP;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;CACnD,GAAG,IAAI,CAgDP"}

package/dist/src/modules/validators/smart-sessions/calls.js

@@ -0,0 +1,85 @@
+import { encodeAbiParameters, encodeFunctionData, keccak256, maxUint256, zeroAddress, zeroHash, } from 'viem';
+import smartSessionEmissaryAbi from '../../abi/smart-session-emissary.js';
+import { SESSION_LOCK_TAG } from './authorization.js';
+import { getPermissionId, getSessionData } from './digest.js';
+import { getSmartSessionEmissaryAddress } from './module.js';
+const SCOPE_MULTICHAIN = 0;
+const RESET_PERIOD_ONE_WEEK = 6;
+const SIGNED_PERMISSION_DISABLE_TYPEHASH = '0x098b3120e60a8adc9d970dec9c1f8796974a3ab6154f995ad56ee7b9a38d8836';
+function config(permissionId) {
+    return {
+        scope: SCOPE_MULTICHAIN,
+        resetPeriod: RESET_PERIOD_ONE_WEEK,
+        allocator: zeroAddress,
+        permissionId,
+    };
+}
+export function encodeEnableSessionCall(input) {
+    const permissionId = getPermissionId(input.session);
+    return {
+        target: getSmartSessionEmissaryAddress(input.environment),
+        value: 0n,
+        data: encodeFunctionData({
+            abi: smartSessionEmissaryAbi,
+            functionName: 'setConfig',
+            args: [
+                input.account,
+                config(permissionId),
+                {
+                    allocatorSig: zeroHash,
+                    userSig: input.userSignature,
+                    expires: maxUint256,
+                    session: {
+                        chainDigestIndex: input.sessionToEnableIndex,
+                        hashesAndChainIds: [...input.hashesAndChainIds],
+                        sessionToEnable: getSessionData(input.session),
+                    },
+                },
+            ],
+        }),
+    };
+}
+export function encodeDisableSessionCall(input) {
+    const permissionId = getPermissionId(input.session);
+    const disableDigest = keccak256(encodeAbiParameters([
+        { type: 'bytes32' },
+        { type: 'address' },
+        { type: 'bytes32' },
+        { type: 'bytes12' },
+        { type: 'uint256' },
+        { type: 'uint256' },
+    ], [
+        SIGNED_PERMISSION_DISABLE_TYPEHASH,
+        input.account,
+        permissionId,
+        SESSION_LOCK_TAG,
+        input.expires,
+        input.nonce,
+    ]));
+    return {
+        target: getSmartSessionEmissaryAddress(input.environment),
+        value: 0n,
+        data: encodeFunctionData({
+            abi: smartSessionEmissaryAbi,
+            functionName: 'removeConfig',
+            args: [
+                input.account,
+                config(permissionId),
+                {
+                    allocatorSig: '0x',
+                    userSig: '0x',
+                    expires: input.expires,
+                    session: {
+                        chainDigestIndex: 0,
+                        hashesAndChainIds: [
+                            {
+                                chainId: BigInt(input.session.chain.id),
+                                sessionDigest: disableDigest,
+                            },
+                        ],
+                    },
+                },
+            ],
+        }),
+    };
+}