@rhinestone/sdk 2.4.0 → 2.6.0

package/dist/src/modules/validators/permissions.js

@@ -10,6 +10,88 @@ function isStaticAbiType(type) {
     }
     return false;
 }
+/** Split `T[k]` / `T[]` into element type and length (`''` when unbounded). */
+const ARRAY_SUFFIX = /^(.*)\[(\d*)\]$/;
+function withType(param, type) {
+    return { ...param, type };
+}
+function tupleComponents(param) {
+    return param.components ?? [];
+}
+/**
+ * True when the param is encoded as a 32-byte offset pointer in the head rather
+ * than inline. Mirrors the ABI spec: `bytes`, `string`, unbounded arrays, and
+ * any tuple/fixed-array transitively containing one of those.
+ */
+function isDynamicAbiParam(param) {
+    const { type } = param;
+    if (type === 'bytes' || type === 'string')
+        return true;
+    const array = ARRAY_SUFFIX.exec(type);
+    if (array) {
+        const [, elementType, length] = array;
+        if (length === '')
+            return true;
+        return isDynamicAbiParam(withType(param, elementType));
+    }
+    if (type === 'tuple')
+        return tupleComponents(param).some(isDynamicAbiParam);
+    return false;
+}
+/**
+ * Bytes this param occupies in the calldata HEAD.
+ *
+ * Not always 32: a static tuple is flattened inline (one word per leaf) and a
+ * fixed-size static array occupies `length` words. Computing offsets as
+ * `paramIndex * 32` silently mis-addresses every param that follows one of
+ * those — e.g. `f(uint256[3] a, address b)` would point at word 1 instead of
+ * word 3 and compare against array data, producing a policy that passes or
+ * fails for reasons unrelated to `b`.
+ */
+function headSize(param) {
+    if (isDynamicAbiParam(param))
+        return 32;
+    const array = ARRAY_SUFFIX.exec(param.type);
+    if (array) {
+        const [, elementType, length] = array;
+        return Number.parseInt(length, 10) * headSize(withType(param, elementType));
+    }
+    if (param.type === 'tuple') {
+        return tupleComponents(param).reduce((sum, c) => sum + headSize(c), 0);
+    }
+    return 32;
+}
+/** Byte offset of `inputs[index]` within the calldata head (past the selector). */
+function headOffset(inputs, index) {
+    let offset = 0;
+    for (let i = 0; i < index; i++)
+        offset += headSize(inputs[i]);
+    return BigInt(offset);
+}
+/**
+ * Calldata head offset of every named top-level parameter of `functionName`.
+ *
+ * Lets callers that build raw param rules (the swap venues) address arguments by
+ * name instead of hardcoding byte offsets — the offsets then follow the ABI
+ * automatically, and a signature change surfaces as a missing key rather than a
+ * rule silently pointing at the wrong word.
+ *
+ * Only single-word static params are included; anything dynamic or multi-word
+ * cannot be compared by a 32-byte reference value and is omitted.
+ */
+export function namedParamOffsets(abi, functionName) {
+    const entry = abi.find((item) => item.type === 'function' && item.name === functionName);
+    if (!entry) {
+        throw new Error(`Function "${functionName}" not found in ABI`);
+    }
+    const offsets = {};
+    entry.inputs.forEach((param, index) => {
+        if (param.name && isStaticAbiType(param.type)) {
+            offsets[param.name] = headOffset(entry.inputs, index);
+        }
+    });
+    return offsets;
+}
 function toReferenceValue(value, abiType) {
     if (abiType === 'address') {
         if (typeof value === 'string' && isAddress(value))
@@ -161,7 +243,22 @@ function resolvePermission(permission) {
                         'Permission rules only support static types ' +
                         '(address, bool, uint*, int*, bytes1–bytes32).');
                 }
-                const calldataOffset = BigInt(paramIndex) * 32n;
+                const calldataOffset = headOffset(abiEntry.inputs, paramIndex);
+                if (rule.min !== undefined || rule.max !== undefined) {
+                    if (rule.min === undefined || rule.max === undefined) {
+                        throw new Error(`Parameter "${paramName}" needs both "min" and "max" — ` +
