@anywalletkit/protocol-swap2-balancer 0.1.9 → 0.3.0

package/README.md

@@ -17,6 +17,17 @@ npm install @anywalletkit/protocol-swap2-balancer @anywalletkit/core
 
 On npm: [@anywalletkit/protocol-swap2-balancer](https://www.npmjs.com/package/@anywalletkit/protocol-swap2-balancer), published from the [release workflow](https://github.com/ultratestbro/anywalletkit/blob/main/RELEASING.md) with provenance.
 
+## Behind `remoteProvider`
+
+When the provider runs on your server, spread its pins into the app's stub:
+`remoteProvider({name: "balancer", baseUrl, ...balancerPins})`. The engine then lets the EVM route call and
+approve only the Balancer V2 Vault, never an address the backend names; without the pins the stub gets no
+EVM calldata route (fail closed). The pins carry `verifyQuote: balancerVerifyQuote`, which opens the Vault call on
+the device: only `batchSwap` of kind GIVEN_IN, no internal balances or pool `userData`, at most
+`BALANCER_MAX_SWAPS` hops, funds from this account to the recipient, the hops selling exactly the input of the
+source token, and limits of exactly the input in and the quote's minimum out. `manageUserBalance`,
+`setRelayerApproval`, `swap` and every other Vault call are refused.
+
 ## Activity
 
 `describeActivity(tx, ctx)` recognizes `batchSwap` `0x945bcec9` and `swap`

package/dist/activity.cjs

@@ -32,7 +32,9 @@ var import_util2 = require("@anywalletkit/protocol-swap2-core/util");
 var import_viem = require("viem");
 var import_util = require("@anywalletkit/protocol-swap2-core/util");
 var import_core = require("@anywalletkit/core");
+var ZERO = "0x0000000000000000000000000000000000000000";
 var BALANCER_V2_VAULT = "0xBA12222222228d8Ba445958a75a0704d566BF2C8";
+var BALANCER_MAX_SWAPS = 16;
 var BALANCER_V2_CHAINS = Object.freeze({
   1: { api: "MAINNET", weth: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" },
   10: { api: "OPTIMISM", weth: "0x4200000000000000000000000000000000000006" },
@@ -51,6 +53,75 @@ var VAULT_ABI = (0, import_viem.parseAbi)([
   `function batchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds, int256[] limits, uint256 deadline) payable returns (int256[] assetDeltas)`,
   "function WETH() view returns (address)"
 ]);
+function balancerVerifyQuote(params, quote) {
+  const id = /^eip155:[0-9]+$/.test(params.sourceChain) ? Number(params.sourceChain.slice(7)) : NaN;
+  const chain = Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? BALANCER_V2_CHAINS[id] : void 0;
+  if (!chain || params.destChain !== params.sourceChain) return "not a same-chain swap on a Balancer v2 chain";
+  const tx = quote.txRequest;
+  if (!tx?.data || !tx.to || tx.serializedTx !== void 0) return "the quote carries no Vault call";
+  if ((0, import_viem.getAddress)(tx.to) !== BALANCER_V2_VAULT) return `the call targets ${tx.to}, not the Vault`;
+  const src = (0, import_util.sourceAssetOf)(params);
+  if (!src) return `unknown source token ${params.sourceToken}`;
+  const nativeIn = !src.contract;
+  const nativeOut = /^0x0+$/.test(params.destToken);
+  let tokenIn, tokenOut, sender, recipient, amountIn, minOut;
+  try {
+    tokenIn = (0, import_viem.getAddress)(nativeIn ? ZERO : src.contract);
+    tokenOut = (0, import_viem.getAddress)(nativeOut ? ZERO : params.destToken);
+    recipient = (0, import_viem.getAddress)(params.destAddress);
+    sender = (0, import_viem.getAddress)(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);
