@rhinestone/sdk 2.0.0-beta.8 → 2.0.0

package/dist/src/modules/validators/policies/claim/arbiters.js

@@ -0,0 +1,82 @@
+/**
+ * The arbiter contract keys that each settlement layer expands to. `ACROSS`
+ * whitelists both arbiter impls so a session is permissioned for the 7579 and
+ * multicall paths regardless of which one the orchestrator picks at intent time.
+ */
+const SETTLEMENT_LAYER_CONTRACT_KEYS = {
+    SAME_CHAIN: ['samechainArbiter'],
+    ECO: ['ecoArbiter'],
+    ACROSS: ['across7579Arbiter', 'acrossMulticallArbiter'],
+};
+/**
+ * Bundled arbiter allow-set — the deployed arbiter addresses per key, per
+ * environment (the union across chains).
+ *
+ * v2: this is a small, signed-path **constant** bundled in the SDK rather than
+ * read from `@rhinestone/shared-configs`. The arbiter is baked into the user's
+ * Permit2 session signature, so it must stay **client-trusted** — never sourced
+ * from the orchestrator you transact against. Rhinestone's arbiters are CREATE2
+ * and near-uniform across chains, so this is a handful of addresses per key
+ * (e.g. `ecoArbiter` has a mainnet and a testnet address). A new *chain* reuses
+ * these; only a contract redeploy or a new settlement layer changes them.
+ */
+const ARBITER_ADDRESSES = {
+    prod: {
+        samechainArbiter: ['0x000000000006e2569CaF8Ff021810790e0A0D740'],
+        ecoArbiter: [
+            '0x2e7627CCfAe4eDb336eEb5a70f08415B0F1a2b8C',
+            '0xA212A6ACCC8db0e4cdf4394D0A851c70Fc27A8F0',
+        ],
+        across7579Arbiter: ['0x28a4D41776968c1201A807ec51fFB405362B8882'],
+        acrossMulticallArbiter: ['0xA162fabb9a0EeF2736485A587aAAB3d015e14224'],
+    },
+    dev: {
+        samechainArbiter: ['0x8fA7720Eee299223f25De8DC03C68A28541dCD10'],
+        ecoArbiter: [
+            '0x1BeBAfb3D05d84A5Bfd94800c88d1342f755d8AB',
+            '0x8A061029AE4c5Cf69b5368119B3b0C80B31F55fE',
+        ],
+        across7579Arbiter: ['0x1b19973F7a29E950ad4FaF8872745B6378005517'],
+        acrossMulticallArbiter: ['0x8343FBBA0526deC1c952A098057021027648bcf9'],
+    },
+};
+/**
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
+ *
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
+ *
+ * @param layers   Settlement layers the session is permitted to use.
+ *                 Empty/undefined ⇒ all supported layers.
+ * @param useDevContracts  Pull from the dev address book instead of mainnet.
+ */
+export function getArbitersForSettlementLayers(layers, useDevContracts) {
+    const effectiveLayers = !layers || layers.length === 0
+        ? Object.keys(SETTLEMENT_LAYER_CONTRACT_KEYS)
+        : layers;
+    const book = ARBITER_ADDRESSES[useDevContracts ? 'dev' : 'prod'];
+    const keys = effectiveLayers.flatMap((l) => SETTLEMENT_LAYER_CONTRACT_KEYS[l]);
+    const seen = new Set();
+    const addresses = [];
+    // The same logical arbiter often shares an address across chains, but a given
+    // key may have multiple addresses live (e.g. a mainnet + testnet deployment).
+    // Collect every unique address for the requested keys, deduped
+    // case-insensitively.
+    for (const key of keys) {
+        // `keys` are `SETTLEMENT_LAYER_CONTRACT_KEYS` values, so `book` always has
+        // an entry for each — no missing-key fallback needed.
+        for (const addr of book[key]) {
+            const norm = addr.toLowerCase();
+            if (seen.has(norm))
+                continue;
+            seen.add(norm);
+            addresses.push(addr);
+        }
+    }
+    return addresses.length ? addresses : undefined;
+}

