@rhinestone/sdk 2.0.0-beta.9 → 2.1.0

package/dist/src/modules/validators/permissions.js

@@ -1,4 +1,4 @@
-import { isAddress, isHex, size, toFunctionSelector, } from 'viem';
+import { isAddress, isHex, padHex, size, toFunctionSelector, } from 'viem';
 function isStaticAbiType(type) {
     if (type === 'address' || type === 'bool')
         return true;
@@ -33,12 +33,53 @@ function toReferenceValue(value, abiType) {
         if (typeof value === 'string' &&
             isHex(value) &&
             size(value) === expectedSize) {
-            return value;
+            // Solidity calldata encodes bytesN (N<32) left-aligned + right-padded
+            // inside its 32-byte word, whereas address/uint*/bool are right-aligned
+            // + left-padded. Downstream `encodeActionParamRule` unconditionally
+            // left-pads with `padHex`, which is correct for the right-aligned types
+            // but wrong for bytesN. Pre-encode here to the full 32-byte hex with
+            // the correct alignment so the policy's bytes32 == bytes32 comparison
+            // matches what's actually in calldata.
+            return padHex(value, { size: 32, dir: 'right' });
         }
         throw new Error(`Expected ${expectedSize}-byte hex string for ${abiType}`);
     }
     throw new Error(`Unsupported ABI type: ${abiType}`);
 }
+// Right-fold an array of leaves into a right-leaning OR chain:
+//   [a, b, c]  →  OR(a, OR(b, c))
+// Right-leaning is fine because ArgPolicy evaluates with short-circuit; any
+// shape that uses every leaf and respects post-order produces the same result.
+function orChain(leaves) {
+    let acc = leaves[leaves.length - 1];
+    for (let i = leaves.length - 2; i >= 0; i--) {
+        acc = { type: 'or', left: leaves[i], right: acc };
+    }
+    return acc;
+}
+function andChain(leaves) {
+    let acc = leaves[leaves.length - 1];
+    for (let i = leaves.length - 2; i >= 0; i--) {
+        acc = { type: 'and', left: leaves[i], right: acc };
+    }
+    return acc;
+}
+// On-chain ERC20SpendingLimitPolicy._isTokenTransferOrApprove matches by
+// 4-byte selector, accepting only these four. Selector-gating here keeps the
+// SDK's accepted set congruent with the contract's — a same-shaped function
+// like `mint(address,uint256)` would otherwise pass argument-type checks and
+// fail every call on-chain.
+const ERC20_SPENDING_LIMIT_SELECTORS = new Set([
+    '0x095ea7b3', // approve(address,uint256)
+    '0x39509351', // increaseAllowance(address,uint256)
+    '0xa9059cbb', // transfer(address,uint256)
+    '0x23b872dd', // transferFrom(address,address,uint256)
+]);
+// Year 2100 in ms — well within uint128 after the encoder's ms→s conversion.
+// Used as the one-sided default for `validUntil` when only `validAfter` is set.
+// Exported so the cross-chain permit expansion (smart-sessions.ts) applies the
+// same always-passing upper bound instead of defaulting to 0 (already expired).
+export const FAR_FUTURE_MS = 4_102_444_800_000;
 function resolvePermission(permission) {
     const { abi, address, functions } = permission;
     const actions = [];
@@ -58,11 +99,57 @@ function resolvePermission(permission) {
         }
         const abiEntry = abiEntries[0];
         const selector = toFunctionSelector(abiEntry);
-        const policies = config.policies ? [...config.policies] : [];
-        const params = config.params ?? {};
-        const paramEntries = Object.entries(params).filter(([, v]) => v !== undefined);
+        if (Object.hasOwn(config, 'policies')) {
+            throw new Error(`Function "${fnName}": \`policies\` was removed from permission configs. ` +
+                'Use params, maxUses, validUntil/validAfter, valueLimit, or spendingLimit instead.');
+        }
+        const policies = [];
+        // --- Sugar field expansion -----------------------------------------------
+        if (config.maxUses !== undefined) {
+            policies.push({ type: 'usage-limit', limit: config.maxUses });
+        }
+        if (config.validUntil !== undefined || config.validAfter !== undefined) {
+            const validUntil = config.validUntil !== undefined
+                ? config.validUntil.getTime()
+                : FAR_FUTURE_MS;
+            const validAfter = config.validAfter !== undefined ? config.validAfter.getTime() : 0;
+            if (validUntil < validAfter) {
