evm

type AddressListConfig struct {
	Addresses []string `json:"addresses"` // 0x prefixed
}

type AddressListEvaluator struct{}

type BatchValidationResult struct {
	Results []ValidationResult
	Valid   bool
}

type CompositePasswordProvider struct {
	// contains filtered or unexported fields
}

type ContractMethodConfig struct {
	Contract   string   `json:"contract"`    // 0x prefixed
	MethodSigs []string `json:"method_sigs"` // 4-byte hex, 0x prefixed
}

type ContractMethodEvaluator struct{}

type EVMAdapter struct {
	// contains filtered or unexported fields
}

type EVMSignPayload struct {
	// For hash signing
	Hash string `json:"hash,omitempty"` // 0x prefixed, 32 bytes

	// For raw message signing
	RawMessage []byte `json:"raw_message,omitempty"`

	// For EIP-191/Personal signing
	Message string `json:"message,omitempty"`

	// For EIP-712 typed data signing
	TypedData *TypedDataPayload `json:"typed_data,omitempty"`

	// For transaction signing
	Transaction *TransactionPayload `json:"transaction,omitempty"`
}

type EnvPasswordProvider struct{}

type HDWalletConfig struct {
	Path          string   `yaml:"path"`           // Path to encrypted HD wallet file
	PasswordEnv   string   `yaml:"password_env"`   // Environment variable containing password
	PasswordStdin bool     `yaml:"password_stdin"` // If true, read password from stdin
	DeriveIndices []uint32 `yaml:"derive_indices"` // Indices to derive at startup
	Enabled       bool     `yaml:"enabled"`        // Whether this HD wallet is enabled
}

type HDWalletInfo struct {
	PrimaryAddress string             `json:"primary_address"`
	BasePath       string             `json:"base_path"`
	DerivedCount   int                `json:"derived_count"`
	Derived        []types.SignerInfo `json:"derived,omitempty"`
}

type HDWalletManager interface {
	CreateHDWallet(ctx context.Context, params types.CreateHDWalletParams) (*HDWalletInfo, error)
	ImportHDWallet(ctx context.Context, params types.ImportHDWalletParams) (*HDWalletInfo, error)
	DeriveAddress(ctx context.Context, primaryAddr string, index uint32) (*types.SignerInfo, error)
	DeriveAddresses(ctx context.Context, primaryAddr string, start, count uint32) ([]types.SignerInfo, error)
	ListHDWallets() []HDWalletInfo
	ListDerivedAddresses(primaryAddr string) ([]types.SignerInfo, error)
}

type HDWalletProvider struct {
	// contains filtered or unexported fields
}

type JSRuleConfig struct {
	// Script is the JS source; must define validate(input) returning { valid, reason?, payload? }.
	Script string `json:"script"`

	// SignTypeFilter restricts to sign types. For evm_js only: may be comma-separated
	// (e.g. "typed_data,transaction"); other rule types support a single value only.
	SignTypeFilter string `json:"sign_type_filter,omitempty"`

	// Delegation (optional)
	DelegateTo   string `json:"delegate_to,omitempty"`   // target rule ID
	DelegateMode string `json:"delegate_mode,omitempty"` // "single" | "per_item" (default "single")
	ItemsKey     string `json:"items_key,omitempty"`     // required for per_item; default "items"
	PayloadKey   string `json:"payload_key,omitempty"`   // optional for single
}

type JSRuleEvaluator struct {
	// contains filtered or unexported fields
}

type JSRuleValidateResult struct {
	Valid      bool        `json:"valid"`
	Reason     string      `json:"reason,omitempty"`
	Payload    interface{} `json:"payload,omitempty"`
	DelegateTo string      `json:"delegate_to,omitempty"` // optional; overrides config.delegate_to when delegating
}

