@rhinestone/sdk 2.0.0-beta.8 → 2.0.0

package/dist/src/modules/validators/definition.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedValidatorDefinition, ValidatorInput } from './types.js';
+export declare function defineValidator(input: ValidatorInput, id?: string, publicId?: number | `0x${string}`): ResolvedValidatorDefinition;
+//# sourceMappingURL=definition.d.ts.map

package/dist/src/modules/validators/definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../../../../modules/validators/definition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAIV,2BAA2B,EAC3B,cAAc,EAGf,MAAM,SAAS,CAAA;AAsEhB,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,EAAE,SAAoB,EACtB,QAAQ,GAAE,MAAM,GAAG,KAAK,MAAM,EAAM,GACnC,2BAA2B,CAe7B"}

package/dist/src/modules/validators/definition.js

@@ -0,0 +1,68 @@
+import { ecdsaSignerId, webauthnSignerId } from './signer-id.js';
+function moduleSelection(address, profile) {
+    return address === undefined
+        ? { source: 'default', profile }
+        : { source: 'explicit', address };
+}
+function defineAtomicValidator(input, id, publicId) {
+    const ownerId = (index) => `${id}/owner/${index}`;
+    switch (input.type) {
+        case 'ecdsa':
+            return {
+                kind: 'ecdsa',
+                id,
+                publicId,
+                module: moduleSelection(input.module, 'ownable'),
+                owners: input.accounts.map((account, index) => ({
+                    kind: 'ecdsa',
+                    id: ownerId(index),
+                    signerId: ecdsaSignerId(account),
+                    account,
+                })),
+                threshold: input.threshold ?? 1,
+            };
+        case 'ens':
+            return {
+                kind: 'ens',
+                id,
+                publicId,
+                module: moduleSelection(undefined, 'ens'),
+                owners: input.owners.map((owner, index) => ({
+                    kind: 'ens',
+                    id: ownerId(index),
+                    signerId: ecdsaSignerId(owner.account),
+                    account: owner.account,
+                    ...(owner.expiration ? { expiration: owner.expiration } : {}),
+                })),
+                threshold: input.threshold ?? 1,
+            };
+        case 'passkey':
+            return {
+                kind: 'passkey',
+                id,
+                publicId,
+                module: moduleSelection(input.module, 'webauthn'),
+                owners: input.accounts.map((account, index) => ({
+                    kind: 'webauthn',
+                    id: ownerId(index),
+                    signerId: webauthnSignerId(account),
+                    account,
+                })),
+                threshold: input.threshold ?? 1,
+            };
+    }
+}
+export function defineValidator(input, id = 'owner-validator', publicId = 0) {
+    if (input.type !== 'multi-factor') {
+        return defineAtomicValidator(input, id, Number(publicId));
+    }
+    const definition = {
+        kind: 'multi-factor',
+        id,
+        publicId,
+        module: moduleSelection(input.module, 'multi-factor'),
+        validators: input.validators.map((validator, index) => defineAtomicValidator(validator, `${id}/factor/${index}`, index)),
+        threshold: input.threshold ?? 1,
+    };
+    return definition;
+}

package/dist/src/modules/validators/ens.d.ts

@@ -0,0 +1,5 @@
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition } from './types.js';
+export declare const ENS_HCA_MODULE: "0x5049ecBd4d961aE6DFEED9b7ccCe7f026454970E";
+export declare function resolveEnsValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+//# sourceMappingURL=ens.d.ts.map

package/dist/src/modules/validators/ens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ens.d.ts","sourceRoot":"","sources":["../../../../modules/validators/ens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAExD,eAAO,MAAM,cAAc,EACzB,4CAAqD,CAAA;AAEvD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAkChB"}

