@rhinestone/shared-configs 2.0.1 → 2.1.1

package/dist/scripts/audit-token-authorizations.js

@@ -0,0 +1,541 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const viem_1 = require("viem");
+const accounts_1 = require("viem/accounts");
+const index_1 = require("../src/index");
+const probeAbi = (0, viem_1.parseAbi)([
+    'function DOMAIN_SEPARATOR() view returns (bytes32)',
+    'function nonces(address) view returns (uint256)',
+    'function authorizationState(address,bytes32) view returns (bool)',
+    'function implementation() view returns (address)',
+    'function getFacet(bytes4) view returns (address)',
+    'function PERMIT_TYPEHASH() view returns (bytes32)',
+    'function TRANSFER_WITH_AUTHORIZATION_TYPEHASH() view returns (bytes32)',
+    'function RECEIVE_WITH_AUTHORIZATION_TYPEHASH() view returns (bytes32)',
+]);
+const permitAbi = (0, viem_1.parseAbi)([
+    'function permit(address,address,uint256,uint256,uint8,bytes32,bytes32)',
+    'function permit(address,address,uint256,uint256,bytes)',
+]);
+const authorizationAbi = (0, viem_1.parseAbi)([
+    'function receiveWithAuthorization(address,address,uint256,uint256,uint256,bytes32,uint8,bytes32,bytes32)',
+    'function receiveWithAuthorization(address,address,uint256,uint256,uint256,bytes32,bytes)',
+]);
+const erc1271Abi = (0, viem_1.parseAbi)([
+    'function isValidSignature(bytes32,bytes) view returns (bytes4)',
+]);
+const selectors = {
+    permit: (0, viem_1.toFunctionSelector)('permit(address,address,uint256,uint256,uint8,bytes32,bytes32)'),
+    authorizationState: (0, viem_1.toFunctionSelector)('authorizationState(address,bytes32)'),
+    transferWithAuthorization: (0, viem_1.toFunctionSelector)('transferWithAuthorization(address,address,uint256,uint256,uint256,bytes32,uint8,bytes32,bytes32)'),
+    receiveWithAuthorization: (0, viem_1.toFunctionSelector)('receiveWithAuthorization(address,address,uint256,uint256,uint256,bytes32,uint8,bytes32,bytes32)'),
+    permitBytes: (0, viem_1.toFunctionSelector)('permit(address,address,uint256,uint256,bytes)'),
+    transferWithAuthorizationBytes: (0, viem_1.toFunctionSelector)('transferWithAuthorization(address,address,uint256,uint256,uint256,bytes32,bytes)'),
+    receiveWithAuthorizationBytes: (0, viem_1.toFunctionSelector)('receiveWithAuthorization(address,address,uint256,uint256,uint256,bytes32,bytes)'),
+};
+const expectedTypehashes = {
+    permit: (0, viem_1.keccak256)((0, viem_1.toBytes)('Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)')),
+    transferWithAuthorization: (0, viem_1.keccak256)((0, viem_1.toBytes)('TransferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)')),
+    receiveWithAuthorization: (0, viem_1.keccak256)((0, viem_1.toBytes)('ReceiveWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)')),
+};
+const EIP1967_IMPLEMENTATION_SLOT = '0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc';
+const LEGACY_ZEPPELIN_IMPLEMENTATION_SLOT = '0x7050c9e0f4ca769c69bd3a8ef740bc37934f8e2c036e5a723fd8ee048ed3f8c3';
+const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000';
+const ZERO_BYTES32 = `0x${'00'.repeat(32)}`;
+const MAX_UINT256 = (1n << 256n) - 1n;
+const ERC1271_MAGIC_VALUE = '0x1626ba7e';
+// Runtime that returns the ERC-1271 magic value for every call. The audit
+// installs it at a fresh address through eth_call state overrides, so the
+// token must actually call owner.isValidSignature(...) to accept a signature
+// that cannot recover to the owner address.
+const ERC1271_ALWAYS_VALID_RUNTIME = `0x7f${ERC1271_MAGIC_VALUE.slice(2)}${'00'.repeat(28)}60005260206000f3`;
+// Fresh throwaway signer used only for eth_call. It never sends a transaction
+// or receives funds, so its permit nonce and ERC-3009 authorization are unused.