+                throw new Error(`Function "${fnName}": validUntil (${validUntil}) is before validAfter (${validAfter}).`);
+            }
+            policies.push({ type: 'time-frame', validUntil, validAfter });
+        }
+        if (config.valueLimit !== undefined) {
+            // Runtime backstop: payable-gating is enforced at the type level, but
+            // users can bypass with `as` casts. valueLimit on a non-payable function
+            // is harmless on-chain (msg.value is always 0, the cap always passes)
+            // but it leaks intent — throw rather than encode dead weight.
+            if (abiEntry.stateMutability !== 'payable') {
+                throw new Error(`Function "${fnName}" is not payable — \`valueLimit\` only constrains native ETH ` +
+                    'attached to the call, which is always zero for non-payable functions. ' +
+                    'Remove `valueLimit`.');
+            }
+            policies.push({ type: 'value-limit', limit: config.valueLimit });
+        }
+        if (config.spendingLimit !== undefined) {
+            // Runtime backstop: type-level gate restricts shape, but ERC20SpendingLimitPolicy
+            // dispatches by selector on-chain — a same-shaped function like
+            // mint(address,uint256) would encode successfully and fail every call.
+            if (!ERC20_SPENDING_LIMIT_SELECTORS.has(selector)) {
+                throw new Error(`Function "${fnName}" (selector ${selector}) is not an ERC-20 transfer/approve ` +
+                    'selector; `spendingLimit` only works on approve, increaseAllowance, ' +
+                    'transfer, or transferFrom. The on-chain policy dispatches by selector ' +
+                    'and would fail every call for other functions.');
+            }
+            policies.push({
+                type: 'spending-limits',
+                limits: [config.spendingLimit],
+            });
+        }
+        // --- End sugar field expansion -------------------------------------------
+        const rawParams = config.params ?? {};
+        const paramEntries = Object.entries(rawParams).filter(([, v]) => v !== undefined);
         if (paramEntries.length > 0) {
-            const rules = paramEntries.map(([paramName, rule]) => {
+            const normalized = paramEntries.map(([paramName, rule]) => {
                 const paramIndex = abiEntry.inputs.findIndex((p) => p.name === paramName);
                 if (paramIndex === -1) {
                     throw new Error(`Parameter "${paramName}" not found in function "${fnName}". ` +
@@ -75,21 +162,79 @@ function resolvePermission(permission) {
                         '(address, bool, uint*, int*, bytes1–bytes32).');
                 }
                 const calldataOffset = BigInt(paramIndex) * 32n;
-                const referenceValue = toReferenceValue(rule.value, param.type);
+                if (rule.anyOf !== undefined) {
+                    if (rule.anyOf.length === 0) {
+                        throw new Error(`Parameter "${paramName}" has empty anyOf — provide at least one value.`);
+                    }
+                    return {
+                        paramName,
+                        calldataOffset,
+                        abiType: param.type,
+                        anyOf: rule.anyOf,
+                    };
+                }
                 return {
-                    condition: rule.condition,
+                    paramName,
                     calldataOffset,
-                    referenceValue,
-                    ...(rule.usageLimit !== undefined
-                        ? { usageLimit: rule.usageLimit }
-                        : {}),
+                    abiType: param.type,
+                    condition: rule.condition,
+                    value: rule.value,
+                    usageLimit: rule.usageLimit,
                 };
             });
-            policies.push({
-                type: 'universal-action',
-                valueLimitPerUse: config.valueLimitPerUse ?? 0n,
-                rules: rules,
-            });
+            const usesArgPolicy = normalized.some((n) => n.anyOf !== undefined);
+            // UniActionPolicy/ArgPolicy reject `msg.value > valueLimitPerUse`, so a
+            // default of 0 would block any non-zero msg.value before the standalone
+            // value-limit policy (sugar) could allow it. Inherit the sugar's cap so
