@zerodev/permissions 5.6.1 → 5.6.3

package/migration/isPermissionMigrated.ts

@@ -0,0 +1,40 @@
+import {
+    MIGRATION_HELPER_ADDRESS,
+    MigrationHelperAbi
+} from "@zerodev/sdk/accounts"
+import type {
+    Address,
+    Chain,
+    Client,
+    Hex,
+    JsonRpcAccount,
+    LocalAccount,
+    Transport
+} from "viem"
+import { readContract } from "viem/actions"
+import { getAction } from "viem/utils"
+
+export const isPermissionMigrated = async (
+    client: Client<
+        Transport,
+        Chain | undefined,
+        JsonRpcAccount | LocalAccount | undefined
+    >,
+    params: { account: Address; permissionId: Hex }
+): Promise<boolean> => {
+    try {
+        const [, , p] = await getAction(
+            client,
+            readContract,
+            "readContract"
+        )({
+            address: MIGRATION_HELPER_ADDRESS,
+            abi: MigrationHelperAbi,
+            functionName: "isMigrated",
+            args: [params.account, [], [params.permissionId]]
+        })
+        return p[0]
+    } catch {
+        return false
+    }
+}

package/migration/migrationSessionKeyAccount.ts

@@ -0,0 +1,120 @@
+import { KernelV3AccountAbi, KernelV3ExecuteAbi } from "@zerodev/sdk"
+import {
+    type CreateKernelAccountReturnType,
+    MIGRATION_HELPER_ADDRESS,
+    MigrationHelperAbi
+} from "@zerodev/sdk/accounts"
+import { CALL_TYPE } from "@zerodev/sdk/constants"
+import {
+    type Call,
+    type Hex,
+    concat,
+    decodeFunctionData,
+    encodeAbiParameters,
+    encodeFunctionData,
+    getAbiItem,
+    parseAbiParameters,
+    toFunctionSelector,
+    zeroAddress
+} from "viem"
+import { isPermissionMigrated } from "./isPermissionMigrated.js"
+
+export const migrationSessionKeyAccount = async (params: {
+    account: CreateKernelAccountReturnType<"0.7">
+    permissionId: Hex
+}): Promise<CreateKernelAccountReturnType<"0.7">> => {
+    const account = params.account
+    const installFallbackCallData = encodeFunctionData({
+        abi: KernelV3AccountAbi,
+        functionName: "installModule",
+        args: [
+            3n,
+            MIGRATION_HELPER_ADDRESS,
+            concat([
+                toFunctionSelector(
+                    getAbiItem({
+                        abi: MigrationHelperAbi,
+                        name: "migrateWithCall"
+                    })
+                ),
+                zeroAddress,
+                encodeAbiParameters(
+                    parseAbiParameters(
+                        "bytes selectorInitData, bytes hookInitData"
+                    ),
+                    [CALL_TYPE.DELEGATE_CALL, "0x0000"]
+                )
+            ])
+        ]
+    })
+    const installFallbackCall = {
+        to: account.address,
+        data: installFallbackCallData,
+        value: 0n
+    }
+    const uninstallFallbackCallData = encodeFunctionData({
+        abi: KernelV3AccountAbi,
+        functionName: "uninstallModule",
+        args: [
+            3n,
+            MIGRATION_HELPER_ADDRESS,
+            concat([
+                toFunctionSelector(
+                    getAbiItem({
+                        abi: MigrationHelperAbi,
+                        name: "migrateWithCall"
+                    })
+                ),
+                "0x"
+            ])
+        ]
+    })
+    const uninstallFallbackCall = {
+        to: account.address,
+        data: uninstallFallbackCallData,
+        value: 0n
+    }
+    return {
+        ...params.account,
+        async encodeCalls(calls, callType) {
+            const isMigrated = await isPermissionMigrated(account.client, {
+                account: account.address,
+                permissionId: params.permissionId
+            })
+            const executeCallData = await account.encodeCalls(calls, callType)
+            if (isMigrated) {
+                return executeCallData
+            }
+            const {
+                args: [execMode, executionCalldata]
+            } = decodeFunctionData({
+                abi: [getAbiItem({ abi: KernelV3ExecuteAbi, name: "execute" })],
+                data: executeCallData
+            })
+            const migrationCallData = encodeFunctionData({
+                abi: MigrationHelperAbi,
+                functionName: "migrateWithCall",
+                args: [[], [params.permissionId], execMode, executionCalldata]
+            })
+
+            const migrationCall = {
+                to: MIGRATION_HELPER_ADDRESS,
+                data: migrationCallData,
+                value: 0n
+            } as Call
+
+            if (account.kernelVersion !== "0.3.0") {
+                return account.encodeCalls([migrationCall], "delegatecall")
+            }
+
+            migrationCall.to = account.address
+            const finalCalls = [
+                installFallbackCall,
+                migrationCall,
+                uninstallFallbackCall
+            ]
+
+            return account.encodeCalls(finalCalls, "call")
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerodev/permissions",
-  "version": "5.6.1",
+  "version": "5.6.3",
   "author": "ZeroDev",
   "main": "./_cjs/index.js",
   "module": "./_esm/index.js",