+                            'provide the other bound, or use a single ' +
+                            '{ condition, value } comparison.');
+                    }
+                    return {
+                        paramName,
+                        calldataOffset,
+                        abiType: param.type,
+                        min: rule.min,
+                        max: rule.max,
+                        usageLimit: rule.usageLimit,
+                    };
+                }
                 if (rule.anyOf !== undefined) {
                     if (rule.anyOf.length === 0) {
                         throw new Error(`Parameter "${paramName}" has empty anyOf — provide at least one value.`);
@@ -182,7 +279,9 @@ function resolvePermission(permission) {
                     usageLimit: rule.usageLimit,
                 };
             });
-            const usesArgPolicy = normalized.some((n) => n.anyOf !== undefined);
+            // Both `anyOf` (OR chain) and `min`/`max` (AND of two rules on ONE param)
+            // need more than the flat one-rule-per-param shape UniActionPolicy offers.
+            const usesArgPolicy = normalized.some((n) => n.anyOf !== undefined || n.min !== undefined);
             // UniActionPolicy/ArgPolicy reject `msg.value > valueLimitPerUse`, so a
             // default of 0 would block any non-zero msg.value before the standalone
             // value-limit policy (sugar) could allow it. Inherit the sugar's cap so
@@ -203,6 +302,45 @@ function resolvePermission(permission) {
                         }));
                         return leaves.length === 1 ? leaves[0] : orChain(leaves);
                     }
+                    if (n.min !== undefined) {
+                        // Inclusive bounds as AND(x >= min, x <= max). Deliberately NOT the
+                        // policy's own `inRange` condition: that packs two uint128 bounds
+                        // into one bytes32 `ref`, which this SDK has no verified encoding
+                        // for. Two comparisons are exactly equivalent and use primitives
+                        // already covered by tests.
+                        //
+                        // `usageLimit` rides on the lower-bound leaf only — putting it on
+                        // both would double-count every call against the cumulative cap.
+                        const minRef = toReferenceValue(n.min, n.abiType);
+                        const maxRef = toReferenceValue(n.max, n.abiType);
+                        if (typeof minRef === 'bigint' &&
+                            typeof maxRef === 'bigint' &&
+                            minRef > maxRef) {
+                            throw new Error(`Parameter "${n.paramName}" has min (${minRef}) greater than ` +
+                                `max (${maxRef}) — no value can satisfy this rule.`);
+                        }
+                        return andChain([
+                            {
+                                type: 'rule',
+                                rule: {
+                                    condition: 'greaterThanOrEqual',
+                                    calldataOffset: n.calldataOffset,
+                                    referenceValue: minRef,
+                                    ...(n.usageLimit !== undefined
+                                        ? { usageLimit: n.usageLimit }
+                                        : {}),
+                                },
+                            },
+                            {
+                                type: 'rule',
+                                rule: {
+                                    condition: 'lessThanOrEqual',
+                                    calldataOffset: n.calldataOffset,
+                                    referenceValue: maxRef,
+                                },
+                            },
+                        ]);
+                    }
                     return {
                         type: 'rule',
                         rule: {