type JSRuleValidator struct {
	// contains filtered or unexported fields
}

type JSTestCase struct {
	Name         string                 `json:"name" yaml:"name"`
	Input        map[string]interface{} `json:"input" yaml:"input"`
	ExpectPass   bool                   `json:"expect_pass" yaml:"expect_pass"`
	ExpectReason string                 `json:"expect_reason,omitempty" yaml:"expect_reason,omitempty"`
}

type KeystoreConfig struct {
	Address       string `yaml:"address"`        // Expected address (for verification)
	Path          string `yaml:"path"`           // Path to keystore file
	PasswordEnv   string `yaml:"password_env"`   // Environment variable containing password (used when password_stdin is false)
	PasswordStdin bool   `yaml:"password_stdin"` // If true, read password from stdin at startup (more secure)
	Enabled       bool   `yaml:"enabled"`        // Whether this signer is enabled
}

type KeystoreProvider struct {
	// contains filtered or unexported fields
}

type MessagePatternConfig struct {
	// Pattern is a regex pattern that the message must match (whitelist) or must not match (blocklist)
	Pattern string `json:"pattern"`

	// Patterns is a list of regex patterns (any match = rule fires)
	// If both Pattern and Patterns are specified, Pattern is added to Patterns
	Patterns []string `json:"patterns,omitempty"`

	// SignTypes restricts which sign types this rule applies to
	// If empty, applies to "personal" and "eip191" by default
	SignTypes []string `json:"sign_types,omitempty"`

	// Description provides human-readable explanation of what the pattern validates
	Description string `json:"description,omitempty"`

	// TestCases defines validation cases to verify rule correctness
	TestCases []MessagePatternTestCase `json:"test_cases,omitempty"`
}

type MessagePatternEvaluator struct{}

type MessagePatternRuleValidator struct {
	// contains filtered or unexported fields
}

type MessagePatternTestCase struct {
	Name         string                  `json:"name"`
	Input        MessagePatternTestInput `json:"input"`
	ExpectPass   bool                    `json:"expect_pass"`
	ExpectReason string                  `json:"expect_reason,omitempty"`
}

type MessagePatternTestInput struct {
	RawMessage string `json:"raw_message"`
	SignType   string `json:"sign_type,omitempty"` // default: "personal"
}

type PasswordProvider interface {
	// GetPassword returns the password for the given keystore configuration
	GetPassword(address string, config KeystoreConfig) ([]byte, error)
}

type PrivateKeyConfig struct {
	Address   string `yaml:"address"` // Expected address (for verification)
	KeyEnvVar string `yaml:"key_env"` // Environment variable containing hex private key
	Enabled   bool   `yaml:"enabled"` // Whether this signer is enabled
}

type PrivateKeyProvider struct {
	// contains filtered or unexported fields
}

type RuleInput struct {
	SignType string `json:"sign_type"` // "transaction" | "typed_data" | "personal_sign"
	ChainID  int64  `json:"chain_id"`
	Signer   string `json:"signer"` // checksum address

	Transaction  *RuleInputTransaction  `json:"transaction,omitempty"`
	TypedData    *RuleInputTypedData    `json:"typed_data,omitempty"`
	PersonalSign *RuleInputPersonalSign `json:"personal_sign,omitempty"`
}

type RuleInputPersonalSign struct {
	Message string `json:"message"`
}

type RuleInputTransaction struct {
	From     string `json:"from"`               // REQUIRED, checksum
	To       string `json:"to"`                 // empty for contract creation
	Value    string `json:"value"`              // hex
	Data     string `json:"data"`               // hex
	Gas      string `json:"gas,omitempty"`      // decimal string
	MethodID string `json:"methodId,omitempty"` // 4-byte hex selector
}

type RuleInputTypedData struct {
	Types       map[string][]TypedDataField `json:"types"`
	PrimaryType string                      `json:"primaryType"`
	Domain      TypedDataDomain             `json:"domain"`
	Message     map[string]interface{}      `json:"message"`
}

type SecurityError struct {
	Pattern string `json:"pattern"`
	Message string `json:"message"`
}