+            // the per-use gate matches user intent; value-limit still enforces the
+            // cumulative cap on top.
+            const embeddedValueLimit = config.valueLimitPerUse ?? config.valueLimit ?? 0n;
+            if (usesArgPolicy) {
+                // One sub-expression per param, then AND across params.
+                const perParam = normalized.map((n) => {
+                    if (n.anyOf !== undefined) {
+                        const leaves = n.anyOf.map((v) => ({
+                            type: 'rule',
+                            rule: {
+                                condition: 'equal',
+                                calldataOffset: n.calldataOffset,
+                                referenceValue: toReferenceValue(v, n.abiType),
+                            },
+                        }));
+                        return leaves.length === 1 ? leaves[0] : orChain(leaves);
+                    }
+                    return {
+                        type: 'rule',
+                        rule: {
+                            condition: n.condition,
+                            calldataOffset: n.calldataOffset,
+                            referenceValue: toReferenceValue(n.value, n.abiType),
+                            ...(n.usageLimit !== undefined
+                                ? { usageLimit: n.usageLimit }
+                                : {}),
+                        },
+                    };
+                });
+                policies.push({
+                    type: 'arg-policy',
+                    valueLimitPerUse: embeddedValueLimit,
+                    expression: perParam.length === 1 ? perParam[0] : andChain(perParam),
+                });
+            }
+            else {
+                // Flat AND-of-rules — cheaper to init via UniActionPolicy.
+                const rules = normalized.map((n) => ({
+                    condition: n.condition,
+                    calldataOffset: n.calldataOffset,
+                    referenceValue: toReferenceValue(n.value, n.abiType),
+                    ...(n.usageLimit !== undefined ? { usageLimit: n.usageLimit } : {}),
+                }));
+                policies.push({
+                    type: 'universal-action',
+                    valueLimitPerUse: embeddedValueLimit,
+                    rules: rules,
+                });
+            }
         }
         else if (config.valueLimitPerUse !== undefined) {
             policies.push({
@@ -105,7 +250,36 @@ function resolvePermission(permission) {
     }
     return actions;
 }
+// Error-path only: recover the function name behind a selector for the
+// duplicate-permission message.
+function findFunctionName(permission, selector) {
+    return Object.keys(permission.functions).find((name) => {
+        const entry = permission.abi.find((e) => e.type === 'function' &&
+            e.name === name);
+        return entry !== undefined && toFunctionSelector(entry) === selector;
+    });
+}
 function resolvePermissions(permissions) {
-    return permissions.flatMap(resolvePermission);
+    // On-chain, actions are keyed by keccak(target, selector): two permission
+    // entries for the same function on the same contract share one actionId,
+    // and the later entry's `initializeWithMultiplexer` silently overwrites the
+    // earlier one's policy config. Reject at build time instead of letting the
+    // collision surface as an opaque InvalidSignature() at execution.
+    const seen = new Set();
+    return permissions.flatMap((permission) => {
+        const actions = resolvePermission(permission);
+        for (const action of actions) {
+            const key = `${action.target.toLowerCase()}:${action.selector.toLowerCase()}`;
+            if (seen.has(key)) {
+                const fnName = findFunctionName(permission, action.selector);
+                throw new Error(`Duplicate permission for function "${fnName}" (selector ${action.selector}) ` +
+                    `on ${action.target}: permission entries for the same function on the same ` +
+                    "contract share one on-chain action, so the later entry's policies would " +
+                    'silently overwrite the earlier ones. Merge them into a single entry.');
+            }
+            seen.add(key);
+        }
+        return actions;
+    });
 }
 export { resolvePermissions, resolvePermission };