package/dist/src/modules/validators/policies/claim/arbiters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAoD3E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA6BvB"}
+{"version":3,"file":"arbiters.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/policies/claim/arbiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AA4D3E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,EACxD,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,EAAE,GAAG,SAAS,CA6BvB"}

package/dist/src/modules/validators/policies/claim/arbiters.js

@@ -2,6 +2,14 @@
  * The arbiter contract keys that each settlement layer expands to. `ACROSS`
  * whitelists both arbiter impls so a session is permissioned for the 7579 and
  * multicall paths regardless of which one the orchestrator picks at intent time.
+ *
+ * `ECO` intentionally remains mapped to the legacy Standard ECO arbiters. The
+ * solver-network ECO route uses `intentExecutorAdapter`, but the current claim
+ * policy only inspects the outer origin mandate. Authorizing that generic
+ * adapter would also authorize unrelated IntentExecutor-backed routes without
+ * enforcing the encoded Eco destination, token, recipient, or deadline. Keep
+ * solver-network ECO blocked by this built-in permission until a route-aware
+ * policy is available.
  */
 const SETTLEMENT_LAYER_CONTRACT_KEYS = {
     SAME_CHAIN: ['samechainArbiter'],

package/dist/src/modules/validators/resolve.d.ts

@@ -1,6 +1,12 @@
+import type { Hex } from 'viem';
 import type { ResolvedModule } from '../types.js';
 import type { AtomicValidatorDefinition, ResolvedValidatorDefinition } from './types.js';
 import { type WebauthnCredentialOrdering } from './webauthn.js';
 export declare function resolveAtomicValidator(definition: AtomicValidatorDefinition, webauthnOrdering?: WebauthnCredentialOrdering): ResolvedModule;
+export declare function resolveAtomicValidatorStatelessData(definition: AtomicValidatorDefinition): Hex;
+export declare function resolveAtomicValidatorFactor(definition: AtomicValidatorDefinition): {
+    module: ResolvedModule;
+    statelessData: `0x${string}`;
+};
 export declare function resolveValidator(definition: ResolvedValidatorDefinition, webauthnOrdering?: WebauthnCredentialOrdering): ResolvedModule;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/src/modules/validators/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../modules/validators/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,SAAS,CAAA;AAChB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,YAAY,CAAA;AAEnB,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,yBAAyB,EACrC,gBAAgB,CAAC,EAAE,0BAA0B,GAC5C,cAAc,CAYhB;AAKD,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,2BAA2B,EACvC,gBAAgB,CAAC,EAAE,0BAA0B,GAC5C,cAAc,CAIhB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../modules/validators/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,SAAS,CAAA;AAChB,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,YAAY,CAAA;AAEnB,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,yBAAyB,EACrC,gBAAgB,CAAC,EAAE,0BAA0B,GAC5C,cAAc,CAYhB;AAKD,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,yBAAyB,GACpC,GAAG,CAYL;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,yBAAyB;;;EAMtC;AAKD,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,2BAA2B,EACvC,gBAAgB,CAAC,EAAE,0BAA0B,GAC5C,cAAc,CAIhB"}

package/dist/src/modules/validators/resolve.js

@@ -1,7 +1,7 @@
-import { resolveEnsValidator } from './ens.js';
+import { encodeEnsStatelessData, resolveEnsValidator } from './ens.js';
 import { resolveMultiFactorValidator } from './multi-factor.js';
-import { resolveOwnableValidator } from './ownable.js';
-import { resolveWebauthnValidator, } from './webauthn.js';
+import { resolveOwnableStatelessData, resolveOwnableValidator } from './ownable.js';
+import { resolveWebauthnStatelessData, resolveWebauthnValidator, } from './webauthn.js';
 export function resolveAtomicValidator(definition, webauthnOrdering) {
     switch (definition.kind) {
         case 'ecdsa':
@@ -15,11 +15,33 @@ export function resolveAtomicValidator(definition, webauthnOrdering) {
             throw new Error(`Validator ${definition.kind} requires feature input`);
     }
 }
+// What a validator's `validateSignatureWithData` expects as its `data`. Only
+// Ownable's happens to equal its install data; for WebAuthn and ENS the two
+// differ, and multi-factor factor slots need this one.
+export function resolveAtomicValidatorStatelessData(definition) {
+    switch (definition.kind) {
+        case 'ecdsa':
+            return resolveOwnableStatelessData(definition);
+        case 'ens':
+            return encodeEnsStatelessData(definition);
+        case 'passkey':
+            return resolveWebauthnStatelessData(definition);
+        case 'k1':
+        case 'smart-session':
+            throw new Error(`Validator ${definition.kind} requires feature input`);
+    }
+}
+export function resolveAtomicValidatorFactor(definition) {
+    return {
+        module: resolveAtomicValidator(definition),
+        statelessData: resolveAtomicValidatorStatelessData(definition),
+    };
+}
 // `webauthnOrdering` only applies to a top-level passkey validator: multi-factor
-// stores its sub-validator data without ever calling the sub-validator's
-// `onInstall`, so the ascending rule never runs and its bytes must not move.
+// stores the stateless configuration for its factors, whose credential order is
+// fixed by the pinned account the IDs are derived from.
 export function resolveValidator(definition, webauthnOrdering) {
     return definition.kind === 'multi-factor'
-        ? resolveMultiFactorValidator(definition, resolveAtomicValidator)
+        ? resolveMultiFactorValidator(definition, resolveAtomicValidatorFactor)
         : resolveAtomicValidator(definition, webauthnOrdering);
 }