type SignTypeRestrictionConfig struct {
	AllowedSignTypes []string `json:"allowed_sign_types"` // List of allowed sign types
}

type SignTypeRestrictionEvaluator struct{}

type SignerConfig struct {
	PrivateKeys []PrivateKeyConfig `yaml:"private_keys"`
	Keystores   []KeystoreConfig   `yaml:"keystores"`
	HDWallets   []HDWalletConfig   `yaml:"hd_wallets"`
}

type SignerCreator interface {
	SignerProvider
	CreateSigner(ctx context.Context, params interface{}) (*types.SignerInfo, error)
}

type SignerDiscoverer interface {
	SignerProvider
	DiscoverLockedSigners() ([]types.SignerInfo, error)
}

type SignerLocker interface {
	SignerProvider
	LockSigner(ctx context.Context, address string) error
}

type SignerManager interface {
	// CreateSigner creates a new signer based on the request type
	CreateSigner(ctx context.Context, req types.CreateSignerRequest) (*types.SignerInfo, error)

	// ListSigners returns signers matching the filter with pagination
	ListSigners(ctx context.Context, filter types.SignerFilter) (types.SignerListResult, error)

	// HDWalletManager returns the HD wallet provider, or error if not configured.
	HDWalletManager() (HDWalletManager, error)

	// DiscoverLockedSigners scans all providers for locked signers and registers them.
	DiscoverLockedSigners(ctx context.Context) error

	// UnlockSigner unlocks a locked signer with the given password.
	UnlockSigner(ctx context.Context, address string, password string) (*types.SignerInfo, error)

	// LockSigner locks an unlocked signer (remove key from memory).
	LockSigner(ctx context.Context, address string) (*types.SignerInfo, error)
}

type SignerManagerImpl struct {
	// contains filtered or unexported fields
}

type SignerProvider interface {
	// Type returns the signer type this provider manages.
	Type() types.SignerType
	// Close releases resources (zeroize keys, close HD wallet sessions, etc.)
	Close() error
}

type SignerRegistry struct {
	// contains filtered or unexported fields
}

type SignerRestrictionConfig struct {
	AllowedSigners []string `json:"allowed_signers"` // List of allowed signer addresses
}

type SignerRestrictionEvaluator struct{}

type SignerUnlocker interface {
	SignerProvider
	UnlockSigner(ctx context.Context, address string, password string) (*ethsig.Signer, error)
}

type SolidityEvaluatorConfig struct {
	ForgePath string        // path to forge binary, empty = auto-detect from PATH
	CacheDir  string        // cache directory for compiled scripts
	TempDir   string        // workspace dir (foundry.toml + lib/forge-std + rule scripts); empty = os.TempDir()/remote-signer-rules. When set to a dir with pre-installed lib/forge-std (e.g. Docker mount), ensureForgeStd is skipped.
	Timeout   time.Duration // max execution time per rule
	CacheTTL  time.Duration // TTL for execution result cache entries, 0 = no expiration
}

type SolidityExpressionConfig struct {
	// Expression is the Solidity code containing require() statements (Mode 1)
	// Available variables:
	//   - address to       (transaction recipient)
	//   - uint256 value    (transaction value in wei)
	//   - bytes4 selector  (method selector, first 4 bytes of data)
	//   - bytes data       (full calldata)
	//   - uint256 chainId  (chain ID)
	//   - address signer   (signing address)
	// Example: require(value <= 1 ether, "exceeds limit");
	Expression string `json:"expression,omitempty"`

	// Functions contains user-defined Solidity functions (Mode 2)
	// When the transaction selector matches a function, it's called automatically
	// with decoded parameters. Context variables available as txTo, txValue, etc.
	// Example:
	//   function transfer(address to, uint256 amount) external {
	//       require(amount <= 10000e6, "exceeds 10k limit");
	//   }
	Functions string `json:"functions,omitempty"`