package/dist/src/modules/validators/ens.js

@@ -0,0 +1,34 @@
+import { encodeAbiParameters, maxUint48 } from 'viem';
+export const ENS_HCA_MODULE = '0x5049ecBd4d961aE6DFEED9b7ccCe7f026454970E';
+export function resolveEnsValidator(definition) {
+    const owners = definition.owners
+        .map((owner) => {
+        if (owner.kind !== 'ens') {
+            throw new Error('ENS validator contains a non-ENS owner');
+        }
+        return {
+            addr: owner.account.address.toLowerCase(),
+            expiration: owner.expiration
+                ? Math.floor(owner.expiration.getTime() / 1000)
+                : Number(maxUint48),
+        };
+    })
+        .sort((left, right) => left.addr.localeCompare(right.addr));
+    return {
+        kind: 'validator',
+        address: ENS_HCA_MODULE,
+        initData: encodeAbiParameters([
+            { name: 'threshold', type: 'uint256' },
+            {
+                name: 'owners',
+                type: 'tuple[]',
+                components: [
+                    { name: 'addr', type: 'address' },
+                    { name: 'expiration', type: 'uint48' },
+                ],
+            },
+        ], [BigInt(definition.threshold), owners]),
+        deInitData: '0x',
+        additionalContext: '0x',
+    };
+}

package/dist/src/modules/validators/k1.d.ts

@@ -0,0 +1,2 @@
+export declare const K1_DEFAULT_VALIDATOR_ADDRESS: "0x00000072f286204bb934ed49d8969e86f7dec7b1";
+//# sourceMappingURL=k1.d.ts.map

package/dist/src/modules/validators/k1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k1.d.ts","sourceRoot":"","sources":["../../../../modules/validators/k1.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,EACvC,4CAAqD,CAAA"}

package/dist/src/modules/validators/k1.js

@@ -0,0 +1 @@
+export const K1_DEFAULT_VALIDATOR_ADDRESS = '0x00000072f286204bb934ed49d8969e86f7dec7b1';

package/dist/src/modules/validators/multi-factor.d.ts

@@ -0,0 +1,18 @@
+import { type Address, type Hex } from 'viem';
+import type { ResolvedModule } from '../types.js';
+import type { MultiFactorValidatorDefinition } from './types.js';
+export declare const MULTI_FACTOR_VALIDATOR_ADDRESS: Address;
+export type AtomicValidatorResolver = (definition: MultiFactorValidatorDefinition['validators'][number]) => ResolvedModule;
+export declare function encodeValidatorId(id: number | Hex): Hex;
+export declare function resolveMultiFactorValidator(definition: MultiFactorValidatorDefinition, resolveAtomic: AtomicValidatorResolver): ResolvedModule;
+export declare function encodeMultiFactorContribution(input: {
+    readonly factorOrder: readonly string[];
+    readonly threshold: number;
+    readonly contributions: readonly {
+        readonly factorId: string;
+        readonly publicId: number | Hex;
+        readonly validator: `0x${string}`;
+        readonly contribution: Hex;
+    }[];
+}): Hex;
+//# sourceMappingURL=multi-factor.d.ts.map

package/dist/src/modules/validators/multi-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-factor.d.ts","sourceRoot":"","sources":["../../../../modules/validators/multi-factor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAIZ,KAAK,GAAG,EAGT,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAA;AAE7D,eAAO,MAAM,8BAA8B,EAAE,OACC,CAAA;AAE9C,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,8BAA8B,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAC7D,cAAc,CAAA;AAEnB,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAEvD;AAED,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,8BAA8B,EAC1C,aAAa,EAAE,uBAAuB,GACrC,cAAc,CAuChB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;QAC/B,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;QACjC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAA;KAC3B,EAAE,CAAA;CACJ,GAAG,GAAG,CA6CN"}