package/dist/src/modules/validators/policies/claim/arbiters.d.ts

@@ -0,0 +1,19 @@
+import type { Address } from 'viem';
+import type { CrossChainSettlementLayer } from '../../smart-sessions/types.js';
+/**
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
+ *
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
+ *
+ * @param layers   Settlement layers the session is permitted to use.
+ *                 Empty/undefined ⇒ all supported layers.
+ * @param useDevContracts  Pull from the dev address book instead of mainnet.
+ */
+export declare function getArbitersForSettlementLayers(layers: readonly CrossChainSettlementLayer[] | undefined, useDevContracts?: boolean): Address[] | undefined;
+//# sourceMappingURL=arbiters.d.ts.map

package/dist/src/modules/validators/policies/claim/arbiters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAoD3E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA6BvB"}

package/dist/src/modules/validators/policies/claim/arbiters.js

@@ -0,0 +1,82 @@
+/**
+ * The arbiter contract keys that each settlement layer expands to. `ACROSS`
+ * whitelists both arbiter impls so a session is permissioned for the 7579 and
+ * multicall paths regardless of which one the orchestrator picks at intent time.
+ */
+const SETTLEMENT_LAYER_CONTRACT_KEYS = {
+    SAME_CHAIN: ['samechainArbiter'],
+    ECO: ['ecoArbiter'],
+    ACROSS: ['across7579Arbiter', 'acrossMulticallArbiter'],
+};
+/**
+ * Bundled arbiter allow-set — the deployed arbiter addresses per key, per
+ * environment (the union across chains).
+ *
+ * v2: this is a small, signed-path **constant** bundled in the SDK rather than
+ * read from `@rhinestone/shared-configs`. The arbiter is baked into the user's
+ * Permit2 session signature, so it must stay **client-trusted** — never sourced
+ * from the orchestrator you transact against. Rhinestone's arbiters are CREATE2
+ * and near-uniform across chains, so this is a handful of addresses per key
+ * (e.g. `ecoArbiter` has a mainnet and a testnet address). A new *chain* reuses
+ * these; only a contract redeploy or a new settlement layer changes them.
+ */
+const ARBITER_ADDRESSES = {
+    prod: {
+        samechainArbiter: ['0x000000000006e2569CaF8Ff021810790e0A0D740'],
+        ecoArbiter: [
+            '0x2e7627CCfAe4eDb336eEb5a70f08415B0F1a2b8C',
+            '0xA212A6ACCC8db0e4cdf4394D0A851c70Fc27A8F0',
+        ],
+        across7579Arbiter: ['0x28a4D41776968c1201A807ec51fFB405362B8882'],
+        acrossMulticallArbiter: ['0xA162fabb9a0EeF2736485A587aAAB3d015e14224'],
+    },
+    dev: {
+        samechainArbiter: ['0x8fA7720Eee299223f25De8DC03C68A28541dCD10'],
+        ecoArbiter: [
+            '0x1BeBAfb3D05d84A5Bfd94800c88d1342f755d8AB',
+            '0x8A061029AE4c5Cf69b5368119B3b0C80B31F55fE',
+        ],
+        across7579Arbiter: ['0x1b19973F7a29E950ad4FaF8872745B6378005517'],
+        acrossMulticallArbiter: ['0x8343FBBA0526deC1c952A098057021027648bcf9'],
+    },
+};
+/**
+ * Collects every distinct arbiter address for the given settlement layers. The
+ * resulting whitelist is what the Permit2 claim policy enforces on-chain — a
+ * session signed once with this whitelist is valid against any of those
+ * arbiters.
+ *
+ * **"Any" means any of the *supported* settlement layers**, not any address on
+ * earth. When `layers` is empty or undefined, this expands to the union of
+ * every layer in {@link SETTLEMENT_LAYER_CONTRACT_KEYS}, so the on-chain arbiter
+ * check stays meaningful (the worst case is still a Rhinestone-blessed arbiter).
+ *
+ * @param layers   Settlement layers the session is permitted to use.
+ *                 Empty/undefined ⇒ all supported layers.
+ * @param useDevContracts  Pull from the dev address book instead of mainnet.
+ */
+export function getArbitersForSettlementLayers(layers, useDevContracts) {
+    const effectiveLayers = !layers || layers.length === 0
+        ? Object.keys(SETTLEMENT_LAYER_CONTRACT_KEYS)
+        : layers;
+    const book = ARBITER_ADDRESSES[useDevContracts ? 'dev' : 'prod'];
+    const keys = effectiveLayers.flatMap((l) => SETTLEMENT_LAYER_CONTRACT_KEYS[l]);
+    const seen = new Set();
+    const addresses = [];
+    // The same logical arbiter often shares an address across chains, but a given
+    // key may have multiple addresses live (e.g. a mainnet + testnet deployment).
+    // Collect every unique address for the requested keys, deduped
+    // case-insensitively.
+    for (const key of keys) {
+        // `keys` are `SETTLEMENT_LAYER_CONTRACT_KEYS` values, so `book` always has
+        // an entry for each — no missing-key fallback needed.
+        for (const addr of book[key]) {
+            const norm = addr.toLowerCase();
+            if (seen.has(norm))
+                continue;
+            seen.add(norm);
+            addresses.push(addr);
+        }
+    }
+    return addresses.length ? addresses : undefined;
+}