package/policies/callPolicyUtils.ts

@@ -5,7 +5,9 @@ import {
     type Hex,
     encodeAbiParameters,
     isHex,
+    keccak256,
     pad,
+    size,
     toFunctionSelector,
     toHex
 } from "viem"
@@ -99,6 +101,7 @@ export function getPermissionFromABI<
     // Generate permission from the target function
     const functionSelector = toFunctionSelector(targetFunction)
     let paramRules: ParamRule[] = []
+
     if (args && Array.isArray(args)) {
         paramRules = (args as CombinedArgs<AbiFunction["inputs"]>)
             .map((arg, i) => {
@@ -132,6 +135,41 @@ export function getPermissionFromABI<
                             { size: 32 }
                         )
                     )
+                } else if (arg.condition === ParamCondition.SLICE_EQUAL) {
+                    if (!("start" in arg) || !("length" in arg)) {
+                        throw new Error(
+                            "start and length are required for SLICE_EQUAL condition"
+                        )
+                    }
+                    const functionArgsType = targetFunction.inputs[i].type
+                    const { start, length, value } = arg
+
+                    let hexValue: Hex
+
+                    // functionArgsType can be "string" or "bytes"
+                    if (functionArgsType === "string") {
+                        hexValue = toHex(value as Parameters<typeof toHex>[0])
+                    } else if (functionArgsType === "bytes") {
+                        hexValue = isHex(value, { strict: true })
+                            ? value
+                            : toHex(value as Parameters<typeof toHex>[0])
+                    } else {
+                        throw new Error(
+                            `Unsupported function argument type: ${functionArgsType} could be "string" or "bytes"`
+                        )
+                    }
+
+                    if (size(hexValue) !== length) {
+                        throw new Error(
+                            "Value length is not equal to the given length"
+                        )
+                    }
+
+                    params = [
+                        toHex(start, { size: 32 }),
+                        toHex(length, { size: 32 }),
+                        keccak256(hexValue)
+                    ]
                 } else {
                     params = [
                         pad(
@@ -144,6 +182,7 @@ export function getPermissionFromABI<
                         )
                     ]
                 }
+
                 return {
                     params,
                     offset: i * 32,

package/policies/toCallPolicy.ts

@@ -1,10 +1,11 @@
-import type { Abi, Address, Hex } from "viem"
+import type { Abi, Address, Hex, Narrow } from "viem"
 import { concatHex, pad } from "viem"
 import {
     CALL_POLICY_CONTRACT_V0_0_1,
     CALL_POLICY_CONTRACT_V0_0_2,
     CALL_POLICY_CONTRACT_V0_0_3,
     CALL_POLICY_CONTRACT_V0_0_4,
+    CALL_POLICY_CONTRACT_V0_0_5,
     PolicyFlags
 } from "../constants.js"
 import type { Policy, PolicyParams } from "../types.js"
@@ -12,13 +13,14 @@ import {
     encodePermissionData,
     getPermissionFromABI
 } from "./callPolicyUtils.js"
-import { CallType, type Permission } from "./types.js"
+import { CallType, type InferPermissions, type Permission } from "./types.js"
 
 export enum CallPolicyVersion {
     V0_0_1 = "0.0.1",
     V0_0_2 = "0.0.2",
     V0_0_3 = "0.0.3",
-    V0_0_4 = "0.0.4"
+    V0_0_4 = "0.0.4",
+    V0_0_5 = "0.0.5"
 }
 