package/dist/src/modules/validators/resolve.d.ts

@@ -0,0 +1,5 @@
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition, ResolvedValidatorDefinition } from './types.js';
+export declare function resolveAtomicValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+export declare function resolveValidator(definition: ResolvedValidatorDefinition): ResolvedModule;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/src/modules/validators/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../modules/validators/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,SAAS,CAAA;AAGhB,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAYhB;AAED,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,2BAA2B,GACtC,cAAc,CAIhB"}

package/dist/src/modules/validators/resolve.js

@@ -0,0 +1,22 @@
+import { resolveEnsValidator } from './ens.js';
+import { resolveMultiFactorValidator } from './multi-factor.js';
+import { resolveOwnableValidator } from './ownable.js';
+import { resolveWebauthnValidator } from './webauthn.js';
+export function resolveAtomicValidator(definition) {
+    switch (definition.kind) {
+        case 'ecdsa':
+            return resolveOwnableValidator(definition);
+        case 'ens':
+            return resolveEnsValidator(definition);
+        case 'passkey':
+            return resolveWebauthnValidator(definition);
+        case 'k1':
+        case 'smart-session':
+            throw new Error(`Validator ${definition.kind} requires feature input`);
+    }
+}
+export function resolveValidator(definition) {
+    return definition.kind === 'multi-factor'
+        ? resolveMultiFactorValidator(definition, resolveAtomicValidator)
+        : resolveAtomicValidator(definition);
+}

package/dist/src/modules/validators/signer-id.d.ts

@@ -0,0 +1,5 @@
+import type { Account, Address, Hex } from 'viem';
+import type { WebAuthnAccount } from 'viem/account-abstraction';
+export declare function ecdsaSignerId(account: Account | Address): string;
+export declare function webauthnSignerId(account: WebAuthnAccount | Hex): string;
+//# sourceMappingURL=signer-id.d.ts.map

package/dist/src/modules/validators/signer-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-id.d.ts","sourceRoot":"","sources":["../../../../modules/validators/signer-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAGhE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,GAAG,GAAG,MAAM,CAGvE"}

package/dist/src/modules/validators/signer-id.js

@@ -0,0 +1,8 @@
+export function ecdsaSignerId(account) {
+    const address = typeof account === 'string' ? account : account.address;
+    return `ecdsa:${address.toLowerCase()}`;
+}
+export function webauthnSignerId(account) {
+    const publicKey = typeof account === 'string' ? account : account.publicKey;
+    return `webauthn:${publicKey.toLowerCase()}`;
+}

package/dist/src/modules/validators/smart-session-signature-types.d.ts

@@ -0,0 +1,35 @@
+import type { Address, Hex } from 'viem';
+interface SmartSessionPolicyData {
+    readonly policy: Address;
+    readonly initData: Hex;
+}
+interface SmartSessionActionData {
+    readonly actionTargetSelector: Hex;
+    readonly actionTarget: Address;
+    readonly actionPolicies: readonly SmartSessionPolicyData[];
+}
+interface SmartSessionErc7739PolicyData {
+    readonly allowedERC7739Content: readonly {
+        readonly appDomainSeparator: Hex;
+        readonly contentNames: readonly string[];
+    }[];
+    readonly erc1271Policies: readonly SmartSessionPolicyData[];
+}
+export interface SmartSessionEnableContributionData {
+    readonly userSignature: Hex;
+    readonly hashesAndChainIds: readonly {
+        readonly chainId: bigint;
+        readonly sessionDigest: Hex;
+    }[];
+    readonly sessionToEnableIndex: number;
+    readonly session: {
+        readonly sessionValidator: Address;
+        readonly sessionValidatorInitData: Hex;
+        readonly salt: Hex;
+        readonly erc7739Policies: SmartSessionErc7739PolicyData;
+        readonly actions: readonly SmartSessionActionData[];
+        readonly claimPolicies: readonly SmartSessionPolicyData[];
+    };
+}
+export {};
+//# sourceMappingURL=smart-session-signature-types.d.ts.map