package/dist/src/modules/validators/multi-factor.js

@@ -0,0 +1,79 @@
+import { concat, encodeAbiParameters, encodePacked, pad, toHex, } from 'viem';
+export const MULTI_FACTOR_VALIDATOR_ADDRESS = '0xf6bdf42c9be18ceca5c06c42a43daf7fbbe7896b';
+export function encodeValidatorId(id) {
+    return pad(typeof id === 'number' ? toHex(id) : id, { size: 12 });
+}
+export function resolveMultiFactorValidator(definition, resolveAtomic) {
+    const validators = definition.validators.map((validator) => {
+        const module = resolveAtomic(validator);
+        return {
+            packedValidatorAndId: concat([
+                encodeValidatorId(validator.publicId),
+                module.address,
+            ]),
+            data: module.initData,
+        };
+    });
+    return {
+        kind: 'validator',
+        address: definition.module.source === 'explicit'
+            ? definition.module.address
+            : MULTI_FACTOR_VALIDATOR_ADDRESS,
+        initData: encodePacked(['uint8', 'bytes'], [
+            definition.threshold,
+            encodeAbiParameters([
+                {
+                    name: 'validators',
+                    type: 'tuple[]',
+                    components: [
+                        { name: 'packedValidatorAndId', type: 'bytes32' },
+                        { name: 'data', type: 'bytes' },
+                    ],
+                },
+            ], [validators]),
+        ]),
+        deInitData: '0x',
+        additionalContext: '0x',
+    };
+}
+export function encodeMultiFactorContribution(input) {
+    if (input.threshold < 1 || input.threshold > input.factorOrder.length) {
+        throw new Error('Validator threshold is outside the configured factor set');
+    }
+    const configured = new Set(input.factorOrder);
+    const contributions = new Map();
+    for (const contribution of input.contributions) {
+        if (!configured.has(contribution.factorId)) {
+            throw new Error(`Unknown validator factor ${contribution.factorId}`);
+        }
+        if (contributions.has(contribution.factorId)) {
+            throw new Error(`Duplicate validator factor ${contribution.factorId}`);
+        }
+        contributions.set(contribution.factorId, contribution);
+    }
+    const ordered = input.factorOrder.flatMap((factorId) => {
+        const contribution = contributions.get(factorId);
+        return contribution ? [contribution] : [];
+    });
+    if (ordered.length < input.threshold) {
+        throw new Error(`Insufficient validator contributions: required ${input.threshold}, received ${ordered.length}`);
+    }
+    return encodeAbiParameters([
+        {
+            name: 'validators',
+            type: 'tuple[]',
+            components: [
+                { name: 'packedValidatorAndId', type: 'bytes32' },
+                { name: 'data', type: 'bytes' },
+            ],
+        },
+    ], [
+        ordered.map((contribution) => ({
+            packedValidatorAndId: concat([
+                encodeValidatorId(contribution.publicId),
+                contribution.validator,
+            ]),
+            data: contribution.contribution,
+        })),
+    ]);
+}

package/dist/src/modules/validators/ownable.d.ts

@@ -0,0 +1,26 @@
+import { type Address, type Hex } from 'viem';
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition } from './types.js';
+export declare const OWNABLE_VALIDATOR_ADDRESS: Address;
+export declare const OWNABLE_V0_VALIDATOR_ADDRESS: "0x2483da3a338895199e5e538530213157e931bf06";
+export declare const OWNABLE_BETA_VALIDATOR_ADDRESS: "0x0000000000e9e6e96bcaa3c113187cdb7e38aed9";
+export declare const ECDSA_MOCK_SIGNATURE: "0x81d4b4981670cb18f99f0b4a66446df1bf5b204d24cfcb659bf38ba27a4359b5711649ec2423c5e1247245eba2964679b6a1dbb85c992ae40b9b00c6935b02ff1b";
+export declare function resolveOwnableAddresses(input: {
+    readonly owners: readonly `0x${string}`[];
+    readonly threshold: number;
+    readonly address?: `0x${string}`;
+}): ResolvedModule;
+export declare function resolveOwnableValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+export declare function encodeOwnableMockSignature(ownerCount: number): Hex;
+export declare function encodeEcdsaValidatorContribution(input: {
+    readonly ownerOrder: readonly string[];
+    readonly threshold: number;
+    readonly recoveryEncoding: 'ethereum' | 'validator-offset-4';
+    readonly contributions: readonly {
+        readonly ownerId: string;
+        readonly signature: Hex;
+        readonly encoding: 'raw-signer' | 'validator-contribution';
+    }[];
+}): Hex;
+export declare function encodeEcdsaRecoveryValue(signature: Hex, encoding: 'ethereum' | 'validator-offset-4'): Hex;
+//# sourceMappingURL=ownable.d.ts.map