package/dist/src/modules/validators/smart-sessions/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAgC,MAAM,MAAM,CAAA;AAU3E,OAAO,EACL,wBAAwB,EAEzB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,KAAK,EAEV,OAAO,EAEP,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,eAAO,MAAM,mCAAmC,EAAE,OACJ,CAAA;AAC9C,eAAO,MAAM,4CAA4C,EAAE,GAAkB,CAAA;AAC7E,eAAO,MAAM,2EAA2E,EACtF,YAAqB,CAAA;AACvB,eAAO,MAAM,uBAAuB,EAClC,4CAAqD,CAAA;AACvD,eAAO,MAAM,yBAAyB,EAAG,YAAqB,CAAA;AAU9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,aAAa,CAAA;IAGnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,WAAW,CA0Fb;AAED,wBAAgB,SAAS,CACvB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAyBT;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAA"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../../modules/validators/smart-sessions/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAgC,MAAM,MAAM,CAAA;AAU3E,OAAO,EACL,wBAAwB,EAEzB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,KAAK,EAGV,OAAO,EAEP,WAAW,EACX,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAEhB,eAAO,MAAM,mCAAmC,EAAE,OACJ,CAAA;AAC9C,eAAO,MAAM,4CAA4C,EAAE,GAAkB,CAAA;AAC7E,eAAO,MAAM,2EAA2E,EACtF,YAAqB,CAAA;AACvB,eAAO,MAAM,uBAAuB,EAClC,4CAAqD,CAAA;AACvD,eAAO,MAAM,yBAAyB,EAAG,YAAqB,CAAA;AAU9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,aAAa,CAAA;IAGnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,WAAW,CAqMb;AAED,wBAAgB,SAAS,CACvB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAoCT;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAA"}