+const auditPrivateKeyBytes = new Uint8Array(32);
+crypto.getRandomValues(auditPrivateKeyBytes);
+const AUDIT_SIGNER = (0, accounts_1.privateKeyToAccount)((0, viem_1.toHex)(auditPrivateKeyBytes));
+const auditContractBytes = new Uint8Array(32);
+crypto.getRandomValues(auditContractBytes);
+const AUDIT_CONTRACT = (0, accounts_1.privateKeyToAccount)((0, viem_1.toHex)(auditContractBytes)).address;
+// The registry endpoint currently rate-limits this audit's method volume. The
+// fallback is public and read-only; TOKEN_AUTH_AUDIT_RPC_<chainId> can override
+// any chain without changing shared config.
+const rpcFallbacks = {
+    '1': ['https://ethereum-rpc.publicnode.com'],
+    '56': ['https://bsc-rpc.publicnode.com'],
+    '130': ['https://unichain-rpc.publicnode.com'],
+    '8453': ['https://base-rpc.publicnode.com'],
+    '11155111': ['https://ethereum-sepolia-rpc.publicnode.com'],
+};
+function addressFromWord(word) {
+    if (!word || word === ZERO_BYTES32)
+        return undefined;
+    const candidate = (0, viem_1.getAddress)(`0x${word.slice(-40)}`);
+    return candidate === ZERO_ADDRESS ? undefined : candidate;
+}
+function codeContains(code, value) {
+    return code.toLowerCase().includes(value.slice(2).toLowerCase());
+}
+async function probeRead(fn) {
+    try {
+        return await fn();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function callSucceeds(label, fn) {
+    try {
+        await fn();
+        return true;
+    }
+    catch (error) {
+        const detail = error && typeof error === 'object' && 'shortMessage' in error
+            ? [
+                String(error.shortMessage),
+                'details' in error ? String(error.details) : '',
+                'cause' in error &&
+                    error.cause &&
+                    typeof error.cause === 'object' &&
+                    'message' in error.cause
+                    ? String(error.cause.message)
+                    : '',
+            ]
+                .filter(Boolean)
+                .join(' — ')
+            : String(error);
+        console.error(`SIMULATION ${label}: ${detail}`);
+        return false;
+    }
+}
+function erc1271StateOverride() {
+    return [
+        {
+            address: AUDIT_CONTRACT,
+            code: ERC1271_ALWAYS_VALID_RUNTIME,
+        },
+    ];
+}
+async function verifyErc1271StateOverride(client, blockNumber) {
+    const data = (0, viem_1.encodeFunctionData)({
+        abi: erc1271Abi,
+        functionName: 'isValidSignature',
+        args: [ZERO_BYTES32, '0x'],
+    });
+    try {
+        const result = await client.call({
+            account: AUDIT_SIGNER.address,
+            to: AUDIT_CONTRACT,
+            data,
+            blockNumber,
+            stateOverride: erc1271StateOverride(),
+        });
+        return result.data?.slice(0, 10).toLowerCase() === ERC1271_MAGIC_VALUE;
+    }
+    catch (error) {
+        const detail = error && typeof error === 'object' && 'shortMessage' in error
+            ? String(error.shortMessage)
+            : String(error);
+        console.error(`STATE OVERRIDE ERC-1271 probe failed: ${detail}`);
+        return false;
+    }
+}
+async function simulatePermit(client, blockNumber, token, authorization, signatureMode) {
+    const owner = signatureMode === 'erc1271' ? AUDIT_CONTRACT : AUDIT_SIGNER.address;
+    const deadline = MAX_UINT256;
+    const signature = await AUDIT_SIGNER.signTypedData({
+        domain: authorization.domain,
+        types: {
+            Permit: [
+                { name: 'owner', type: 'address' },
+                { name: 'spender', type: 'address' },
+                { name: 'value', type: 'uint256' },
+                { name: 'nonce', type: 'uint256' },
+                { name: 'deadline', type: 'uint256' },
+            ],
+        },
+        primaryType: 'Permit',
+        message: {
+            owner,
+            spender: AUDIT_SIGNER.address,
+            value: 0n,
+            nonce: 0n,
+            deadline,
+        },
+    });
+    const parsed = (0, viem_1.parseSignature)(signature);
+    const data = signatureMode === 'erc1271'
+        ? (0, viem_1.encodeFunctionData)({
+            abi: permitAbi,