package/dist/src/modules/validators/ownable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownable.d.ts","sourceRoot":"","sources":["../../../../modules/validators/ownable.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,GAAG,EAGT,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAExD,eAAO,MAAM,yBAAyB,EAAE,OACM,CAAA;AAC9C,eAAO,MAAM,4BAA4B,EACvC,4CAAqD,CAAA;AACvD,eAAO,MAAM,8BAA8B,EACzC,4CAAqD,CAAA;AAEvD,eAAO,MAAM,oBAAoB,EAC/B,sIAA+I,CAAA;AAQjJ,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAA;CACjC,GAAG,cAAc,CAmBjB;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAchB;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAElE;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,UAAU,GAAG,oBAAoB,CAAA;IAC5D,QAAQ,CAAC,aAAa,EAAE,SAAS;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,wBAAwB,CAAA;KAC3D,EAAE,CAAA;CACJ,GAAG,GAAG,CAiCN;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,GAAG,EACd,QAAQ,EAAE,UAAU,GAAG,oBAAoB,GAC1C,GAAG,CAaL"}

package/dist/src/modules/validators/ownable.js

@@ -0,0 +1,84 @@
+import { concat, encodeAbiParameters, hexToBytes, toHex, } from 'viem';
+export const OWNABLE_VALIDATOR_ADDRESS = '0x000000000013fdb5234e4e3162a810f54d9f7e98';
+export const OWNABLE_V0_VALIDATOR_ADDRESS = '0x2483da3a338895199e5e538530213157e931bf06';
+export const OWNABLE_BETA_VALIDATOR_ADDRESS = '0x0000000000e9e6e96bcaa3c113187cdb7e38aed9';
+export const ECDSA_MOCK_SIGNATURE = '0x81d4b4981670cb18f99f0b4a66446df1bf5b204d24cfcb659bf38ba27a4359b5711649ec2423c5e1247245eba2964679b6a1dbb85c992ae40b9b00c6935b02ff1b';
+function moduleAddress(definition) {
+    return definition.module.source === 'explicit'
+        ? definition.module.address
+        : OWNABLE_VALIDATOR_ADDRESS;
+}
+export function resolveOwnableAddresses(input) {
+    return {
+        kind: 'validator',
+        address: input.address ?? OWNABLE_VALIDATOR_ADDRESS,
+        initData: encodeAbiParameters([
+            { name: 'threshold', type: 'uint256' },
+            { name: 'owners', type: 'address[]' },
+        ], [
+            BigInt(input.threshold),
+            input.owners
+                .map((owner) => owner.toLowerCase())
+                .sort(),
+        ]),
+        deInitData: '0x',
+        additionalContext: '0x',
+    };
+}
+export function resolveOwnableValidator(definition) {
+    const owners = definition.owners
+        .map((owner) => {
+        if (owner.kind === 'webauthn') {
+            throw new Error('Ownable validator contains a WebAuthn owner');
+        }
+        return owner.account.address.toLowerCase();
+    })
+        .sort();
+    return resolveOwnableAddresses({
+        owners,
+        threshold: definition.threshold,
+        address: moduleAddress(definition),
+    });
+}
+export function encodeOwnableMockSignature(ownerCount) {
+    return concat(Array.from({ length: ownerCount }, () => ECDSA_MOCK_SIGNATURE));
+}
+export function encodeEcdsaValidatorContribution(input) {
+    if (input.threshold < 1 || input.threshold > input.ownerOrder.length) {
+        throw new Error('Validator threshold is outside the configured owner set');
+    }
+    const configured = new Set(input.ownerOrder);
+    const contributions = new Map();
+    for (const contribution of input.contributions) {
+        if (!configured.has(contribution.ownerId)) {
+            throw new Error(`Unknown validator owner ${contribution.ownerId}`);
+        }
+        if (contributions.has(contribution.ownerId)) {
+            throw new Error(`Duplicate validator owner ${contribution.ownerId}`);
+        }
+        contributions.set(contribution.ownerId, contribution.encoding === 'validator-contribution'
+            ? contribution.signature
+            : encodeEcdsaRecoveryValue(contribution.signature, input.recoveryEncoding));
+    }
+    const ordered = input.ownerOrder.flatMap((ownerId) => {
+        const contribution = contributions.get(ownerId);
+        return contribution ? [contribution] : [];
+    });
+    if (ordered.length < input.threshold) {
+        throw new Error(`Insufficient validator contributions: required ${input.threshold}, received ${ordered.length}`);
+    }
+    return concat(ordered);
+}
+export function encodeEcdsaRecoveryValue(signature, encoding) {
+    const bytes = hexToBytes(signature);
+    if (bytes.length !== 65) {
+        throw new Error('ECDSA signatures must contain 65 bytes');
+    }
+    const recovery = bytes[64];
+    const ethereumRecovery = recovery < 27 ? recovery + 27 : recovery;
+    const encodedRecovery = encoding === 'validator-offset-4' ? ethereumRecovery + 4 : ethereumRecovery;
+    if (encodedRecovery > 255) {
+        throw new Error('ECDSA recovery value does not fit in one byte');
+    }
+    return concat([signature.slice(0, -2), toHex(encodedRecovery)]);
+}