package/dist/src/modules/validators/smart-sessions/resolve.js

@@ -9,6 +9,7 @@ import { DEFAULT_POLICY_ADDRESSES, resolvePolicyAddresses, } from './policies/ad
 import { expandCrossChainPermit, resolvePermit2ClaimPolicy, } from './policies/claim.js';
 import { encodeSessionPolicy } from './policies/encode.js';
 import { resolveSessionSigning } from './signing.js';
+import { resolveSwapScope } from './swap/scope.js';
 export const SMART_SESSIONS_FALLBACK_TARGET_FLAG = '0x0000000000000000000000000000000000000001';
 export const SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG = '0x00000001';
 export const SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG_PERMITTED_TO_CALL_SMARTSESSION = '0x00000002';
@@ -31,16 +32,73 @@ export function resolveSessionData(definition, options = {}) {
         actionTarget: SMART_SESSIONS_FALLBACK_TARGET_FLAG,
         actionPolicies: [{ policy: addresses.sudo, initData: '0x' }],
     };
-    const userActions = definition.permissions?.length
-        ? resolvePermissions(definition.permissions)
-        : [];
+    // `swap` is sugar over permissions + actions: it compiles to one merged
+    // approve plus one scoped swap action per venue, then rides the same
+    // resolution path. Venue routers, selectors and calldata offsets stay inside
+    // swap-venues.ts so they never reach the public surface (RHI-6286).
+    const swapScope = definition.swap
+        ? resolveSwapScope(definition.swap, definition.chain.id, environment)
+        : undefined;
+    // Declaring `swap` IS the restriction — a swap-scoped session that still
+    // carried the wildcard fallback would let the session key call anything the
+    // global intent-execution whitelist allows, which is the opposite of what the
+    // caller asked for. `restrictToActions` stays as the explicit spelling for
+    // sessions scoped by hand.
+    const restricted = definition.restrictToActions === true || swapScope !== undefined;
+    const permissions = [
+        ...(definition.permissions ?? []),
+        ...(swapScope?.permissions ?? []),
+    ];
+    const userActions = permissions.length ? resolvePermissions(permissions) : [];
+    // Raw scoped actions (target + selector + policies) for calls that can't be
+    // addressed by the ABI-name `permissions` sugar — e.g. a fynd swap scoped by
+    // its raw selector with no ABI (RHI-6286).
+    const rawActions = [
+        ...(definition.actions ?? []),
+        ...(swapScope?.actions ?? []),
+    ];
+    // A restricted session drops the fallback action, which is also where a
+    // cross-chain permit's spending-limit / time-frame guardrails live — so a
+    // restricted session combined with a permit would keep claim signing but lose
+    // maxAmount/deadline enforcement. These are different authorization surfaces;
+    // reject the combination rather than silently drop the guardrails.
+    if (restricted &&
+        (definition.crossChainPermits?.length || definition.claimPolicies?.length)) {
+        throw new Error('restrictToActions is incompatible with crossChainPermits/claimPolicies: ' +
+            'dropping the fallback also drops the permit guardrails (spending/time ' +
+            'limits). Use a restricted scoped-action session or a permit session, ' +
+            'not both.');
+    }
+    // Guard raw actions from reintroducing the wildcard: reject one without
+    // target+selector (would map to the fallback flags), or one that targets the
+    // fallback sentinel outright — either would re-add the wildcard action that
+    // restrictToActions drops.
+    for (const a of rawActions) {
+        if (!('target' in a) || !('selector' in a)) {
+            throw new Error('definition.actions entries must be scoped (target + selector); a ' +
+                'fallback-shaped action would map to the wildcard fallback target');
+        }
+        if (a.target.toLowerCase() ===
+            SMART_SESSIONS_FALLBACK_TARGET_FLAG.toLowerCase()) {
+            throw new Error('definition.actions must not target the fallback sentinel ' +
+                `(${SMART_SESSIONS_FALLBACK_TARGET_FLAG}) — it reintroduces the wildcard action`);
+        }
+    }
     const expandedPermits = (definition.crossChainPermits ?? []).map((input) => expandCrossChainPermit(resolveCrossChainPermission(input), environment));
     const permitFallbackPolicies = expandedPermits.flatMap(({ fallbackPolicies }) => fallbackPolicies);
+    // The wildcard intent-execution fallback. Dropped for a restricted session so
+    // the explicit permissions are the ONLY authorized ops — a non-listed selector
+    // then reverts instead of escaping via the global intent-execution target
+    // whitelist (RHI-6286).
+    const fallbackAction = {
+        policies: [{ type: 'intent-execution' }, ...permitFallbackPolicies],
+    };
     const injectedActions = [
         // Native-wrap `deposit()` is only permitted when the caller supplies the
         // chain's wrapped-native token (e.g. via `RhinestoneSDK.createSession`,
-        // which resolves it from `/chains`).
-        ...(options.wrappedNativeToken
+        // which resolves it from `/chains`). Dropped for a restricted session so it