+    amountIn = BigInt(params.amountIn);
+    minOut = BigInt(quote.minDestAmount);
+  } catch {
+    return "the request does not name EVM tokens, a recipient and amounts";
+  }
+  if (nativeIn ? BigInt(tx.value ?? "0") !== amountIn || tx.approvalAddress !== void 0 : BigInt(tx.value ?? "0") !== 0n || !tx.approvalAddress || (0, import_viem.getAddress)(tx.approvalAddress) !== BALANCER_V2_VAULT) {
+    return nativeIn ? "a native input is paid as exactly the input in value, with no approval" : "a token input attaches no value and approves the Vault";
+  }
+  let call;
+  try {
+    call = (0, import_viem.decodeFunctionData)({ abi: VAULT_ABI, data: tx.data });
+  } catch {
+    return "the Vault call is not batchSwap";
+  }
+  if (call.functionName !== "batchSwap") return `${call.functionName} is not batchSwap`;
+  const [kind, swaps, assets, funds, limits] = call.args;
+  if (kind !== 0) return "the batch is not GIVEN_IN";
+  if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) return `the batch has ${swaps.length} pool hops, not 1\u2013${BALANCER_MAX_SWAPS}`;
+  if (funds.fromInternalBalance || funds.toInternalBalance) return "the batch uses Vault internal balances";
+  if ((0, import_viem.getAddress)(funds.sender) !== sender || (0, import_viem.getAddress)(funds.recipient) !== recipient) return `the batch takes from ${funds.sender} and pays ${funds.recipient}, not this account and the recipient`;
+  const list = assets.map((a) => (0, import_viem.getAddress)(a));
+  if (new Set(list).size !== list.length) return "the batch names an asset twice";
+  if ((nativeIn || nativeOut) && list.includes((0, import_viem.getAddress)(chain.weth))) return "a native swap passes through the wrapped native";
+  const inIdx = list.indexOf(tokenIn);
+  const outIdx = list.indexOf(tokenOut);
+  if (inIdx < 0 || outIdx < 0 || inIdx === outIdx) return "the batch does not trade the requested tokens";
+  if (limits.length !== list.length || limits.some((l, i) => l !== (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n))) {
+    return "the limits are not exactly the input in and the quote's minimum out";
+  }
+  let given = 0n;
+  for (const step of swaps) {
+    if (step.userData !== "0x") return "the batch carries pool userData this module never sends";
+    if (step.assetInIndex >= BigInt(list.length) || step.assetOutIndex >= BigInt(list.length) || step.assetInIndex === step.assetOutIndex) return "a hop names no valid asset pair";
+    if (step.amount > 0n) {
+      if (step.assetInIndex !== BigInt(inIdx)) return "a hop brings in an amount of another asset than the input";
+      given += step.amount;
+    }
+  }
+  if (given !== amountIn) return `the hops sell ${given}, not the ${amountIn} input`;
+  if (!swaps.some((step) => step.assetOutIndex === BigInt(outIdx))) return "no hop delivers the destination token";
+  if (call.args[5] <= BigInt(Math.floor(Date.now() / 1e3))) return "the batch deadline has passed";
+  return null;
+}
+var balancerPins = Object.freeze({
+  callTargets: (chain) => balancerVaultFor(chain),
+  spenders: (chain) => balancerVaultFor(chain),
+  verifyQuote: balancerVerifyQuote
+});
+function balancerVaultFor(chain) {
+  const id = /^eip155:[0-9]+$/.test(chain) ? Number(chain.slice(7)) : NaN;
+  return Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? [BALANCER_V2_VAULT] : [];
+}
 
 // src/activity.ts
 var BALANCER_MODULE = "@anywalletkit/protocol-swap2-balancer";