package/dist/src/modules/validators/smart-session-signature-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-session-signature-types.d.ts","sourceRoot":"","sources":["../../../../modules/validators/smart-session-signature-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAExC,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAA;CACvB;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAA;IAClC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC3D;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QACvC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAA;QAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KACzC,EAAE,CAAA;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC5D;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS;QACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;KAC5B,EAAE,CAAA;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;QAClC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAA;QACtC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;QAClB,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAA;QACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAA;QACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;KAC1D,CAAA;CACF"}

package/dist/src/modules/validators/smart-session-signature-types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/modules/validators/smart-sessions/authorization.d.ts

@@ -0,0 +1,99 @@
+import { type Address } from 'viem';
+import type { Session, SessionDetails } from './types.js';
+export declare const SESSION_LOCK_TAG: "0x000000000000000000000000";
+export declare const types: {
+    readonly PolicyData: readonly [{
+        readonly name: "policy";
+        readonly type: "address";
+    }, {
+        readonly name: "initData";
+        readonly type: "bytes";
+    }];
+    readonly ActionData: readonly [{
+        readonly name: "actionTargetSelector";
+        readonly type: "bytes4";
+    }, {
+        readonly name: "actionTarget";
+        readonly type: "address";
+    }, {
+        readonly name: "actionPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly ERC7739Context: readonly [{
+        readonly name: "appDomainSeparator";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "contentName";
+        readonly type: "string[]";
+    }];
+    readonly ERC7739Data: readonly [{
+        readonly name: "allowedERC7739Content";
+        readonly type: "ERC7739Context[]";
+    }, {
+        readonly name: "erc1271Policies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly LockTagData: readonly [{
+        readonly name: "lockTag";
+        readonly type: "bytes12";
+    }, {
+        readonly name: "claimPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly SignedPermissions: readonly [{
+        readonly name: "actions";
+        readonly type: "ActionData[]";
+    }, {
+        readonly name: "erc7739Policies";
+        readonly type: "ERC7739Data";
+    }, {
+        readonly name: "lockTagPolicies";
+        readonly type: "LockTagData";
+    }, {
+        readonly name: "permitGenericPolicy";
+        readonly type: "bool";
+    }];
+    readonly SignedSession: readonly [{
+        readonly name: "account";
+        readonly type: "address";
+    }, {
+        readonly name: "expires";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "permissions";
+        readonly type: "SignedPermissions";
+    }, {
+        readonly name: "salt";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "sessionValidator";
+        readonly type: "address";
+    }, {
+        readonly name: "sessionValidatorInitData";
+        readonly type: "bytes";
+    }, {
+        readonly name: "smartSessionEmissary";
+        readonly type: "address";
+    }];
+    readonly ChainSession: readonly [{
+        readonly name: "chainId";
+        readonly type: "uint64";
+    }, {
+        readonly name: "session";
+        readonly type: "SignedSession";
+    }];
+    readonly MultiChainSession: readonly [{
+        readonly name: "sessionsAndChainIds";
+        readonly type: "ChainSession[]";
+    }];
+};
+export declare function getSessionDetails(input: {
+    readonly account: Address;
+    readonly sessions: readonly Session[];
+    readonly environment: 'production' | 'development';
+    readonly readNonce: (session: Session) => Promise<bigint>;
+}): Promise<SessionDetails>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/src/modules/validators/smart-sessions/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,MAAM,CAAA;AAOb,OAAO,KAAK,EAAE,OAAO,EAAe,cAAc,EAAE,MAAM,SAAS,CAAA;AAEnE,eAAO,MAAM,gBAAgB,EAAG,4BAAqC,CAAA;AAErE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CR,CAAA;AAyCV,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,cAAc,CAAC,CA8B1B"}