+        // can't add an unrequested sudo action beyond the caller's permissions.
+        ...(options.wrappedNativeToken && !restricted
             ? [
                 {
                     target: options.wrappedNativeToken,
@@ -54,17 +112,45 @@ export function resolveSessionData(definition, options = {}) {
                 },
             ]
             : []),
-        {
-            policies: [{ type: 'intent-execution' }, ...permitFallbackPolicies],
-        },
+        ...(restricted ? [] : [fallbackAction]),
         {
             target: DUMMY_PRECLAIMOP_TARGET,
             selector: DUMMY_PRECLAIMOP_SELECTOR,
-            policies: [{ type: 'sudo' }],
+            // The real pre-claim op carries no value, so cap it for a restricted
+            // session rather than granting sudo, which would let this injected action
+            // send native value to the dummy target.
+            //
+            // 1 wei, NOT 0: `ValueLimitPolicy.initializeWithMultiplexer` does
+            // `require(valueLimit != 0)`, so a zero limit reverts while the policy is
+            // being installed. That made every restricted session impossible to
+            // enable — the revert surfaces as `InvalidSignature()` from the emissary,
+            // which reads as a signature problem rather than a policy-init one.
+            // 1 wei is the smallest limit that installs, and the op carries no value.
+            policies: restricted
+                ? [{ type: 'value-limit', limit: 1n }]
+                : [{ type: 'sudo' }],
         },
     ];
-    const actions = userActions.length || permitFallbackPolicies.length
-        ? [...userActions, ...injectedActions].map((action) => ({
+    if (restricted && !userActions.length && !rawActions.length) {
+        throw new Error('restrictToActions drops the fallback, so the session must supply at ' +
+            'least one permission or action — none were given');
+    }
+    // Raw actions bypass resolvePermissions' duplicate guard, so a raw action that
+    // collides with an ABI permission (or another raw action) on the same
+    // (target, selector) would map to the same on-chain action id and silently
+    // overwrite policy config — reject it instead.
+    const scoped = [...userActions, ...rawActions].filter((a) => 'target' in a && 'selector' in a);
+    const seen = new Set();
+    for (const a of scoped) {
+        const key = `${a.target.toLowerCase()}:${a.selector.toLowerCase()}`;
+        if (seen.has(key)) {
+            throw new Error(`Duplicate scoped action for (${a.target}, ${a.selector}) — permissions ` +
+                'and actions share one on-chain action id; merge them into a single entry');
+        }
+        seen.add(key);
+    }
+    const actions = userActions.length || rawActions.length || permitFallbackPolicies.length
+        ? [...userActions, ...rawActions, ...injectedActions].map((action) => ({
             actionTargetSelector: 'selector' in action
                 ? action.selector
                 : SMART_SESSIONS_FALLBACK_TARGET_SELECTOR_FLAG,
@@ -81,8 +167,12 @@ export function resolveSessionData(definition, options = {}) {
         policy: PERMIT2_CLAIM_POLICY_ADDRESS,
         initData: encodePermit2ClaimPolicyInitData(resolvePermit2ClaimPolicy(policy)),
     }));
+    // A restricted session must not leave an open ERC-1271 signing surface: with
+    // signing defaulting to unrestricted, a session key limited to swap/approve
+    // could still sign e.g. a Permit2 approval off-chain and move funds. Default it
+    // to `disabled` when restricting; the caller can still opt into a signing policy.
     const erc7739Policies = resolveSessionSigning({
-        signing: definition.signing,
+        signing: definition.signing ?? (restricted ? { mode: 'disabled' } : undefined),
         environment,
         addresses,
     });
@@ -108,7 +198,15 @@ export function toSession(definition, options = {}) {
     return {
         chain: definition.chain,
         owners: definition.owners,
-        hasExplicitPermissions: Boolean(definition.permissions?.length),
+        // Drives `verifyExecutions`, which selects the signature mode: false lets an
+        // already-enabled session sign in pure ERC-1271 mode, and that mode never
+        // reaches the emissary's `verifyExecution` — so the action policies are
+        // never consulted. `swap` compiles to actions, so it MUST count here, or a
+        // swap-only session would silently stop being action-checked the moment it
+        // is enabled.
+        hasExplicitPermissions: Boolean(definition.permissions?.length ||
+            definition.actions?.length ||
+            definition.swap),
         permissionId: getPermissionIdFromData(data),
         sessionValidator: data.sessionValidator,
         sessionValidatorInitData: data.sessionValidatorInitData,
@@ -116,6 +214,7 @@ export function toSession(definition, options = {}) {
         erc7739Policies: data.erc7739Policies,
         actions: data.actions,
         claimPolicies: [...(definition.claimPolicies ?? []), ...expandedClaims],
+        ...(definition.swap ? { swap: definition.swap } : {}),
     };
 }
 export { DEFAULT_POLICY_ADDRESSES };