package/dist/activity.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/activity.ts","../src/provider.ts"],"sourcesContent":["/**\n * Activity recognition for Balancer v2: `swap` / `batchSwap` on the Vault\n * (one address on every chain) on a chain the module serves → `swap`,\n * \"Swapped A → B\" from the owner's net transfers.\n */\nimport type {ActivityItem, ChainTx, DescribeActivityContext} from \"@anywalletkit/core\";\nimport {chainLabel, describeSwapLike, matchesCall} from \"@anywalletkit/protocol-swap2-core/activity\";\nimport {evmRef, isEvm} from \"@anywalletkit/protocol-swap2-core/util\";\nimport {BALANCER_V2_CHAINS, BALANCER_V2_VAULT} from \"./provider.js\";\n\nexport const BALANCER_MODULE = \"@anywalletkit/protocol-swap2-balancer\";\n\n/** Vault swap entry points (`viem toFunctionSelector`, 2026-10-14). */\nexport const BALANCER_VAULT_SELECTORS: ReadonlySet<string> = new Set([\n  \"0x945bcec9\", // batchSwap(uint8,(bytes32,uint256,uint256,uint256,bytes)[],address[],(address,bool,address,bool),int256[],uint256)\n  \"0x52bbbe29\", // swap((bytes32,uint8,address,address,uint256,bytes),(address,bool,address,bool),uint256,uint256)\n]);\n\nexport function describeBalancerActivity(tx: ChainTx, ctx: DescribeActivityContext): ActivityItem | null {\n  if (!isEvm(tx.chain) || !BALANCER_V2_CHAINS[evmRef(tx.chain)]) return null;\n  if (!matchesCall(tx, [BALANCER_V2_VAULT], BALANCER_VAULT_SELECTORS)) return null;\n  return describeSwapLike(tx, ctx, {protocol: BALANCER_MODULE, subtitle: `Balancer v2 · ${chainLabel(tx.chain)}`, kind: \"swap\"});\n}\n","import {decodeFunctionData, decodeFunctionResult, encodeFunctionData, getAddress, parseAbi, type Hex} from \"viem\";\nimport {describeBalancerActivity} from \"./activity.js\";\nimport {evmRef, isEvm, timeoutSignal, sourceAssetOf} from \"@anywalletkit/protocol-swap2-core/util\";\nimport type {Asset, CrossChainProvider, IntentRef, IntentStatus, Quote, QuoteParams, UnsignedTx} from \"@anywalletkit/protocol-swap2-core/types\";\nimport {bigintToNumber} from \"@anywalletkit/core\";\n\n/**\n * Balancer v2 — the cp0x permissionless Balancer venue (balancer.cp0x.com).\n *\n * Discovery only from the API: Balancer's SOR (`sorGetSwapPaths`, v2 pools)\n * suggests the path. Everything on the money path is on-chain: the Vault\n * prices that exact path (`queryBatchSwap` via eth_call), the quote uses the\n * Vault's number, and `batchSwap` carries `limits` (in ≤ amountIn, out ≥ min)\n * plus a deadline — the Vault itself refuses anything worse. Native coins use\n * the Vault's own ETH sentinel (address 0): it wraps/unwraps through WETH.\n */\n\nconst ZERO = \"0x0000000000000000000000000000000000000000\";\n/** The same Balancer v2 Vault address on every chain it is deployed on. */\nexport const BALANCER_V2_VAULT = \"0xBA12222222228d8Ba445958a75a0704d566BF2C8\";\nconst DEFAULT_API = \"https://api-v3.balancer.fi/\";\nconst DEFAULT_SLIPPAGE_BPS = 50;\nconst DEFAULT_TTL_MS = 300_000;\nconst DEFAULT_DEADLINE_S = 600;\n\n/** Chains where the v2 Vault is live, with the SOR API name and the Vault's WETH() (verified on-chain 2026-10-13). */\nexport const BALANCER_V2_CHAINS: Readonly<Record<number, {api: string; weth: `0x${string}`}>> = Object.freeze({\n  1: {api: \"MAINNET\", weth: \"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2\"},\n  10: {api: \"OPTIMISM\", weth: \"0x4200000000000000000000000000000000000006\"},\n  