+            functionName: 'permit',
+            args: [
+                owner,
+                AUDIT_SIGNER.address,
+                0n,
+                deadline,
+                signature,
+            ],
+        })
+        : (0, viem_1.encodeFunctionData)({
+            abi: permitAbi,
+            functionName: 'permit',
+            args: [
+                AUDIT_SIGNER.address,
+                AUDIT_SIGNER.address,
+                0n,
+                deadline,
+                Number(parsed.v),
+                parsed.r,
+                parsed.s,
+            ],
+        });
+    return callSucceeds(`${token} permit signature=${signatureMode}`, () => client.call({
+        account: AUDIT_SIGNER.address,
+        to: token,
+        data,
+        blockNumber,
+        ...(signatureMode === 'erc1271'
+            ? { stateOverride: erc1271StateOverride() }
+            : {}),
+    }));
+}
+async function simulateReceiveWithAuthorization(client, blockNumber, token, authorization, signatureMode) {
+    const owner = signatureMode === 'erc1271' ? AUDIT_CONTRACT : AUDIT_SIGNER.address;
+    const signature = await AUDIT_SIGNER.signTypedData({
+        domain: authorization.domain,
+        types: {
+            ReceiveWithAuthorization: [
+                { name: 'from', type: 'address' },
+                { name: 'to', type: 'address' },
+                { name: 'value', type: 'uint256' },
+                { name: 'validAfter', type: 'uint256' },
+                { name: 'validBefore', type: 'uint256' },
+                { name: 'nonce', type: 'bytes32' },
+            ],
+        },
+        primaryType: 'ReceiveWithAuthorization',
+        message: {
+            from: owner,
+            to: AUDIT_SIGNER.address,
+            value: 0n,
+            validAfter: 0n,
+            validBefore: MAX_UINT256,
+            nonce: ZERO_BYTES32,
+        },
+    });
+    const parsed = (0, viem_1.parseSignature)(signature);
+    const prefix = [
+        owner,
+        AUDIT_SIGNER.address,
+        0n,
+        0n,
+        MAX_UINT256,
+        ZERO_BYTES32,
+    ];
+    const data = signatureMode === 'erc1271'
+        ? (0, viem_1.encodeFunctionData)({
+            abi: authorizationAbi,
+            functionName: 'receiveWithAuthorization',
+            args: [...prefix, signature],
+        })
+        : (0, viem_1.encodeFunctionData)({
+            abi: authorizationAbi,
+            functionName: 'receiveWithAuthorization',
+            args: [...prefix, Number(parsed.v), parsed.r, parsed.s],
+        });
+    return callSucceeds(`${token} receiveWithAuthorization signature=${signatureMode}`, () => client.call({
+        account: AUDIT_SIGNER.address,
+        to: token,
+        data,
+        blockNumber,
+        ...(signatureMode === 'erc1271'
+            ? { stateOverride: erc1271StateOverride() }
+            : {}),
+    }));
+}
+async function auditToken(client, blockNumber, address, configured) {
+    const problems = [];
+    const rootCode = await probeRead(() => client.getCode({ address, blockNumber }));
+    if (!rootCode) {
+        return {
+            standards: [],
+            eoaOnly: undefined,
+            liveDomainSeparator: undefined,
+            implementation: undefined,
+            problems: ['could not read runtime bytecode'],
+        };
+    }
+    const publicImplementation = await probeRead(() => client.readContract({
+        address,
+        abi: probeAbi,
+        functionName: 'implementation',
+        blockNumber,
+    }));
+    const eip1967Implementation = addressFromWord(await probeRead(() => client.getStorageAt({
+        address,
+        slot: EIP1967_IMPLEMENTATION_SLOT,
+        blockNumber,
+    })));
+    const legacyImplementation = addressFromWord(await probeRead(() => client.getStorageAt({
+        address,
+        slot: LEGACY_ZEPPELIN_IMPLEMENTATION_SLOT,
+        blockNumber,
+    })));
+    const implementation = typeof publicImplementation === 'string' &&
+        publicImplementation !== ZERO_ADDRESS
+        ? (0, viem_1.getAddress)(publicImplementation)
+        : (eip1967Implementation ?? legacyImplementation);
+    const implementationCode = implementation