package/dist/src/modules/validators/smart-sessions/authorization.js

@@ -0,0 +1,101 @@
+import { hashStruct, maxUint256, } from 'viem';
+import { getSessionData } from './digest.js';
+import { getSmartSessionEmissaryAddress } from './module.js';
+import { SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, } from './resolve.js';
+export const SESSION_LOCK_TAG = '0x000000000000000000000000';
+export const types = {
+    PolicyData: [
+        { name: 'policy', type: 'address' },
+        { name: 'initData', type: 'bytes' },
+    ],
+    ActionData: [
+        { name: 'actionTargetSelector', type: 'bytes4' },
+        { name: 'actionTarget', type: 'address' },
+        { name: 'actionPolicies', type: 'PolicyData[]' },
+    ],
+    ERC7739Context: [
+        { name: 'appDomainSeparator', type: 'bytes32' },
+        { name: 'contentName', type: 'string[]' },
+    ],
+    ERC7739Data: [
+        { name: 'allowedERC7739Content', type: 'ERC7739Context[]' },
+        { name: 'erc1271Policies', type: 'PolicyData[]' },
+    ],
+    LockTagData: [
+        { name: 'lockTag', type: 'bytes12' },
+        { name: 'claimPolicies', type: 'PolicyData[]' },
+    ],
+    SignedPermissions: [
+        { name: 'actions', type: 'ActionData[]' },
+        { name: 'erc7739Policies', type: 'ERC7739Data' },
+        { name: 'lockTagPolicies', type: 'LockTagData' },
+        { name: 'permitGenericPolicy', type: 'bool' },
+    ],
+    SignedSession: [
+        { name: 'account', type: 'address' },
+        { name: 'expires', type: 'uint256' },
+        { name: 'nonce', type: 'uint256' },
+        { name: 'permissions', type: 'SignedPermissions' },
+        { name: 'salt', type: 'bytes32' },
+        { name: 'sessionValidator', type: 'address' },
+        { name: 'sessionValidatorInitData', type: 'bytes' },
+        { name: 'smartSessionEmissary', type: 'address' },
+    ],
+    ChainSession: [
+        { name: 'chainId', type: 'uint64' },
+        { name: 'session', type: 'SignedSession' },
+    ],
+    MultiChainSession: [{ name: 'sessionsAndChainIds', type: 'ChainSession[]' }],
+};
+function signedSession(account, data, nonce, environment) {
+    return {
+        account,
+        permissions: {
+            permitGenericPolicy: data.actions.some((action) => action.actionTarget === SMART_SESSIONS_FALLBACK_TARGET_FLAG &&
+                action.actionTargetSelector ===
+                    SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG),
+            lockTagPolicies: {
+                lockTag: SESSION_LOCK_TAG,
+                claimPolicies: data.claimPolicies,
+            },
+            erc7739Policies: {
+                allowedERC7739Content: data.erc7739Policies.allowedERC7739Content.map((content) => ({
+                    contentName: content.contentNames,
+                    appDomainSeparator: content.appDomainSeparator,
+                })),
+                erc1271Policies: data.erc7739Policies.erc1271Policies,
+            },
+            actions: data.actions,
+        },
+        sessionValidator: data.sessionValidator,
+        sessionValidatorInitData: data.sessionValidatorInitData,
+        salt: data.salt,
+        smartSessionEmissary: getSmartSessionEmissaryAddress(environment),
+        expires: maxUint256,
+        nonce,
+    };
+}
+export async function getSessionDetails(input) {
+    const nonces = await Promise.all(input.sessions.map(input.readNonce));
+    const signed = input.sessions.map((session, index) => signedSession(input.account, getSessionData(session), nonces[index], input.environment));
+    const hashesAndChainIds = signed.map((session, index) => ({
+        chainId: BigInt(input.sessions[index].chain.id),
+        sessionDigest: hashStruct({
+            types,
+            primaryType: 'SignedSession',
+            data: session,
+        }),
+    }));
+    const data = {
+        domain: { name: 'SmartSessionEmissary', version: '1' },
+        types,
+        primaryType: 'MultiChainSession',
+        message: {
+            sessionsAndChainIds: signed.map((session, index) => ({
+                chainId: BigInt(input.sessions[index].chain.id),
+                session,
+            })),
+        },
+    };
+    return { nonces, hashesAndChainIds, data };
+}