100: {api: \"GNOSIS\", weth: \"0xe91D153E0b41518A2Ce8Dd3D7944Fa863463a97d\"},\n  137: {api: \"POLYGON\", weth: \"0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270\"},\n  146: {api: \"SONIC\", weth: \"0x039e2fB66102314Ce7b64Ce5Ce3E5183bc94aD38\"},\n  8453: {api: \"BASE\", weth: \"0x4200000000000000000000000000000000000006\"},\n  9745: {api: \"PLASMA\", weth: \"0x6100E367285b01F48D07953803A2d8dCA5D19873\"},\n  42161: {api: \"ARBITRUM\", weth: \"0x82aF49447D8a07e3bd95BD0d56f35241523fBab1\"},\n  43114: {api: \"AVALANCHE\", weth: \"0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7\"},\n});\n\nconst SWAP_STEP = \"(bytes32 poolId, uint256 assetInIndex, uint256 assetOutIndex, uint256 amount, bytes userData)\";\nconst FUNDS = \"(address sender, bool fromInternalBalance, address recipient, bool toInternalBalance)\";\nconst VAULT_ABI = parseAbi([\n  `function queryBatchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds) returns (int256[] assetDeltas)`,\n  `function batchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds, int256[] limits, uint256 deadline) payable returns (int256[] assetDeltas)`,\n  \"function WETH() view returns (address)\",\n]);\n\ntype Step = {poolId: Hex; assetInIndex: bigint; assetOutIndex: bigint; amount: bigint; userData: Hex};\ntype Funds = {sender: Hex; fromInternalBalance: boolean; recipient: Hex; toInternalBalance: boolean};\n\nexport interface BalancerProviderConfig {\n  enabled?: boolean;\n  /** JSON-RPC endpoints per EVM chain id (on-chain pricing + receipts). */\n  rpcUrls: Readonly<Record<number, readonly string[]>>;\n  /** Balancer API (SOR) base URL — discovery only. */\n  apiUrl?: string;\n  defaultSlippageBps?: number;\n  quoteTtlMs?: number;\n  deadlineSeconds?: number;\n}\n\ninterface SorPath {\n  pools: string[];\n  tokens: {address: string; decimals: number}[];\n  inputAmountRaw: string;\n  outputAmountRaw: string;\n  protocolVersion: number;\n}\n\n/** Base units → the decimal string the SOR expects (\"1.5\"). */\nfunction human(amount: bigint, decimals: number): string {\n  const s = amount.toString().padStart(decimals + 1, \"0\");\n  const whole = s.slice(0, s.length - decimals);\n  const frac = s.slice(s.length - decimals).replace(/0+$/, \"\");\n  return frac ? `${whole}.${frac}` : whole;\n}\n\nexport function balancerProvider(config: BalancerProviderConfig): CrossChainProvider {\n  const api = config.apiUrl ?? DEFAULT_API;\n  const slippageDefault = config.defaultSlippageBps ?? DEFAULT_SLIPPAGE_BPS;\n  const ttl = config.quoteTtlMs ?? DEFAULT_TTL_MS;\n  const deadlineS = config.deadlineSeconds ?? DEFAULT_DEADLINE_S;\n  const verified = new Map<number, Promise<void>>();\n\n  const chainIdOf = (caip2: string): number | null => {\n    if (!isEvm(caip2)) return null;\n    const id = evmRef(caip2);\n    return BALANCER_V2_CHAINS[id] && config.rpcUrls[id]?.length ? id : null;\n  };\n\n  async function rpc(chainId: number, method: string, params: unknown[]): Promise<unknown> {\n    let lastErr: unknown;\n    for (const url of config.rpcUrls[chainId] ?? []) {\n      try {\n        const res = await fetch(url, {method: \"POST\", headers: {\"content-type\": \"application/json\"}, body: JSON.stringify({jsonrpc: \"2.0\", id: 1, method, params}), signal: timeoutSignal(12_000)});\n        if (!res.ok) throw new Error(`HTTP ${res.status}`);\n        const body = (await res.json()) as {result?: unknown; error?: {message?: string}};\n        if (body.error) throw Object.assign(new Error(body.error.message ?? \"rpc error\"), {rpc: true});\n        return body.result ?? null;\n      } catch (e) {\n        if ((e as {rpc?: boolean}).rpc) throw e; // a revert is an answer, not a dead endpoint\n        lastErr = e;\n      }\n    }\n    throw new Error(`balancer: no RPC answered on chain ${chainId} (${lastErr instanceof Error ? lastErr.message : String(lastErr)})`);\n  }\n\n  /** The Vault is deployed here and wraps through the WETH we pinned. */\n  function verify(chainId: number): Promise<void> {\n    let p = verified.get(chainId);\n    if (!p) {\n      p = (async () => {\n        const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data: encodeFunctionData({abi: VAULT_ABI, functionName: \"WETH\"})}, \"latest\"])) as Hex;\n        const weth = decodeFunctionResult({abi: VAULT_ABI, functionName: \"WETH\", data: raw});\n        if (getAddress(weth) !== getAddress(BALANCER_V2_CHAINS[chainId]!.weth)) throw new Error(`balancer: the Vault on chain ${chainId} is not the pinned deployment — refusing`);\n      })();\n      p.catch(() => verified.delete(chainId));\n      verified.set(chainId, p);\n    }\n    return p;\n  }\n\n  /** Vault.queryBatchSwap on chain: the asset deltas this exact batch would produce. */\n  async function query(chainId: number, swaps: readonly Step[], assets: readonly Hex[], funds: Funds): Promise<readonly bigint[]> {\n    const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"queryBatchSwap\", args: [0, swaps, assets, funds]});\n    const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data}, \"latest\"])) as Hex;\n    return decodeFunctionResult({abi: VAULT_ABI, functionName: \"queryBatchSwap\", data: raw});\n  }\n\n  return {\n    name: \"balancer\",\n    describeActivity: describeBalancerActivity,\n    supportsSameChain: true,\n    enabled: () => config.enabled ?? true,\n    supportsChain: (caip2: string) => chainIdOf(caip2) !== null,\n    supportsChainPair: (from: string, to: string) => from === to && chainIdOf(from) !== null,\n    supportsRoute: (from: Asset, to: Asset) => from.chain === to.chain && chainIdOf(from.chain) !== null,\n\n    async getQuote(params: QuoteParams, signal?: AbortSignal): Promise<Quote | null> {\n      const refuse = (why: string): null => {\n        params.onRefusal?.(`balancer: ${why}`);\n        return null;\n      };\n      if (params.flex) return refuse(\"amount-flexible deposits are not supported\");\n      if (params.sourceChain !== params.destChain) return refuse(\"same-chain swaps only\");\n      const chainId = chainIdOf(params.sourceChain);\n      if (chainId === null) return refuse(`no Balancer v2 Vault or RPC for ${params.sourceChain}`);\n      const chain = BALANCER_V2_CHAINS[chainId]!;\n      const src = sourceAssetOf(params);\n      if (!src) return refuse(`unknown source token ${params.sourceToken}`);\n      const nativeIn = !src.contract;\n      const nativeOut = /^0x0+$/.test(params.destToken);\n      if (!nativeOut && !/^0x[0-9a-fA-F]{40}$/.test(params.destToken)) return refuse(\"destination token must be an EVM address\");\n      if (!