+        ? await probeRead(() => client.getCode({ address: implementation, blockNumber }))
+        : undefined;
+    const evidenceCodes = [rootCode];
+    if (implementationCode)
+        evidenceCodes.push(implementationCode);
+    const selectorSupport = {};
+    for (const [name, selector] of Object.entries(selectors)) {
+        if (evidenceCodes.some((code) => codeContains(code, selector))) {
+            selectorSupport[name] = true;
+            continue;
+        }
+        const facet = await probeRead(() => client.readContract({
+            address,
+            abi: probeAbi,
+            functionName: 'getFacet',
+            args: [selector],
+            blockNumber,
+        }));
+        selectorSupport[name] = facet !== undefined && facet !== ZERO_ADDRESS;
+        if (facet && facet !== ZERO_ADDRESS) {
+            const facetCode = await probeRead(() => client.getCode({ address: facet, blockNumber }));
+            if (facetCode)
+                evidenceCodes.push(facetCode);
+        }
+    }
+    const liveDomainSeparator = await probeRead(() => client.readContract({
+        address,
+        abi: probeAbi,
+        functionName: 'DOMAIN_SEPARATOR',
+        blockNumber,
+    }));
+    const nonce = await probeRead(() => client.readContract({
+        address,
+        abi: probeAbi,
+        functionName: 'nonces',
+        args: [ZERO_ADDRESS],
+        blockNumber,
+    }));
+    const authorizationState = await probeRead(() => client.readContract({
+        address,
+        abi: probeAbi,
+        functionName: 'authorizationState',
+        args: [ZERO_ADDRESS, ZERO_BYTES32],
+        blockNumber,
+    }));
+    const onchainTypehashes = {
+        permit: await probeRead(() => client.readContract({
+            address,
+            abi: probeAbi,
+            functionName: 'PERMIT_TYPEHASH',
+            blockNumber,
+        })),
+        transferWithAuthorization: await probeRead(() => client.readContract({
+            address,
+            abi: probeAbi,
+            functionName: 'TRANSFER_WITH_AUTHORIZATION_TYPEHASH',
+            blockNumber,
+        })),
+        receiveWithAuthorization: await probeRead(() => client.readContract({
+            address,
+            abi: probeAbi,
+            functionName: 'RECEIVE_WITH_AUTHORIZATION_TYPEHASH',
+            blockNumber,
+        })),
+    };
+    const typehashMatches = (name) => {
+        const returned = onchainTypehashes[name];
+        if (returned !== undefined)
+            return returned === expectedTypehashes[name];
+        return evidenceCodes.some((code) => codeContains(code, expectedTypehashes[name]));
+    };
+    const permitSurface = selectorSupport.permit &&
+        liveDomainSeparator !== undefined &&
+        nonce !== undefined;
+    const transferSurface = selectorSupport.authorizationState &&
+        selectorSupport.transferWithAuthorization &&
+        selectorSupport.receiveWithAuthorization &&
+        liveDomainSeparator !== undefined &&
+        authorizationState !== undefined;
+    if (selectorSupport.permit !==
+        (liveDomainSeparator !== undefined && nonce !== undefined)) {
+        problems.push('ERC-2612 selector/read-method evidence is inconsistent');
+    }
+    const completeTransferSelectors = selectorSupport.authorizationState &&
+        selectorSupport.transferWithAuthorization &&
+        selectorSupport.receiveWithAuthorization;
+    if (completeTransferSelectors !==
+        (liveDomainSeparator !== undefined && authorizationState !== undefined)) {
+        problems.push('ERC-3009 selector/read-method evidence is inconsistent');
+    }
+    const permitSimulation = configured?.standards.includes('erc2612')
+        ? await simulatePermit(client, blockNumber, address, configured, 'eoa-vrs')
+        : undefined;
+    const transferSimulation = configured?.standards.includes('erc3009')
+        ? await simulateReceiveWithAuthorization(client, blockNumber, address, configured, 'eoa-vrs')
+        : undefined;
+    const erc2612 = permitSurface && (permitSimulation ?? typehashMatches('permit'));
+    const erc3009 = transferSurface &&
+        (transferSimulation ??