package/dist/src/modules/validators/resolve.d.ts

@@ -0,0 +1,5 @@
+import type { ResolvedModule } from '../types.js';
+import type { AtomicValidatorDefinition, ResolvedValidatorDefinition } from './types.js';
+export declare function resolveAtomicValidator(definition: AtomicValidatorDefinition): ResolvedModule;
+export declare function resolveValidator(definition: ResolvedValidatorDefinition): ResolvedModule;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/src/modules/validators/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../modules/validators/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,SAAS,CAAA;AAGhB,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,yBAAyB,GACpC,cAAc,CAYhB;AAED,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,2BAA2B,GACtC,cAAc,CAIhB"}

package/dist/src/modules/validators/resolve.js

@@ -0,0 +1,22 @@
+import { resolveEnsValidator } from './ens.js';
+import { resolveMultiFactorValidator } from './multi-factor.js';
+import { resolveOwnableValidator } from './ownable.js';
+import { resolveWebauthnValidator } from './webauthn.js';
+export function resolveAtomicValidator(definition) {
+    switch (definition.kind) {
+        case 'ecdsa':
+            return resolveOwnableValidator(definition);
+        case 'ens':
+            return resolveEnsValidator(definition);
+        case 'passkey':
+            return resolveWebauthnValidator(definition);
+        case 'k1':
+        case 'smart-session':
+            throw new Error(`Validator ${definition.kind} requires feature input`);
+    }
+}
+export function resolveValidator(definition) {
+    return definition.kind === 'multi-factor'
+        ? resolveMultiFactorValidator(definition, resolveAtomicValidator)
+        : resolveAtomicValidator(definition);
+}

package/dist/src/modules/validators/signer-id.d.ts

@@ -0,0 +1,5 @@
+import type { Account, Address, Hex } from 'viem';
+import type { WebAuthnAccount } from 'viem/account-abstraction';
+export declare function ecdsaSignerId(account: Account | Address): string;
+export declare function webauthnSignerId(account: WebAuthnAccount | Hex): string;
+//# sourceMappingURL=signer-id.d.ts.map

package/dist/src/modules/validators/signer-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-id.d.ts","sourceRoot":"","sources":["../../../../modules/validators/signer-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAGhE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,GAAG,GAAG,MAAM,CAGvE"}

package/dist/src/modules/validators/signer-id.js

@@ -0,0 +1,8 @@
+export function ecdsaSignerId(account) {
+    const address = typeof account === 'string' ? account : account.address;
+    return `ecdsa:${address.toLowerCase()}`;
+}
+export function webauthnSignerId(account) {
+    const publicKey = typeof account === 'string' ? account : account.publicKey;
+    return `webauthn:${publicKey.toLowerCase()}`;
+}

package/dist/src/modules/validators/smart-session-signature-types.d.ts

@@ -0,0 +1,35 @@
+import type { Address, Hex } from 'viem';
+interface SmartSessionPolicyData {
+    readonly policy: Address;
+    readonly initData: Hex;
+}
+interface SmartSessionActionData {
+    readonly actionTargetSelector: Hex;
+    readonly actionTarget: Address;
+    readonly actionPolicies: readonly SmartSessionPolicyData[];
+}
+interface SmartSessionErc7739PolicyData {
+    readonly allowedERC7739Content: readonly {
+        readonly appDomainSeparator: Hex;
+        readonly contentNames: readonly string[];
+    }[];
+    readonly erc1271Policies: readonly SmartSessionPolicyData[];
+}
+export interface SmartSessionEnableContributionData {
+    readonly userSignature: Hex;
+    readonly hashesAndChainIds: readonly {
+        readonly chainId: bigint;
+        readonly sessionDigest: Hex;
+    }[];
+    readonly sessionToEnableIndex: number;
+    readonly session: {
+        readonly sessionValidator: Address;
+        readonly sessionValidatorInitData: Hex;
+        readonly salt: Hex;
+        readonly erc7739Policies: SmartSessionErc7739PolicyData;
+        readonly actions: readonly SmartSessionActionData[];
+        readonly claimPolicies: readonly SmartSessionPolicyData[];
+    };
+}
+export {};
+//# sourceMappingURL=smart-session-signature-types.d.ts.map