/^0x[0-9a-fA-F]{40}$/.test(params.destAddress)) return refuse(\"recipient must be an EVM address\");\n      let amountIn: bigint;\n      try {\n        amountIn = BigInt(params.amountIn);\n      } catch {\n        return refuse(\"amount is not an integer\");\n      }\n      if (amountIn <= 0n) return refuse(\"amount must be positive\");\n      const tokenIn = getAddress(nativeIn ? chain.weth : src.contract!);\n      const tokenOut = getAddress(nativeOut ? chain.weth : params.destToken);\n      if (tokenIn === tokenOut) return refuse(nativeIn || nativeOut ? \"that is a wrap/unwrap, not a swap\" : \"same token in and out\");\n\n      try {\n        await verify(chainId);\n        // 1) Discovery: the SOR's v2 paths (never trusted for price).\n        // Values are inlined (this API ignores GraphQL variables); all are validated\n        // addresses / a decimal number / a fixed enum, so nothing user-shaped is spliced.\n        const query_ = `query { sorGetSwapPaths(chain: ${chain.api}, swapAmount: \"${human(amountIn, src.decimals)}\", swapType: EXACT_IN, tokenIn: \"${tokenIn}\", tokenOut: \"${tokenOut}\", useProtocolVersion: 2) { protocolVersion paths { pools tokens { address decimals } inputAmountRaw outputAmountRaw protocolVersion } } }`;\n        const res = await fetch(api, {\n          method: \"POST\",\n          headers: {\"content-type\": \"application/json\"},\n          body: JSON.stringify({query: query_}),\n          signal: signal ?? timeoutSignal(12_000),\n        });\n        if (!res.ok) return refuse(`SOR answered HTTP ${res.status}`);\n        const body = (await res.json()) as {data?: {sorGetSwapPaths?: {protocolVersion?: number; paths?: SorPath[]}}; errors?: {message?: string}[]};\n        const paths = body.data?.sorGetSwapPaths?.paths ?? [];\n        if (body.errors?.length) return refuse(`SOR: ${body.errors[0]?.message?.slice(0, 120) ?? \"error\"}`);\n        if (!paths.length || paths.some((p) => p.protocolVersion !== 2 || p.pools.length === 0 || p.tokens.length !== p.pools.length + 1)) {\n          return refuse(\"no Balancer v2 pool route for this pair and amount\");\n        }\n        if (paths.reduce((s, p) => s + BigInt(p.inputAmountRaw), 0n) !== amountIn) return refuse(\"the SOR split does not add up to the amount\");\n\n        // 2) Build the batch from the suggested paths.\n        const assets: Hex[] = [];\n        const indexOf = (a: string) => {\n          const addr = getAddress(a);\n          let i = assets.findIndex((x) => x === addr);\n          if (i < 0) i = assets.push(addr) - 1;\n          return BigInt(i);\n        };\n        const swaps: Step[] = [];\n        for (const p of paths) {\n          if (getAddress(p.tokens[0]!.address) !== tokenIn || getAddress(p.tokens[p.tokens.length - 1]!.address) !== tokenOut) return refuse(\"the SOR path does not start/end at the requested tokens\");\n          p.pools.forEach((pool, i) => {\n            if (!/^0x[0-9a-fA-F]{64}$/.test(pool)) throw new Error(\"balancer: malformed pool id from the SOR\");\n            swaps.push({poolId: pool as Hex, assetInIndex: indexOf(p.tokens[i]!.address), assetOutIndex: indexOf(p.tokens[i + 1]!.address), amount: i === 0 ? BigInt(p.inputAmountRaw) : 0n, userData: \"0x\"});\n          });\n        }\n        const inIdx = bigintToNumber(indexOf(tokenIn));\n        const outIdx = bigintToNumber(indexOf(tokenOut));\n        // The Vault's ETH sentinel: native in/out wraps/unwraps through its WETH.