package/dist/src/modules/validators/smart-sessions/swap/fynd.d.ts

@@ -0,0 +1,92 @@
+import { type Address } from 'viem';
+import type { FyndVenue } from '../types.js';
+import type { VenueContext, VenueScoping } from './rules.js';
+/**
+ * fynd — Rhinestone's self-hosted Tycho aggregator.
+ *
+ * Unlike 0x there is no allowance-holder indirection: the TychoRouter is both
+ * the swap target and the ERC-20 approval spender, and every field we care about
+ * is a named static argument in the calldata head. That means nothing here is a
+ * magic offset — the rules are addressed by ABI parameter name.
+ */
+/** Chains with a deployed, whitelisted TychoRouter. */
+export declare const FYND_CHAIN_IDS: readonly [1, 56, 130, 137, 8453, 9745, 42161];
+export type FyndChainId = (typeof FYND_CHAIN_IDS)[number];
+/**
+ * TychoRouter per chain — the contract fynd's encoded fills target.
+ *
+ * Mirrors `fynd.routers` in the orchestrator's quoters.jsonnet. A chain is
+ * listed only when the router is whitelisted in `IntentExecutionPolicy`, since a
+ * quoter enabled without a whitelisted target produces quotes that revert.
+ */
+export declare const FYND_ROUTERS: Record<FyndChainId, Address>;
+/**
+ * TychoRouter `singleSwap`, the entrypoint fynd's encoded quotes call.
+ *
+ * Only the argument TYPES determine the selector and the head layout, and those
+ * are pinned by {@link FYND_SWAP_SELECTOR}'s assertion in the test suite. The
+ * NAMES of the first five are corroborated by observed fynd calldata; the
+ * trailing tuple's component names are our own labels and carry no guarantee —
+ * we never address them, since a tuple containing `bytes` is dynamic and sits
+ * behind a pointer.
+ */
+export declare const tychoRouterAbi: readonly [{
+    readonly type: "function";
+    readonly name: "singleSwap";
+    readonly stateMutability: "payable";
+    readonly inputs: readonly [{
+        readonly name: "amountIn";
+        readonly type: "uint256";
+    }, {
+        readonly name: "tokenIn";
+        readonly type: "address";
+    }, {
+        readonly name: "tokenOut";
+        readonly type: "address";
+    }, {
+        readonly name: "minAmountOut";
+        readonly type: "uint256";
+    }, {
+        readonly name: "receiver";
+        readonly type: "address";
+    }, {
+        readonly name: "permit";
+        readonly type: "tuple";
+        readonly components: readonly [{
+            readonly name: "nonce";
+            readonly type: "uint16";
+        }, {
+            readonly name: "token";
+            readonly type: "address";
+        }, {
+            readonly name: "amount";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }, {
+            readonly name: "signature";
+            readonly type: "bytes";
+        }];
+    }, {
+        readonly name: "swap";
+        readonly type: "bytes";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "amountOut";
+        readonly type: "uint256";
+    }];
+}];
+export declare const FYND_SWAP_SELECTOR: `0x${string}`;
+/**
+ * Scope a session to fynd swaps.
+ *
+ * Needs no addresses: the router is a per-chain deployment the SDK knows, and
+ * because it is also the approval spender there is no separate allowance target
+ * to reason about.
+ */
+export declare function fynd(options?: {
+    maxSpend?: bigint;
+}): FyndVenue;
+export declare function scopeFynd(ctx: VenueContext): VenueScoping;
+//# sourceMappingURL=fynd.d.ts.map

package/dist/src/modules/validators/smart-sessions/swap/fynd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fynd.d.ts","sourceRoot":"","sources":["../../../../../../modules/validators/smart-sessions/swap/fynd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,OAAO,EAAsB,MAAM,MAAM,CAAA;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAkC,MAAM,UAAU,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGzD;;;;;;;GAOG;AAEH,uDAAuD;AACvD,eAAO,MAAM,cAAc,+CAAgD,CAAA;AAE3E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAQrD,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BH,CAAA;AAExB,eAAO,MAAM,kBAAkB,eAAwC,CAAA;AAQvE;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,SAAS,CAKnE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CAoBzD"}