 export const getCallPolicyAddress = (
@@ -35,35 +37,38 @@ export const getCallPolicyAddress = (
             return CALL_POLICY_CONTRACT_V0_0_3
         case CallPolicyVersion.V0_0_4:
             return CALL_POLICY_CONTRACT_V0_0_4
+        case CallPolicyVersion.V0_0_5:
+            return CALL_POLICY_CONTRACT_V0_0_5
     }
 }
 
 export type CallPolicyParams<
-    TAbi extends Abi | readonly unknown[],
-    TFunctionName extends string | undefined = string
+    permissions extends readonly Permission<
+        Abi,
+        string
+    >[] = readonly Permission<Abi, string>[]
 > = PolicyParams & {
     policyVersion: CallPolicyVersion
-    permissions?: Permission<TAbi, TFunctionName>[]
+    permissions?: InferPermissions<Narrow<permissions>>
 }
 
 export function toCallPolicy<
-    TAbi extends Abi | readonly unknown[],
-    TFunctionName extends string | undefined = string
+    const permissions extends readonly Permission<Abi, string>[]
 >({
     policyAddress,
     policyFlag = PolicyFlags.FOR_ALL_VALIDATION,
     policyVersion,
-    permissions = []
-}: CallPolicyParams<TAbi, TFunctionName>): Policy {
+    permissions: inputPermissions
+}: CallPolicyParams<permissions>): Policy {
     const callPolicyAddress = getCallPolicyAddress(policyVersion, policyAddress)
 
-    const generatedPermissionParams = permissions?.map((perm) => {
+    const generatedPermissionParams = inputPermissions?.map((perm) => {
         // Natural discrimination: if abi and functionName are present, do ABI-based validation
         if (perm.abi && perm.functionName) {
             return getPermissionFromABI({
                 abi: perm.abi as Abi,
                 functionName: perm.functionName as string,
-                args: perm.args as [],
+                args: perm.args,
                 policyAddress: callPolicyAddress,
                 selector: perm.selector
             })
@@ -76,8 +81,8 @@ export function toCallPolicy<
         }
     })
 
-    permissions =
-        permissions?.map((perm, index) => ({
+    const processedPermissions =
+        inputPermissions?.map((perm, index) => ({
             ...perm,
             callType: perm.callType ?? CallType.CALL,
             selector:
@@ -92,7 +97,7 @@ export function toCallPolicy<
         })) ?? []
 
     const encodedPermissionData = encodePermissionData(
-        permissions,
+        processedPermissions,
         callPolicyAddress
     )
 
@@ -108,8 +113,8 @@ export function toCallPolicy<
             policyVersion,
             policyAddress,
             policyFlag,
-            permissions
-        } as unknown as CallPolicyParams<Abi | readonly unknown[], string> & {
+            permissions: processedPermissions
+        } as unknown as CallPolicyParams<permissions> & {
             type: "call"
         }
     }

package/policies/types.ts

@@ -7,8 +7,10 @@ import type {
     AbiParameterToPrimitiveType,
     AbiStateMutability,
     Address,
+    ContractFunctionName,
     Hex,
-    Narrow
+    Narrow,
+    Prettify
 } from "viem"
 
 export enum CallType {
@@ -24,7 +26,8 @@ export enum ParamCondition {
     GREATER_THAN_OR_EQUAL = 3,
     LESS_THAN_OR_EQUAL = 4,
     NOT_EQUAL = 5,
-    ONE_OF = 6
+    ONE_OF = 6,
+    SLICE_EQUAL = 7
 }
 