\n        if (nativeIn || nativeOut) {\n          const wethIdx = assets.findIndex((a) => a === getAddress(chain.weth));\n          if (paths.some((p) => p.tokens.slice(1, -1).some((t) => getAddress(t.address) === getAddress(chain.weth)))) return refuse(\"this route passes through the wrapped native — pick the wrapped token instead\");\n          if (wethIdx >= 0) assets[wethIdx] = ZERO as Hex;\n        }\n        const sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);\n        const recipient = getAddress(params.destAddress);\n        const funds: Funds = {sender, fromInternalBalance: false, recipient, toInternalBalance: false};\n\n        // 3) Price it on-chain — this, not the SOR's number, is the quote.\n        const deltas = await query(chainId, swaps, assets, funds);\n        const paid = deltas[inIdx]!;\n        const out = -deltas[outIdx]!;\n        if (paid !== amountIn) return refuse(`the Vault would take ${paid}, not ${amountIn}`);\n        if (out <= 0n) return refuse(\"the Vault prices this route at zero output\");\n        if (deltas.some((d, i) => i !== inIdx && i !== outIdx && d !== 0n)) return refuse(\"the batch leaves an intermediate balance — refusing\");\n\n        const bps = params.slippageBps ?? slippageDefault;\n        const minOut = (out * BigInt(10_000 - bps)) / 10_000n;\n        if (params.minAmountOut !== undefined && minOut < BigInt(params.minAmountOut)) return refuse(`floor breach (min=${minOut} < floor=${params.minAmountOut})`);\n        const limits = assets.map((_, i) => (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n));\n        const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineS);\n        const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"batchSwap\", args: [0, swaps, assets, funds, limits, deadline]});\n        const gasLimit = 160_000n + 95_000n * BigInt(swaps.length);\n        return {\n          provider: \"balancer\",\n          intentId: `balancer:${chainId}`,\n          depositAddress: \"\",\n          depositMemo: null,\n          txRequest: {\n            to: BALANCER_V2_VAULT,\n            data,\n            value: nativeIn ? amountIn.toString() : \"0\",\n            chainId,\n            gasLimit: gasLimit.toString(),\n            ...(nativeIn ? {} : {approvalAddress: BALANCER_V2_VAULT}),\n          },\n          sourceAmount: amountIn.toString(),\n          destAmount: out.toString(),\n          minDestAmount: minOut.toString(),\n          feeUsd: 0,\n          etaSeconds: 15,\n          reliability: 0.97,\n          validUntilMs: Date.now() + ttl,\n          // Pool swap fees are inside the Vault-priced output; no fee is added on top.\n          providerData: {paths: String(paths.length), hops: String(swaps.length), minOut: minOut.toString(), poolFee: \"pools\"},\n        };\n      } catch (e) {\n        return refuse(e instanceof Error ? e.message.replace(/^balancer: /, \"\") : String(e));\n      }\n    },\n\n    /** Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum. */\n    async preflightDeposit(quote: Quote, tx: UnsignedTx): Promise<void> {\n      const chainId = Number(quote.intentId.split(\":\")[1]);\n      const minOut = quote.providerData?.minOut;\n      if (!BALANCER_V2_CHAINS[chainId] || !minOut || !tx.data) return;\n      const call = decodeFunctionData({abi: VAULT_ABI, data: tx.data as Hex});\n      if (call.functionName !== \"batchSwap\") throw new Error(\"balancer: the transaction is not a Vault batchSwap\");\n      const [, swaps, assets, funds, limits] = call.args;\n      const outIdx = limits.findIndex((l) => l < 0n);\n      const deltas = await query(chainId, swaps, assets, funds);\n      const out = -deltas[outIdx]!;\n      if (out < BigInt(minOut)) throw new Error(`balancer: price moved — the pools now pay ${out}, under your minimum ${minOut}. Nothing was sent; refresh the quote.