package/dist/src/modules/validators/smart-sessions/swap/fynd.js

@@ -0,0 +1,101 @@
+import { toFunctionSelector } from 'viem';
+import { namedParamOffsets } from '../../permissions.js';
+import { cumulativeCap, pin, swapAction } from './rules.js';
+/**
+ * fynd — Rhinestone's self-hosted Tycho aggregator.
+ *
+ * Unlike 0x there is no allowance-holder indirection: the TychoRouter is both
+ * the swap target and the ERC-20 approval spender, and every field we care about
+ * is a named static argument in the calldata head. That means nothing here is a
+ * magic offset — the rules are addressed by ABI parameter name.
+ */
+/** Chains with a deployed, whitelisted TychoRouter. */
+export const FYND_CHAIN_IDS = [1, 56, 130, 137, 8453, 9745, 42161];
+/**
+ * TychoRouter per chain — the contract fynd's encoded fills target.
+ *
+ * Mirrors `fynd.routers` in the orchestrator's quoters.jsonnet. A chain is
+ * listed only when the router is whitelisted in `IntentExecutionPolicy`, since a
+ * quoter enabled without a whitelisted target produces quotes that revert.
+ */
+export const FYND_ROUTERS = {
+    1: '0xda892c989d07a18b5dd3f392d949f00df15c5736',
+    56: '0x99748cbd931cb367dad265c5b2b4bd306d448e99',
+    130: '0x764bc67b1036b00bc91221e988261f971a1c7ce4',
+    137: '0x7cb3e87095f6cf95982dc6f57445171a6d3b511c',
+    8453: '0x2d3524b9b5dae34b646614eebb1e038d403e4cac',
+    9745: '0x8f9b3b0451efff0ae8100428aee35fa3cbc0b769',
+    42161: '0xc1f838a5382bbb5729a0801c8ba73dfc861c4d34',
+};
+/**
+ * TychoRouter `singleSwap`, the entrypoint fynd's encoded quotes call.
+ *
+ * Only the argument TYPES determine the selector and the head layout, and those
+ * are pinned by {@link FYND_SWAP_SELECTOR}'s assertion in the test suite. The
+ * NAMES of the first five are corroborated by observed fynd calldata; the
+ * trailing tuple's component names are our own labels and carry no guarantee —
+ * we never address them, since a tuple containing `bytes` is dynamic and sits
+ * behind a pointer.
+ */
+export const tychoRouterAbi = [
+    {
+        type: 'function',
+        name: 'singleSwap',
+        stateMutability: 'payable',
+        inputs: [
+            { name: 'amountIn', type: 'uint256' },
+            { name: 'tokenIn', type: 'address' },
+            { name: 'tokenOut', type: 'address' },
+            { name: 'minAmountOut', type: 'uint256' },
+            { name: 'receiver', type: 'address' },
+            {
+                name: 'permit',
+                type: 'tuple',
+                components: [
+                    { name: 'nonce', type: 'uint16' },
+                    { name: 'token', type: 'address' },
+                    { name: 'amount', type: 'uint256' },
+                    { name: 'deadline', type: 'uint256' },
+                    { name: 'signature', type: 'bytes' },
+                ],
+            },
+            { name: 'swap', type: 'bytes' },
+        ],
+        outputs: [{ name: 'amountOut', type: 'uint256' }],
+    },
+];
+export const FYND_SWAP_SELECTOR = toFunctionSelector(tychoRouterAbi[0]);
+/** Head offsets derived from the ABI — never hardcoded. */
+const OFFSETS = namedParamOffsets(tychoRouterAbi, 'singleSwap');
+/**
+ * Scope a session to fynd swaps.
+ *
+ * Needs no addresses: the router is a per-chain deployment the SDK knows, and
+ * because it is also the approval spender there is no separate allowance target
+ * to reason about.
+ */
+export function fynd(options = {}) {
+    return {
+        id: 'fynd',
+        ...(options.maxSpend !== undefined ? { maxSpend: options.maxSpend } : {}),
+    };
+}
+export function scopeFynd(ctx) {
+    const router = FYND_ROUTERS[ctx.chainId];
+    if (router === undefined) {
+        throw new Error(`fynd is not available on chain ${ctx.chainId}. ` +
+            `Supported: ${FYND_CHAIN_IDS.join(', ')}.`);
+    }
+    const rules = [
+        pin(OFFSETS.tokenIn, ctx.sellToken),
+        pin(OFFSETS.tokenOut, ctx.buyToken),
+        pin(OFFSETS.receiver, ctx.recipient),
+    ];
+    if (ctx.cap !== undefined) {
+        rules.push(cumulativeCap(OFFSETS.amountIn, ctx.cap));
+    }
+    return {
+        approveSpenders: [router],
+        actions: [swapAction(router, FYND_SWAP_SELECTOR, rules)],
+    };
+}