package/dist/src/modules/validators/permissions.d.ts

@@ -1,4 +1,5 @@
-import type { Permission, ScopedAction } from '../../types.js';
+import type { Permission, ScopedAction } from './smart-sessions/types.js';
+export declare const FAR_FUTURE_MS = 4102444800000;
 declare function resolvePermission(permission: Permission): ScopedAction[];
 declare function resolvePermissions(permissions: readonly Permission[]): ScopedAction[];
 export { resolvePermissions, resolvePermission };

package/dist/src/modules/validators/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EAEb,MAAM,aAAa,CAAA;AA0CpB,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA+FjE;AAED,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAEhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../modules/validators/permissions.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,UAAU,EACV,YAAY,EAGb,MAAM,wBAAwB,CAAA;AAiH/B,eAAO,MAAM,aAAa,gBAAoB,CAAA;AAE9C,iBAAS,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,EAAE,CA0NjE;AAkBD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,YAAY,EAAE,CAwBhB;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/src/modules/validators/permissions.js

@@ -1,4 +1,4 @@
-import { isAddress, isHex, size, toFunctionSelector, } from 'viem';
+import { isAddress, isHex, padHex, size, toFunctionSelector, } from 'viem';
 function isStaticAbiType(type) {
     if (type === 'address' || type === 'bool')
         return true;
@@ -33,12 +33,53 @@ function toReferenceValue(value, abiType) {
         if (typeof value === 'string' &&
             isHex(value) &&
             size(value) === expectedSize) {
-            return value;
+            // Solidity calldata encodes bytesN (N<32) left-aligned + right-padded
+            // inside its 32-byte word, whereas address/uint*/bool are right-aligned
+            // + left-padded. Downstream `encodeActionParamRule` unconditionally
+            // left-pads with `padHex`, which is correct for the right-aligned types
+            // but wrong for bytesN. Pre-encode here to the full 32-byte hex with
+            // the correct alignment so the policy's bytes32 == bytes32 comparison
+            // matches what's actually in calldata.
+            return padHex(value, { size: 32, dir: 'right' });
         }
         throw new Error(`Expected ${expectedSize}-byte hex string for ${abiType}`);
     }
     throw new Error(`Unsupported ABI type: ${abiType}`);
 }
+// Right-fold an array of leaves into a right-leaning OR chain:
+//   [a, b, c]  →  OR(a, OR(b, c))
+// Right-leaning is fine because ArgPolicy evaluates with short-circuit; any
+// shape that uses every leaf and respects post-order produces the same result.
+function orChain(leaves) {
+    let acc = leaves[leaves.length - 1];
+    for (let i = leaves.length - 2; i >= 0; i--) {
+        acc = { type: 'or', left: leaves[i], right: acc };
+    }
+    return acc;
+}
+function andChain(leaves) {
+    let acc = leaves[leaves.length - 1];
+    for (let i = leaves.length - 2; i >= 0; i--) {
+        acc = { type: 'and', left: leaves[i], right: acc };
+    }
+    return acc;
+}
+// On-chain ERC20SpendingLimitPolicy._isTokenTransferOrApprove matches by
+// 4-byte selector, accepting only these four. Selector-gating here keeps the
+// SDK's accepted set congruent with the contract's — a same-shaped function
+// like `mint(address,uint256)` would otherwise pass argument-type checks and
+// fail every call on-chain.
+const ERC20_SPENDING_LIMIT_SELECTORS = new Set([
+    '0x095ea7b3', // approve(address,uint256)
+    '0x39509351', // increaseAllowance(address,uint256)
+    '0xa9059cbb', // transfer(address,uint256)
+    '0x23b872dd', // transferFrom(address,address,uint256)
+]);
+// Year 2100 in ms — well within uint128 after the encoder's ms→s conversion.