package/dist/src/modules/validators/smart-session-signature-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-session-signature-types.d.ts","sourceRoot":"","sources":["../../../../modules/validators/smart-session-signature-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAExC,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAA;CACvB;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAA;IAClC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC3D;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QACvC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAA;QAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KACzC,EAAE,CAAA;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAC5D;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS;QACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAA;KAC5B,EAAE,CAAA;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;QAClC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAA;QACtC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;QAClB,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAA;QACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAA;QACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;KAC1D,CAAA;CACF"}

package/dist/src/modules/validators/smart-session-signature-types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/modules/validators/smart-sessions/authorization.d.ts

@@ -0,0 +1,99 @@
+import { type Address } from 'viem';
+import type { Session, SessionDetails } from './types.js';
+export declare const SESSION_LOCK_TAG: "0x000000000000000000000000";
+export declare const types: {
+    readonly PolicyData: readonly [{
+        readonly name: "policy";
+        readonly type: "address";
+    }, {
+        readonly name: "initData";
+        readonly type: "bytes";
+    }];
+    readonly ActionData: readonly [{
+        readonly name: "actionTargetSelector";
+        readonly type: "bytes4";
+    }, {
+        readonly name: "actionTarget";
+        readonly type: "address";
+    }, {
+        readonly name: "actionPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly ERC7739Context: readonly [{
+        readonly name: "appDomainSeparator";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "contentName";
+        readonly type: "string[]";
+    }];
+    readonly ERC7739Data: readonly [{
+        readonly name: "allowedERC7739Content";
+        readonly type: "ERC7739Context[]";
+    }, {
+        readonly name: "erc1271Policies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly LockTagData: readonly [{
+        readonly name: "lockTag";
+        readonly type: "bytes12";
+    }, {
+        readonly name: "claimPolicies";
+        readonly type: "PolicyData[]";
+    }];
+    readonly SignedPermissions: readonly [{
+        readonly name: "actions";
+        readonly type: "ActionData[]";
+    }, {
+        readonly name: "erc7739Policies";
+        readonly type: "ERC7739Data";
+    }, {
+        readonly name: "lockTagPolicies";
+        readonly type: "LockTagData";
+    }, {
+        readonly name: "permitGenericPolicy";
+        readonly type: "bool";
+    }];
+    readonly SignedSession: readonly [{
+        readonly name: "account";
+        readonly type: "address";
+    }, {
+        readonly name: "expires";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "permissions";
+        readonly type: "SignedPermissions";
+    }, {
+        readonly name: "salt";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "sessionValidator";
+        readonly type: "address";
+    }, {
+        readonly name: "sessionValidatorInitData";
+        readonly type: "bytes";
+    }, {
+        readonly name: "smartSessionEmissary";
+        readonly type: "address";
+    }];
+    readonly ChainSession: readonly [{
+        readonly name: "chainId";
+        readonly type: "uint64";
+    }, {
+        readonly name: "session";
+        readonly type: "SignedSession";
+    }];
+    readonly MultiChainSession: readonly [{
+        readonly name: "sessionsAndChainIds";
+        readonly type: "ChainSession[]";
+    }];
+};
+export declare function getSessionDetails(input: {
+    readonly account: Address;
+    readonly sessions: readonly Session[];
+    readonly environment: 'production' | 'development';
+    readonly readNonce: (session: Session) => Promise<bigint>;
+}): Promise<SessionDetails>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/src/modules/validators/smart-sessions/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,MAAM,CAAA;AAOb,OAAO,KAAK,EAAE,OAAO,EAAe,cAAc,EAAE,MAAM,SAAS,CAAA;AAEnE,eAAO,MAAM,gBAAgB,EAAG,4BAAqC,CAAA;AAErE,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CR,CAAA;AAyCV,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,aAAa,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,cAAc,CAAC,CA8B1B"}