 export interface ParamRule {
@@ -113,6 +116,12 @@ type ConditionValue<
           condition: ParamCondition.ONE_OF
           value: AbiParameterToPrimitiveType<TAbiParameter, TAbiParameterKind>[]
       }
+    | {
+          condition: ParamCondition.SLICE_EQUAL
+          value: AbiParameterToPrimitiveType<TAbiParameter, TAbiParameterKind>
+          start: number
+          length: number
+      }
     | {
           condition: Exclude<ParamCondition, ParamCondition.ONE_OF>
           value: AbiParameterToPrimitiveType<TAbiParameter, TAbiParameterKind>
@@ -149,3 +158,43 @@ export type GeneratePermissionFromArgsParameters<
     : _FunctionName extends string
       ? { abi: [Narrow<TAbi[number]>] } & GetFunctionArgs<TAbi, _FunctionName>
       : never)
+
+// infer permission parameters from `unknown` - similar to GetMulticallContractParameters
+export type GetPermissionParameters<permission> = permission extends {
+    abi: infer abi extends Abi
+} // 1. Check if `abi` is const-asserted or defined inline
+    ? // 1a. Check if `functionName` is valid for `abi`
+      permission extends {
+          functionName: infer functionName extends ContractFunctionName<abi>
+      }
+        ? // Use PermissionWithABI which supports CombinedArgs
+          PermissionWithABI<abi, functionName>
+        : // 1b. `functionName` is invalid, check if `abi` is declared as `Abi`
+          Abi extends abi
+          ? PermissionWithABI<abi, string> // `abi` declared as `Abi`, unable to infer types further
+          : // `abi` is const-asserted or defined inline, infer types for `functionName` and `args`
+            PermissionWithABI<abi, string>
+    : permission extends { target: Address } // manual permission
+      ? PermissionManual
+      : never // invalid permission
+
+// Process permissions array - similar to MulticallContracts
+export type InferPermissions<
+    permissions extends readonly unknown[],
+    result extends readonly unknown[] = []
+> = permissions extends readonly [] // no permissions, return empty
+    ? readonly []
+    : permissions extends readonly [infer permission] // one permission left before returning `result`
+      ? readonly [...result, Prettify<GetPermissionParameters<permission>>]
+      : permissions extends readonly [infer permission, ...infer rest] // grab first permission and recurse through `rest`
+        ? InferPermissions<
+              [...rest],
+              [...result, Prettify<GetPermissionParameters<permission>>]
+          >
+        : readonly unknown[] extends permissions
+          ? permissions
+          : // If `permissions` is *some* array but we couldn't assign `unknown[]` to it, then it must hold some known/homogenous type!
+            permissions extends readonly (infer permission)[]
+            ? readonly Prettify<GetPermissionParameters<permission>>[]
+            : // Fallback
+              readonly Permission<Abi, string>[]

package/serializeMultiChainPermissionAccounts.ts

@@ -19,6 +19,8 @@ import {
 export type MultiChainPermissionAccountsParams = {
     account: SmartAccount<KernelSmartAccountImplementation>
     privateKey?: Hex
+    permissionPlugin?: PermissionPlugin
+    isExternalPermissionPlugin?: boolean
 }
 
 export const serializeMultiChainPermissionAccounts = async (
@@ -26,13 +28,21 @@ export const serializeMultiChainPermissionAccounts = async (
 ): Promise<string[]> => {
     if (params.length === 0) return []
 
+    let isPreInstalled = false
     const permissionParamsPerAccounts = params.map((param) => {
-        if (!isPermissionValidatorPlugin(param.account.kernelPluginManager)) {
+        if (
+            isPermissionValidatorPlugin(param.account.kernelPluginManager) &&
+            !param.isExternalPermissionPlugin
+        ) {
+            return (
+                param.account.kernelPluginManager as PermissionPlugin
+            ).getPluginSerializationParams()
+        } else if (param.permissionPlugin) {
+            isPreInstalled = !param.isExternalPermissionPlugin
+            return param.permissionPlugin.getPluginSerializationParams()
+        } else {
             throw new Error("Account plugin is not a permission validator")
         }
-        return (
-            param.account.kernelPluginManager as PermissionPlugin
-        ).getPluginSerializationParams()
     })
 
     const actions = params.map((param) =>
@@ -43,23 +53,30 @@ export const serializeMultiChainPermissionAccounts = async (
         param.account.kernelPluginManager.getValidityData()
     )
 
-    const pluginEnableTypedDatas = await Promise.all(
-        params.map(async (param) => {
-            return param.account.kernelPluginManager.getPluginsEnableTypedData(
-                param.account.address
-            )
-        })
-    )
-
-    // build merkle tree for enable signatures
-    const leaves = pluginEnableTypedDatas.map((typedData) => {
-        return hashTypedData(typedData)
-    })
+    let leaves: Hex[] = []
+    let merkleTree: MerkleTree = new MerkleTree(leaves)
+
+    if (!isPreInstalled) {
+        const pluginEnableTypedDatas = await Promise.all(
+            params.map(async (param) => {
+                return param.account.kernelPluginManager.getPluginsEnableTypedData(
+                    param.account.address,
+                    param.isExternalPermissionPlugin
+                        ? param.permissionPlugin
+                        : undefined // override permission plugin if externalPlugin
+                )
+            })
+        )
 