+// Used as the one-sided default for `validUntil` when only `validAfter` is set.
+// Exported so the cross-chain permit expansion (smart-sessions.ts) applies the
+// same always-passing upper bound instead of defaulting to 0 (already expired).
+export const FAR_FUTURE_MS = 4_102_444_800_000;
 function resolvePermission(permission) {
     const { abi, address, functions } = permission;
     const actions = [];
@@ -58,11 +99,57 @@ function resolvePermission(permission) {
         }
         const abiEntry = abiEntries[0];
         const selector = toFunctionSelector(abiEntry);
-        const policies = config.policies ? [...config.policies] : [];
-        const params = config.params ?? {};
-        const paramEntries = Object.entries(params).filter(([, v]) => v !== undefined);
+        if (Object.hasOwn(config, 'policies')) {
+            throw new Error(`Function "${fnName}": \`policies\` was removed from permission configs. ` +
+                'Use params, maxUses, validUntil/validAfter, valueLimit, or spendingLimit instead.');
+        }
+        const policies = [];
+        // --- Sugar field expansion -----------------------------------------------
+        if (config.maxUses !== undefined) {
+            policies.push({ type: 'usage-limit', limit: config.maxUses });
+        }
+        if (config.validUntil !== undefined || config.validAfter !== undefined) {
+            const validUntil = config.validUntil !== undefined
+                ? config.validUntil.getTime()
+                : FAR_FUTURE_MS;
+            const validAfter = config.validAfter !== undefined ? config.validAfter.getTime() : 0;
+            if (validUntil < validAfter) {
+                throw new Error(`Function "${fnName}": validUntil (${validUntil}) is before validAfter (${validAfter}).`);
+            }
+            policies.push({ type: 'time-frame', validUntil, validAfter });
+        }
+        if (config.valueLimit !== undefined) {
+            // Runtime backstop: payable-gating is enforced at the type level, but
+            // users can bypass with `as` casts. valueLimit on a non-payable function
+            // is harmless on-chain (msg.value is always 0, the cap always passes)
+            // but it leaks intent — throw rather than encode dead weight.
+            if (abiEntry.stateMutability !== 'payable') {
+                throw new Error(`Function "${fnName}" is not payable — \`valueLimit\` only constrains native ETH ` +
+                    'attached to the call, which is always zero for non-payable functions. ' +
+                    'Remove `valueLimit`.');
+            }
+            policies.push({ type: 'value-limit', limit: config.valueLimit });
+        }
+        if (config.spendingLimit !== undefined) {
+            // Runtime backstop: type-level gate restricts shape, but ERC20SpendingLimitPolicy
+            // dispatches by selector on-chain — a same-shaped function like
+            // mint(address,uint256) would encode successfully and fail every call.
+            if (!ERC20_SPENDING_LIMIT_SELECTORS.has(selector)) {
+                throw new Error(`Function "${fnName}" (selector ${selector}) is not an ERC-20 transfer/approve ` +
+                    'selector; `spendingLimit` only works on approve, increaseAllowance, ' +
+                    'transfer, or transferFrom. The on-chain policy dispatches by selector ' +
+                    'and would fail every call for other functions.');
+            }
+            policies.push({
+                type: 'spending-limits',
+                limits: [config.spendingLimit],
+            });
+        }
+        // --- End sugar field expansion -------------------------------------------
+        const rawParams = config.params ?? {};
+        const paramEntries = Object.entries(rawParams).filter(([, v]) => v !== undefined);