	// TypedDataExpression is Solidity code for EIP-712 typed data validation (Mode 3)
	// Available variables:
	//   - string eip712_primaryType       (primary type name, e.g., "Permit")
	//   - string eip712_domainName        (domain name)
	//   - string eip712_domainVersion     (domain version)
	//   - uint256 eip712_domainChainId    (domain chain ID)
	//   - address eip712_domainContract   (verifying contract address)
	//   - Plus message fields as defined by TypedDataTypes (or inferred from request)
	// Example: require(value <= 1000000e6, "permit value exceeds 1M limit");
	TypedDataExpression string `json:"typed_data_expression,omitempty"`

	// TypedDataStruct defines the expected EIP-712 message structure using Solidity struct syntax
	// When specified, the rule will:
	//   1. Only match requests where primaryType matches the struct name (or TypedDataPrimaryType if set)
	//   2. Generate a struct instance variable with lowercase name (e.g., Order -> order)
	//   3. Access fields using struct.field syntax (e.g., order.taker, order.feeRateBps)
	// Example:
	//   typed_data_struct: |
	//     struct Order {
	//         uint256 salt;
	//         address maker;
	//         address taker;
	//         uint256 feeRateBps;
	//     }
	//   typed_data_expression: |
	//     require(order.taker == address(0), "taker must be zero address");
	//     require(order.feeRateBps <= 1000, "fee exceeds 10%");
	TypedDataStruct string `json:"typed_data_struct,omitempty"`

	// TypedDataPrimaryType specifies the expected EIP-712 primaryType to match
	// If not set but TypedDataStruct is defined, uses the struct name as primaryType
	// The lowercase form of this name is used as the struct instance variable name
	// Example: "Order" -> instance variable "order" accessible in expressions
	TypedDataPrimaryType string `json:"typed_data_primary_type,omitempty"`

	// TypedDataFunctions contains struct definitions and validation functions (Mode 4)
	// Define structs matching EIP-712 types and functions to validate them
	// Example:
	//   struct Permit { address owner; address spender; uint256 value; ... }
	//   function validatePermit(Permit memory permit) external { ... }
	TypedDataFunctions string `json:"typed_data_functions,omitempty"`

	// SignTypeFilter restricts this rule to specific sign types
	// If empty, applies to all sign types (default behavior for transaction rules)
	// Common values: "transaction", "typed_data", "personal", "eip191"
	SignTypeFilter string `json:"sign_type_filter,omitempty"`

	// InMappingArrays supplies address lists for in(expr, varName): varName -> []address.
	// When rule body contains in(txTo, allowed_safe_addresses), generate allowed_safe_addresses_mapping
	// and set InMappingArrays["allowed_safe_addresses"] to the list. O(1) lookup instead of expanded OR chain.
	InMappingArrays map[string][]string `json:"in_mapping_arrays,omitempty"`

	// Description explains what the rule validates
	Description string `json:"description,omitempty"`

	// ABISignature defines custom ABI decoding (optional, only for Expression mode)
	// Format: "functionName(type1,type2,...)"
	ABISignature string `json:"abi_signature,omitempty"`

	// TestCases defines validation cases to verify rule correctness
	// Each test case is executed during rule creation/update to ensure validity
	TestCases []SolidityTestCase `json:"test_cases"`
}

type SolidityRuleEvaluator struct {
	// contains filtered or unexported fields
}

type SolidityRuleValidator struct {
	// contains filtered or unexported fields
}

type SolidityTestCase struct {
	// Name describes what this test case validates
	Name string `json:"name"`

	// Input defines the transaction context for this test
	Input SolidityTestInput `json:"input"`

	// ExpectPass indicates whether the rule should pass (true) or revert (false)
	ExpectPass bool `json:"expect_pass"`