+            (typehashMatches('transferWithAuthorization') &&
+                typehashMatches('receiveWithAuthorization')));
+    if (configured?.standards.includes('erc2612') && !permitSimulation) {
+        problems.push('a correctly typed ERC-2612 permit reverted under eth_call');
+    }
+    else if (permitSurface && !erc2612) {
+        problems.push('unconfigured ERC-2612 surface has an unprovable type hash');
+    }
+    if (configured?.standards.includes('erc3009') && !transferSimulation) {
+        problems.push('a correctly typed ERC-3009 receiveWithAuthorization reverted under eth_call');
+    }
+    else if (transferSurface && !erc3009) {
+        problems.push('unconfigured ERC-3009 surface has unprovable type hashes');
+    }
+    const standards = [];
+    if (erc3009)
+        standards.push('erc3009');
+    if (erc2612)
+        standards.push('erc2612');
+    const contractSignerSelectors = [];
+    if (erc3009) {
+        contractSignerSelectors.push(selectorSupport.transferWithAuthorizationBytes &&
+            selectorSupport.receiveWithAuthorizationBytes);
+    }
+    if (erc2612)
+        contractSignerSelectors.push(selectorSupport.permitBytes);
+    let eoaOnly;
+    if (contractSignerSelectors.length > 0) {
+        if (contractSignerSelectors.every((supported) => !supported)) {
+            eoaOnly = true;
+        }
+        else if (!contractSignerSelectors.every(Boolean)) {
+            problems.push('standards disagree on contract-wallet signature support; eoaOnly cannot represent this token');
+        }
+        else if (!configured) {
+            problems.push('contract-wallet support requires the configured domain for an ERC-1271 simulation');
+        }
+        else if (!(await verifyErc1271StateOverride(client, blockNumber))) {
+            problems.push('RPC did not apply the ERC-1271 state override; contract-wallet support is unverified');
+        }
+        else {
+            const contractSignerSupport = [];
+            if (erc3009) {
+                contractSignerSupport.push(await simulateReceiveWithAuthorization(client, blockNumber, address, configured, 'erc1271'));
+            }
+            if (erc2612) {
+                contractSignerSupport.push(await simulatePermit(client, blockNumber, address, configured, 'erc1271'));
+            }
+            if (contractSignerSupport.every(Boolean))
+                eoaOnly = false;
+            else if (contractSignerSupport.every((supported) => !supported)) {
+                eoaOnly = true;
+            }
+            else {
+                problems.push('standards disagree in ERC-1271 simulation; eoaOnly cannot represent this token');
+            }
+        }
+    }
+    return {
+        standards,
+        eoaOnly,
+        liveDomainSeparator,
+        implementation,
+        problems,
+    };
+}
+async function main() {
+    const problems = [];
+    const requestedChainIds = process.env.TOKEN_AUTH_AUDIT_CHAIN_IDS
+        ? new Set(process.env.TOKEN_AUTH_AUDIT_CHAIN_IDS.split(','))
+        : undefined;
+    let auditedTokens = 0;
+    let nativeTokens = 0;
+    let configuredTokens = 0;
+    for (const [chainId, chain] of Object.entries(index_1.chainRegistry)) {
+        if (requestedChainIds && !requestedChainIds.has(chainId))
+            continue;
+        if (chain.vmType !== 'evm' || chain.virtual) {
+            for (const token of chain.tokens) {
+                if (token.authorization) {
+                    problems.push(`${chain.name} (${chainId}) ${token.symbol}: authorization metadata is invalid on a non-direct EVM chain`);
+                }
+            }
+            continue;
+        }
+        if (!chain.publicRpcUrl) {
+            problems.push(`${chain.name} (${chainId}): no public RPC URL`);
+            continue;
+        }
+        const override = process.env[`TOKEN_AUTH_AUDIT_RPC_${chainId}`];
+        const rpcUrls = [
+            override,
+            ...(rpcFallbacks[chainId] ?? []),
+            chain.publicRpcUrl,
+        ].filter((url, index, urls) => Boolean(url) && urls.indexOf(url) === index);
+        const client = (0, viem_1.createPublicClient)({
+            transport: (0, viem_1.fallback)(rpcUrls.map((url) => (0, viem_1.http)(url, { retryCount: 2, timeout: 15_000 }))),
+        });
+        const blockNumber = await client.getBlockNumber();