         if (paramEntries.length > 0) {
-            const rules = paramEntries.map(([paramName, rule]) => {
+            const normalized = paramEntries.map(([paramName, rule]) => {
                 const paramIndex = abiEntry.inputs.findIndex((p) => p.name === paramName);
                 if (paramIndex === -1) {
                     throw new Error(`Parameter "${paramName}" not found in function "${fnName}". ` +
@@ -75,21 +162,79 @@ function resolvePermission(permission) {
                         '(address, bool, uint*, int*, bytes1–bytes32).');
                 }
                 const calldataOffset = BigInt(paramIndex) * 32n;
-                const referenceValue = toReferenceValue(rule.value, param.type);
+                if (rule.anyOf !== undefined) {
+                    if (rule.anyOf.length === 0) {
+                        throw new Error(`Parameter "${paramName}" has empty anyOf — provide at least one value.`);
+                    }
+                    return {
+                        paramName,
+                        calldataOffset,
+                        abiType: param.type,
+                        anyOf: rule.anyOf,
+                    };
+                }
                 return {
-                    condition: rule.condition,
+                    paramName,
                     calldataOffset,
-                    referenceValue,
-                    ...(rule.usageLimit !== undefined
-                        ? { usageLimit: rule.usageLimit }
-                        : {}),
+                    abiType: param.type,
+                    condition: rule.condition,
+                    value: rule.value,
+                    usageLimit: rule.usageLimit,
                 };
             });
-            policies.push({
-                type: 'universal-action',
-                valueLimitPerUse: config.valueLimitPerUse ?? 0n,
-                rules: rules,
-            });
+            const usesArgPolicy = normalized.some((n) => n.anyOf !== undefined);
+            // UniActionPolicy/ArgPolicy reject `msg.value > valueLimitPerUse`, so a
+            // default of 0 would block any non-zero msg.value before the standalone
+            // value-limit policy (sugar) could allow it. Inherit the sugar's cap so
+            // the per-use gate matches user intent; value-limit still enforces the
+            // cumulative cap on top.
+            const embeddedValueLimit = config.valueLimitPerUse ?? config.valueLimit ?? 0n;
+            if (usesArgPolicy) {
+                // One sub-expression per param, then AND across params.
+                const perParam = normalized.map((n) => {
+                    if (n.anyOf !== undefined) {
+                        const leaves = n.anyOf.map((v) => ({
+                            type: 'rule',
+                            rule: {
+                                condition: 'equal',
+                                calldataOffset: n.calldataOffset,
+                                referenceValue: toReferenceValue(v, n.abiType),
+                            },
+                        }));
+                        return leaves.length === 1 ? leaves[0] : orChain(leaves);
+                    }
+                    return {
+                        type: 'rule',
+                        rule: {
+                            condition: n.condition,
+                            calldataOffset: n.calldataOffset,
+                            referenceValue: toReferenceValue(n.value, n.abiType),
+                            ...(n.usageLimit !== undefined
+                                ? { usageLimit: n.usageLimit }
+                                : {}),
+                        },
+                    };
+                });
+                policies.push({