package/dist/src/modules/validators/smart-sessions/calls.d.ts

@@ -0,0 +1,19 @@
+import { type Address, type Hex } from 'viem';
+import type { Call } from '../../../calls/types.js';
+import type { ChainDigest, Session } from './types.js';
+export declare function encodeEnableSessionCall(input: {
+    readonly account: Address;
+    readonly session: Session;
+    readonly userSignature: Hex;
+    readonly hashesAndChainIds: readonly ChainDigest[];
+    readonly sessionToEnableIndex: number;
+    readonly environment: 'production' | 'development';
+}): Call;
+export declare function encodeDisableSessionCall(input: {
+    readonly account: Address;
+    readonly session: Session;
+    readonly expires: bigint;
+    readonly nonce: bigint;
+    readonly environment: 'production' | 'development';
+}): Call;
+//# sourceMappingURL=calls.d.ts.map

package/dist/src/modules/validators/smart-sessions/calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/calls.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,GAAG,EAKT,MAAM,MAAM,CAAA;AACb,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAKhD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAgBnD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,WAAW,EAAE,CAAA;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;CACnD,GAAG,IAAI,CAwBP;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;CACnD,GAAG,IAAI,CAgDP"}

package/dist/src/modules/validators/smart-sessions/calls.js

@@ -0,0 +1,85 @@
+import { encodeAbiParameters, encodeFunctionData, keccak256, maxUint256, zeroAddress, zeroHash, } from 'viem';
+import smartSessionEmissaryAbi from '../../abi/smart-session-emissary.js';
+import { SESSION_LOCK_TAG } from './authorization.js';
+import { getPermissionId, getSessionData } from './digest.js';
+import { getSmartSessionEmissaryAddress } from './module.js';
+const SCOPE_MULTICHAIN = 0;
+const RESET_PERIOD_ONE_WEEK = 6;
+const SIGNED_PERMISSION_DISABLE_TYPEHASH = '0x098b3120e60a8adc9d970dec9c1f8796974a3ab6154f995ad56ee7b9a38d8836';
+function config(permissionId) {
+    return {
+        scope: SCOPE_MULTICHAIN,
+        resetPeriod: RESET_PERIOD_ONE_WEEK,
+        allocator: zeroAddress,
+        permissionId,
+    };
+}
+export function encodeEnableSessionCall(input) {
+    const permissionId = getPermissionId(input.session);
+    return {
+        target: getSmartSessionEmissaryAddress(input.environment),
+        value: 0n,
+        data: encodeFunctionData({
+            abi: smartSessionEmissaryAbi,
+            functionName: 'setConfig',
+            args: [
+                input.account,
+                config(permissionId),
+                {
+                    allocatorSig: zeroHash,
+                    userSig: input.userSignature,
+                    expires: maxUint256,
+                    session: {
+                        chainDigestIndex: input.sessionToEnableIndex,
+                        hashesAndChainIds: [...input.hashesAndChainIds],
+                        sessionToEnable: getSessionData(input.session),
+                    },
+                },
+            ],
+        }),
+    };
+}
+export function encodeDisableSessionCall(input) {
+    const permissionId = getPermissionId(input.session);
+    const disableDigest = keccak256(encodeAbiParameters([
+        { type: 'bytes32' },
+        { type: 'address' },
+        { type: 'bytes32' },
+        { type: 'bytes12' },
+        { type: 'uint256' },
+        { type: 'uint256' },
+    ], [
+        SIGNED_PERMISSION_DISABLE_TYPEHASH,
+        input.account,
+        permissionId,
+        SESSION_LOCK_TAG,
+        input.expires,
+        input.nonce,
+    ]));
+    return {
+        target: getSmartSessionEmissaryAddress(input.environment),
+        value: 0n,
+        data: encodeFunctionData({
+            abi: smartSessionEmissaryAbi,
+            functionName: 'removeConfig',
+            args: [
+                input.account,
+                config(permissionId),
+                {
+                    allocatorSig: '0x',
+                    userSig: '0x',
+                    expires: input.expires,
+                    session: {
+                        chainDigestIndex: 0,
+                        hashesAndChainIds: [
+                            {
+                                chainId: BigInt(input.session.chain.id),
+                                sessionDigest: disableDigest,
+                            },
+                        ],
+                    },
+                },
+            ],
+        }),
+    };
+}