	// ExpectReason is the expected revert reason (only used when ExpectPass is false)
	// If empty, any revert is accepted; if set, must match the revert message
	ExpectReason string `json:"expect_reason,omitempty"`
}

type SolidityTestInput struct {
	// Transaction context fields (for transaction rules)
	To       string `json:"to,omitempty"`       // recipient address, 0x-prefixed
	Value    string `json:"value,omitempty"`    // value in wei (decimal string)
	Selector string `json:"selector,omitempty"` // method selector, 0x-prefixed 4 bytes
	Data     string `json:"data,omitempty"`     // full calldata, 0x-prefixed hex
	ChainID  string `json:"chain_id,omitempty"` // chain ID (decimal string)
	Signer   string `json:"signer,omitempty"`   // signer address, 0x-prefixed

	// EIP-712 typed data fields (for typed_data rules)
	TypedData *TypedDataTestInput `json:"typed_data,omitempty"`
}

type StdinPasswordProvider struct{}

type StructDefinition struct {
	Name   string           // struct name (e.g., "Order")
	Fields []TypedDataField // ordered list of fields
}

type SyntaxError struct {
	Message  string `json:"message"`
	Line     int    `json:"line,omitempty"`
	Column   int    `json:"column,omitempty"`
	Severity string `json:"severity"` // "error" or "warning"
}

type TestCaseResult struct {
	Name           string `json:"name"`
	Passed         bool   `json:"passed"`
	ExpectedPass   bool   `json:"expected_pass"`
	ActualPass     bool   `json:"actual_pass"`
	ExpectedReason string `json:"expected_reason,omitempty"`
	ActualReason   string `json:"actual_reason,omitempty"`
	Error          string `json:"error,omitempty"`
}

type TransactionPayload struct {
	To        *string `json:"to,omitempty"`   // nil for contract creation
	Value     string  `json:"value"`          // wei as decimal string
	Data      string  `json:"data,omitempty"` // 0x-prefixed hex string
	Nonce     *uint64 `json:"nonce,omitempty"`
	Gas       uint64  `json:"gas"`
	GasPrice  string  `json:"gasPrice,omitempty"`  // for legacy tx
	GasTipCap string  `json:"gasTipCap,omitempty"` // for EIP-1559
	GasFeeCap string  `json:"gasFeeCap,omitempty"` // for EIP-1559
	TxType    string  `json:"txType"`              // "legacy", "eip2930", "eip1559"
}

type TransactionType string

type TypedDataDomain struct {
	Name              string `json:"name,omitempty"`
	Version           string `json:"version,omitempty"`
	ChainId           string `json:"chainId,omitempty"` // decimal string
	VerifyingContract string `json:"verifyingContract,omitempty"`
	Salt              string `json:"salt,omitempty"`
}

type TypedDataDomainInput struct {
	Name              string `json:"name,omitempty"`
	Version           string `json:"version,omitempty"`
	ChainID           string `json:"chainId,omitempty"`
	VerifyingContract string `json:"verifyingContract,omitempty"`
	Salt              string `json:"salt,omitempty"`
}

type TypedDataField struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

type TypedDataPayload struct {
	Types       map[string][]TypedDataField `json:"types"`
	PrimaryType string                      `json:"primaryType"`
	Domain      TypedDataDomain             `json:"domain"`
	Message     map[string]interface{}      `json:"message"`
}

type TypedDataTestInput struct {
	// PrimaryType is the primary type name (e.g., "Permit")
	PrimaryType string `json:"primaryType,omitempty"`

	// Domain contains the EIP-712 domain parameters
	Domain *TypedDataDomainInput `json:"domain,omitempty"`

	// Message contains the typed data message fields
	// Keys are field names, values are field values (as strings)
	Message map[string]interface{} `json:"message,omitempty"`
}

type ValidationMode int

type ValidationResult struct {
	Valid           bool             `json:"valid"`
	SyntaxError     *SyntaxError     `json:"syntax_error,omitempty"`
	TestCaseResults []TestCaseResult `json:"test_case_results,omitempty"`
	FailedTestCases int              `json:"failed_test_cases"`
}

type ValueLimitConfig struct {
	MaxValue string `json:"max_value"` // wei as decimal string
}

type ValueLimitEvaluator struct{}