-    const merkleTree = new MerkleTree(leaves, keccak256, {
-        sortPairs: true
-    })
+        // build merkle tree for enable signatures
+        leaves = pluginEnableTypedDatas.map((typedData) => {
+            return hashTypedData(typedData)
+        })
 
+        merkleTree = new MerkleTree(leaves, keccak256, {
+            sortPairs: true
+        })
+    }
     const merkleRoot = merkleTree.getHexRoot() as Hex
 
     const toEthSignedMessageHash = hashMessage({ raw: merkleRoot })
@@ -67,7 +84,8 @@ export const serializeMultiChainPermissionAccounts = async (
     let signature: Hex = "0x"
     if (
         params[0].account.kernelPluginManager.sudoValidator?.source ===
-        "MultiChainECDSAValidator"
+            "MultiChainECDSAValidator" &&
+        !isPreInstalled
     ) {
         signature =
             await params[0].account.kernelPluginManager.sudoValidator?.signMessage(
@@ -80,7 +98,8 @@ export const serializeMultiChainPermissionAccounts = async (
     }
     if (
         params[0].account.kernelPluginManager.sudoValidator?.source ===
-        "MultiChainWebAuthnValidator"
+            "MultiChainWebAuthnValidator" &&
+        !isPreInstalled
     ) {
         const encodedSignature =
             await params[0].account.kernelPluginManager.sudoValidator?.signMessage(
@@ -96,6 +115,8 @@ export const serializeMultiChainPermissionAccounts = async (
     // get enable signatures for multi-chain validator
     const enableSignatures = await Promise.all(
         params.map(async (param, index) => {
+            if (isPreInstalled) return undefined
+
             if (!param.account.kernelPluginManager.sudoValidator) {
                 throw new Error(
                     "No sudo validator found, check if sudo validator is multi-chain validator"

package/serializePermissionAccount.ts

@@ -13,7 +13,8 @@ export const serializePermissionAccount = async (
     privateKey?: Hex,
     enableSignature?: Hex,
     eip7702Auth?: SignAuthorizationReturnType,
-    permissionPlugin?: PermissionPlugin
+    permissionPlugin?: PermissionPlugin,
+    isExternalPermissionPlugin?: boolean
 ): Promise<string> => {
     let permissionParams: PermissionData
     let isPreInstalled = false
@@ -21,13 +22,16 @@ export const serializePermissionAccount = async (
     const validityData = account.kernelPluginManager.getValidityData()
 
     // Check if permission plugin is in kernelPluginManager
-    if (isPermissionValidatorPlugin(account.kernelPluginManager)) {
+    if (
+        isPermissionValidatorPlugin(account.kernelPluginManager) &&
+        !isExternalPermissionPlugin
+    ) {
         permissionParams =
             account.kernelPluginManager.getPluginSerializationParams()
     } else if (permissionPlugin) {
         // Permission plugin provided externally (initConfig case)
         permissionParams = permissionPlugin.getPluginSerializationParams()
-        isPreInstalled = true
+        isPreInstalled = !isExternalPermissionPlugin
     } else {
         throw new Error("No permission validator found in account or provided")
     }
@@ -36,7 +40,8 @@ export const serializePermissionAccount = async (
         ? undefined
         : (enableSignature ??
           (await account.kernelPluginManager.getPluginEnableSignature(
-              account.address
+              account.address,
+              isExternalPermissionPlugin ? permissionPlugin : undefined // override permission plugin if externalPlugin
           )))
     const _eip7702Auth = account.authorization
         ? (eip7702Auth ?? (await account?.eip7702Authorization?.()))

package/types.ts

@@ -5,7 +5,7 @@ import type {
     GetKernelVersion,
     PluginValidityData
 } from "@zerodev/sdk/types"
-import type { Abi, Address, Hex, LocalAccount } from "viem"
+import type { Address, Hex, LocalAccount } from "viem"
 import type { EntryPointVersion } from "viem/account-abstraction"
 import type { SignAuthorizationReturnType } from "viem/accounts"
 import type { PolicyFlags } from "./constants.js"
@@ -42,7 +42,7 @@ export type Policy = {
     getPolicyInfoInBytes: () => Hex
     // return params directly to serialize/deserialize Policy
     policyParams:
-        | (CallPolicyParams<Abi | readonly unknown[], string> & {
+        | (CallPolicyParams & {
               type: "call"
           })
         | (GasPolicyParams & { type: "gas" })