package/dist/src/modules/validators/smart-sessions/cross-chain-permits.d.ts

@@ -0,0 +1,4 @@
+import type { CrossChainPermissionInput, CrossChainPermit } from './types.js';
+export declare function resolveCrossChainPermission(input: CrossChainPermissionInput): CrossChainPermit;
+export declare function toCrossChainPermissionInput(permit: CrossChainPermit): CrossChainPermissionInput;
+//# sourceMappingURL=cross-chain-permits.d.ts.map

package/dist/src/modules/validators/smart-sessions/cross-chain-permits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-chain-permits.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/cross-chain-permits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAgB1E,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,yBAAyB,GAC/B,gBAAgB,CAyClB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,gBAAgB,GACvB,yBAAyB,CA2B3B"}

package/dist/src/modules/validators/smart-sessions/cross-chain-permits.js

@@ -0,0 +1,77 @@
+function seconds(input) {
+    return BigInt(Math.floor(input.getTime() / 1000));
+}
+function normalizeLegs(legs) {
+    if (legs === undefined)
+        return undefined;
+    const values = Array.isArray(legs) ? legs : [legs];
+    return values.length === 0 ? undefined : values;
+}
+// Token fields are per-chain ERC-20 addresses (v2 no longer accepts symbols),
+// so legs pass through directly; only the `Date` bounds are converted.
+export function resolveCrossChainPermission(input) {
+    const from = normalizeLegs(input.from)?.map((leg) => ({
+        chain: leg.chain,
+        token: leg.token,
+        ...(leg.maxAmount === undefined ? {} : { maxAmount: leg.maxAmount }),
+    }));
+    const to = normalizeLegs(input.to)?.map((leg) => ({
+        chain: leg.chain,
+        token: leg.token,
+        ...(leg.recipient === undefined ? {} : { recipient: leg.recipient }),
+    }));
+    const validUntil = input.validUntil ? seconds(input.validUntil) : undefined;
+    const validAfter = input.validAfter ? seconds(input.validAfter) : undefined;
+    if (validUntil !== undefined &&
+        validAfter !== undefined &&
+        validAfter > validUntil) {
+        throw new Error(`crossChainPermits: validAfter (${validAfter}) is greater than validUntil (${validUntil})`);
+    }
+    return {
+        ...(from ? { from } : {}),
+        ...(to ? { to } : {}),
+        ...(validUntil === undefined ? {} : { validUntil }),
+        ...(validAfter === undefined ? {} : { validAfter }),
+        ...(input.fillDeadline
+            ? {
+                fillDeadline: input.fillDeadline.map(({ chain, min, max }) => ({
+                    chain,
+                    ...(min ? { min: seconds(min) } : {}),
+                    ...(max ? { max: seconds(max) } : {}),
+                })),
+            }
+            : {}),
+        recipientIsAccount: !input.allowRecipientNotAccount,
+        ...(input.settlementLayers
+            ? { settlementLayers: input.settlementLayers }
+            : {}),
+    };
+}
+export function toCrossChainPermissionInput(permit) {
+    const date = (value) => new Date(Number(value) * 1000);
+    return {
+        ...(permit.from ? { from: permit.from } : {}),
+        ...(permit.to ? { to: permit.to } : {}),
+        ...(permit.validUntil === undefined
+            ? {}
+            : { validUntil: date(permit.validUntil) }),
+        ...(permit.validAfter === undefined
+            ? {}
+            : { validAfter: date(permit.validAfter) }),
+        ...(permit.fillDeadline
+            ? {
+                fillDeadline: permit.fillDeadline.map(({ chain, min, max }) => ({
+                    chain,
+                    ...(min === undefined ? {} : { min: date(min) }),
+                    ...(max === undefined ? {} : { max: date(max) }),
+                })),
+            }
+            : {}),
+        ...(permit.recipientIsAccount === undefined
+            ? {}
+            : { allowRecipientNotAccount: !permit.recipientIsAccount }),
+        ...(permit.settlementLayers
+            ? { settlementLayers: permit.settlementLayers }
+            : {}),
+    };
+}