+        for (const token of chain.tokens) {
+            const label = `${chain.name} (${chainId}) ${token.symbol} ${token.address}`;
+            if (token.address.toLowerCase() === ZERO_ADDRESS) {
+                nativeTokens++;
+                if (token.authorization) {
+                    problems.push(`${label}: native tokens cannot use token permits`);
+                }
+                continue;
+            }
+            auditedTokens++;
+            const address = (0, viem_1.getAddress)(token.address);
+            const result = await auditToken(client, blockNumber, address, token.authorization);
+            const configuredStandards = token.authorization?.standards ?? [];
+            if (JSON.stringify(configuredStandards) !== JSON.stringify(result.standards)) {
+                result.problems.push(`configured standards ${JSON.stringify(configuredStandards)} do not match live standards ${JSON.stringify(result.standards)}`);
+            }
+            if (token.authorization) {
+                configuredTokens++;
+                const derived = (0, viem_1.domainSeparator)({
+                    domain: token.authorization.domain,
+                });
+                if (derived !== token.authorization.domainSeparator) {
+                    result.problems.push(`declared domain derives ${derived}, not pinned ${token.authorization.domainSeparator}`);
+                }
+                if (result.liveDomainSeparator !== token.authorization.domainSeparator) {
+                    result.problems.push(`live DOMAIN_SEPARATOR ${result.liveDomainSeparator ?? '<unavailable>'} does not match pinned ${token.authorization.domainSeparator}`);
+                }
+                if (result.eoaOnly !== token.authorization.eoaOnly) {
+                    result.problems.push(`configured eoaOnly=${token.authorization.eoaOnly} does not match verified signature overloads (${result.eoaOnly})`);
+                }
+            }
+            const standards = result.standards.length > 0 ? result.standards.join('+') : 'none';
+            const signer = result.eoaOnly === undefined
+                ? 'n/a'
+                : result.eoaOnly
+                    ? 'EOA-only'
+                    : 'EOA+ERC1271';
+            console.log(`${result.problems.length === 0 ? 'PASS' : 'FAIL'} ${chainId}@${blockNumber} ${token.symbol} ${address} standards=${standards} signer=${signer} implementation=${result.implementation ?? 'direct'}`);
+            for (const problem of result.problems) {
+                problems.push(`${label}: ${problem}`);
+            }
+        }
+    }
+    console.log(`\nAudited ${auditedTokens} deployed EVM token entries; verified ${configuredTokens} authorization declarations; skipped ${nativeTokens} native-token entries as not applicable.`);
+    if (problems.length > 0) {
+        console.error('\nAuthorization audit failed:');
+        for (const problem of problems)
+            console.error(`- ${problem}`);
+        process.exitCode = 1;
+    }
+}
+main().catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+});

package/dist/scripts/generate.js

@@ -89,7 +89,7 @@ function renderChains(chainRegistry, mainnets, testnets) {
     }
     return [
         "// Auto-generated by scripts/generate.ts. Do not edit manually.",
-        'import type { ChainNetwork, ChainStack, PegGroup, ProviderIds, ProviderName, SettlementConfig, SettlementLayer, SupportedChain, SwapQuoter, SwapQuoterConfig, VmType } from "./types";',
+        'import type { ChainNetwork, ChainStack, PegGroup, ProviderIds, ProviderName, SettlementConfig, SettlementLayer, SupportedChain, SwapQuoter, SwapQuoterConfig, TokenAuthorization, VmType } from "./types";',
         "",
         "interface Token {",
         "  /** EVM: 0x-prefixed hex. SVM: base58 SPL mint. TVM: base58 (T-prefixed). */",
@@ -100,6 +100,8 @@ function renderChains(chainRegistry, mainnets, testnets) {
         "  pegGroup?: PegGroup;",
         "  balanceSlot: number | null;",
         "  approvalSlot: number | null;",
+        "  /** Token-native EIP-712 authorization support, when verified. */",
+        "  authorization?: TokenAuthorization;",
         "  /** Bridge layers that can carry this token on this chain, when known. */",
         "  settlementLayers?: SettlementLayer[];",
         "  /** Rhino's own symbol for this token, where it differs from ours. */",