package/dist/src/modules/validators/smart-sessions/authorization.js

@@ -0,0 +1,101 @@
+import { hashStruct, maxUint256, } from 'viem';
+import { getSessionData } from './digest.js';
+import { getSmartSessionEmissaryAddress } from './module.js';
+import { SMART_SESSIONS_FALLBACK_TARGET_FLAG, SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG, } from './resolve.js';
+export const SESSION_LOCK_TAG = '0x000000000000000000000000';
+export const types = {
+    PolicyData: [
+        { name: 'policy', type: 'address' },
+        { name: 'initData', type: 'bytes' },
+    ],
+    ActionData: [
+        { name: 'actionTargetSelector', type: 'bytes4' },
+        { name: 'actionTarget', type: 'address' },
+        { name: 'actionPolicies', type: 'PolicyData[]' },
+    ],
+    ERC7739Context: [
+        { name: 'appDomainSeparator', type: 'bytes32' },
+        { name: 'contentName', type: 'string[]' },
+    ],
+    ERC7739Data: [
+        { name: 'allowedERC7739Content', type: 'ERC7739Context[]' },
+        { name: 'erc1271Policies', type: 'PolicyData[]' },
+    ],
+    LockTagData: [
+        { name: 'lockTag', type: 'bytes12' },
+        { name: 'claimPolicies', type: 'PolicyData[]' },
+    ],
+    SignedPermissions: [
+        { name: 'actions', type: 'ActionData[]' },
+        { name: 'erc7739Policies', type: 'ERC7739Data' },
+        { name: 'lockTagPolicies', type: 'LockTagData' },
+        { name: 'permitGenericPolicy', type: 'bool' },
+    ],
+    SignedSession: [
+        { name: 'account', type: 'address' },
+        { name: 'expires', type: 'uint256' },
+        { name: 'nonce', type: 'uint256' },
+        { name: 'permissions', type: 'SignedPermissions' },
+        { name: 'salt', type: 'bytes32' },
+        { name: 'sessionValidator', type: 'address' },
+        { name: 'sessionValidatorInitData', type: 'bytes' },
+        { name: 'smartSessionEmissary', type: 'address' },
+    ],
+    ChainSession: [
+        { name: 'chainId', type: 'uint64' },
+        { name: 'session', type: 'SignedSession' },
+    ],
+    MultiChainSession: [{ name: 'sessionsAndChainIds', type: 'ChainSession[]' }],
+};
+function signedSession(account, data, nonce, environment) {
+    return {
+        account,
+        permissions: {
+            permitGenericPolicy: data.actions.some((action) => action.actionTarget === SMART_SESSIONS_FALLBACK_TARGET_FLAG &&
+                action.actionTargetSelector ===
+                    SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG),
+            lockTagPolicies: {
+                lockTag: SESSION_LOCK_TAG,
+                claimPolicies: data.claimPolicies,
+            },
+            erc7739Policies: {
+                allowedERC7739Content: data.erc7739Policies.allowedERC7739Content.map((content) => ({
+                    contentName: content.contentNames,
+                    appDomainSeparator: content.appDomainSeparator,
+                })),
+                erc1271Policies: data.erc7739Policies.erc1271Policies,
+            },
+            actions: data.actions,
+        },
+        sessionValidator: data.sessionValidator,
+        sessionValidatorInitData: data.sessionValidatorInitData,
+        salt: data.salt,
+        smartSessionEmissary: getSmartSessionEmissaryAddress(environment),
+        expires: maxUint256,
+        nonce,
+    };
+}
+export async function getSessionDetails(input) {
+    const nonces = await Promise.all(input.sessions.map(input.readNonce));
+    const signed = input.sessions.map((session, index) => signedSession(input.account, getSessionData(session), nonces[index], input.environment));
+    const hashesAndChainIds = signed.map((session, index) => ({
+        chainId: BigInt(input.sessions[index].chain.id),
+        sessionDigest: hashStruct({
+            types,
+            primaryType: 'SignedSession',
+            data: session,
+        }),
+    }));
+    const data = {
+        domain: { name: 'SmartSessionEmissary', version: '1' },
+        types,
+        primaryType: 'MultiChainSession',
+        message: {
+            sessionsAndChainIds: signed.map((session, index) => ({
+                chainId: BigInt(input.sessions[index].chain.id),
+                session,
+            })),
+        },
+    };
+    return { nonces, hashesAndChainIds, data };
+}