package/dist/src/modules/validators/smart-sessions/digest.d.ts

@@ -0,0 +1,5 @@
+import type { Session, SessionData } from './types.js';
+export declare function getPermissionIdFromData(session: SessionData): `0x${string}`;
+export declare function getSessionData(session: Session): SessionData;
+export declare function getPermissionId(session: Session): `0x${string}`;
+//# sourceMappingURL=digest.d.ts.map

package/dist/src/modules/validators/smart-sessions/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/digest.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,KAAK,MAAM,EAAE,CAe3E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAc5D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,MAAM,EAAE,CAE/D"}

package/dist/src/modules/validators/smart-sessions/digest.js

@@ -0,0 +1,30 @@
+import { encodeAbiParameters, keccak256 } from 'viem';
+import { encodePermit2ClaimPolicyInitData, PERMIT2_CLAIM_POLICY_ADDRESS, } from '../policies/claim/permit2.js';
+import { resolvePermit2ClaimPolicy } from './policies/claim.js';
+export function getPermissionIdFromData(session) {
+    return keccak256(encodeAbiParameters([
+        { type: 'address', name: 'sessionValidator' },
+        { type: 'bytes', name: 'sessionValidatorInitData' },
+        { type: 'bytes32', name: 'salt' },
+    ], [
+        session.sessionValidator,
+        session.sessionValidatorInitData,
+        session.salt,
+    ]));
+}
+export function getSessionData(session) {
+    return {
+        sessionValidator: session.sessionValidator,
+        sessionValidatorInitData: session.sessionValidatorInitData,
+        salt: session.salt,
+        erc7739Policies: session.erc7739Policies,
+        actions: session.actions,
+        claimPolicies: session.claimPolicies.map((policy) => ({
+            policy: PERMIT2_CLAIM_POLICY_ADDRESS,
+            initData: encodePermit2ClaimPolicyInitData(resolvePermit2ClaimPolicy(policy)),
+        })),
+    };
+}
+export function getPermissionId(session) {
+    return session.permissionId;
+}

package/dist/src/modules/validators/smart-sessions/mock-signature.d.ts

@@ -0,0 +1,10 @@
+import { type Hex } from 'viem';
+import type { Session, SmartSessionMockShape } from './types.js';
+export declare function buildSmartSessionMockSignature(input: {
+    readonly session: Session;
+    readonly environment: 'production' | 'development';
+    readonly chainCount?: number;
+    readonly targetChainId?: number;
+    readonly shape?: SmartSessionMockShape;
+}): Hex;
+//# sourceMappingURL=mock-signature.d.ts.map

package/dist/src/modules/validators/smart-sessions/mock-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-signature.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/mock-signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,GAAG,EAAY,MAAM,MAAM,CAAA;AAGjD,OAAO,KAAK,EAEV,OAAO,EAEP,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAA;CACvC,GAAG,GAAG,CA4BN"}