+                    type: 'arg-policy',
+                    valueLimitPerUse: embeddedValueLimit,
+                    expression: perParam.length === 1 ? perParam[0] : andChain(perParam),
+                });
+            }
+            else {
+                // Flat AND-of-rules — cheaper to init via UniActionPolicy.
+                const rules = normalized.map((n) => ({
+                    condition: n.condition,
+                    calldataOffset: n.calldataOffset,
+                    referenceValue: toReferenceValue(n.value, n.abiType),
+                    ...(n.usageLimit !== undefined ? { usageLimit: n.usageLimit } : {}),
+                }));
+                policies.push({
+                    type: 'universal-action',
+                    valueLimitPerUse: embeddedValueLimit,
+                    rules: rules,
+                });
+            }
         }
         else if (config.valueLimitPerUse !== undefined) {
             policies.push({
@@ -105,7 +250,36 @@ function resolvePermission(permission) {
     }
     return actions;
 }
+// Error-path only: recover the function name behind a selector for the
+// duplicate-permission message.
+function findFunctionName(permission, selector) {
+    return Object.keys(permission.functions).find((name) => {
+        const entry = permission.abi.find((e) => e.type === 'function' &&
+            e.name === name);
+        return entry !== undefined && toFunctionSelector(entry) === selector;
+    });
+}
 function resolvePermissions(permissions) {
-    return permissions.flatMap(resolvePermission);
+    // On-chain, actions are keyed by keccak(target, selector): two permission
+    // entries for the same function on the same contract share one actionId,
+    // and the later entry's `initializeWithMultiplexer` silently overwrites the
+    // earlier one's policy config. Reject at build time instead of letting the
+    // collision surface as an opaque InvalidSignature() at execution.
+    const seen = new Set();
+    return permissions.flatMap((permission) => {
+        const actions = resolvePermission(permission);
+        for (const action of actions) {
+            const key = `${action.target.toLowerCase()}:${action.selector.toLowerCase()}`;
+            if (seen.has(key)) {
+                const fnName = findFunctionName(permission, action.selector);
+                throw new Error(`Duplicate permission for function "${fnName}" (selector ${action.selector}) ` +
+                    `on ${action.target}: permission entries for the same function on the same ` +
+                    "contract share one on-chain action, so the later entry's policies would " +
+                    'silently overwrite the earlier ones. Merge them into a single entry.');
+            }
+            seen.add(key);
+        }
+        return actions;
+    });
 }
 export { resolvePermissions, resolvePermission };

package/dist/src/modules/validators/policies/claim/arbiters.d.ts

@@ -0,0 +1,19 @@
+import type { Address } from 'viem';
+import type { CrossChainSettlementLayer } from '../../smart-sessions/types.js';
+/**
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
+ *
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
+ *
+ * @param layers   Settlement layers the session is permitted to use.
+ *                 Empty/undefined ⇒ all supported layers.
+ * @param useDevContracts  Pull from the dev address book instead of mainnet.
+ */
+export declare function getArbitersForSettlementLayers(layers: readonly CrossChainSettlementLayer[] | undefined, useDevContracts?: boolean): Address[] | undefined;
+//# sourceMappingURL=arbiters.d.ts.map

package/dist/src/modules/validators/policies/claim/arbiters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAoD3E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA6BvB"}