`);\n    },\n\n    async buildDeposit(quote: Quote): Promise<UnsignedTx> {\n      const tx = quote.txRequest;\n      if (!tx?.to || !tx.data) throw new Error(\"swap2: Balancer quote has no transaction request\");\n      return {chain: \"\", to: tx.to, value: tx.value ?? \"0\", data: tx.data, ...(tx.chainId !== undefined ? {chainId: tx.chainId} : {}), ...(tx.gasLimit ? {gasLimit: tx.gasLimit} : {}), ...(tx.approvalAddress ? {approvalAddress: tx.approvalAddress} : {})};\n    },\n\n    async trackIntent(ref: IntentRef): Promise<IntentStatus> {\n      if (!ref.sourceTxHash) return {state: \"pending\"};\n      const chainId = Number(ref.intentId.split(\":\")[1]);\n      if (!BALANCER_V2_CHAINS[chainId] || !config.rpcUrls[chainId]?.length) return {state: \"pending\"};\n      try {\n        const receipt = (await rpc(chainId, \"eth_getTransactionReceipt\", [ref.sourceTxHash])) as {status?: string} | null;\n        if (!receipt) return {state: \"pending\"};\n        return receipt.status === \"0x1\" ? {state: \"completed\", destTxHash: ref.sourceTxHash} : {state: \"failed\"};\n      } catch {\n        return {state: \"pending\"};\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,sBAAwD;AACxD,IAAAA,eAA4B;;;ACP5B,kBAA2G;AAE3G,kBAA0D;AAE1D,kBAA6B;AAetB,IAAM,oBAAoB;AAO1B,IAAM,qBAAmF,OAAO,OAAO;AAAA,EAC5G,GAAG,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACtE,IAAI,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACvE,KAAK,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,SAAS,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,QAAQ,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACxE,OAAO,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EAC3E,OAAO,EAAC,KAAK,aAAa,MAAM,6CAA4C;AAC9E,CAAC;AAED,IAAM,YAAY;AAClB,IAAM,QAAQ;AACd,IAAM,gBAAY,sBAAS;AAAA,EACzB,uCAAuC,SAAS,+BAA+B,KAAK;AAAA,EACpF,kCAAkC,SAAS,+BAA+B,KAAK;AAAA,EAC/E;AACF,CAAC;;;ADlCM,IAAM,kBAAkB;AAGxB,IAAM,2BAAgD,oBAAI,IAAI;AAAA,EACnE;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAEM,SAAS,yBAAyB,IAAa,KAAmD;AACvG,MAAI,KAAC,oBAAM,GAAG,KAAK,KAAK,CAAC,uBAAmB,qBAAO,GAAG,KAAK,CAAC,EAAG,QAAO;AACtE,MAAI,KAAC,6BAAY,IAAI,CAAC,iBAAiB,GAAG,wBAAwB,EAAG,QAAO;AAC5E,aAAO,kCAAiB,IAAI,KAAK,EAAC,UAAU,iBAAiB,UAAU,wBAAiB,4BAAW,GAAG,KAAK,CAAC,IAAI,MAAM,OAAM,CAAC;AAC/H;","names":["import_util"]}
+{"version":3,"sources":["../src/activity.ts","../src/provider.ts"],"sourcesContent":["/**\n * Activity recognition for Balancer v2: `swap` / `batchSwap` on the Vault\n * (one address on every chain) on a chain the module serves → `swap`,\n * \"Swapped A → B\" from the owner's net transfers.\n */\nimport type {ActivityItem, ChainTx, DescribeActivityContext} from \"@anywalletkit/core\";\nimport {chainLabel, describeSwapLike, matchesCall} from \"@anywalletkit/protocol-swap2-core/activity\";\nimport {evmRef, isEvm} from \"@anywalletkit/protocol-swap2-core/util\";\nimport {BALANCER_V2_CHAINS, BALANCER_V2_VAULT} from \"./provider.js\";\n\nexport const BALANCER_MODULE = \"@anywalletkit/protocol-swap2-balancer\";\n\n/** Vault swap entry points (`viem toFunctionSelector`, 2026-10-14). */\nexport const BALANCER_VAULT_SELECTORS: ReadonlySet<string> = new Set([\n  \"0x945bcec9\", // batchSwap(uint8,(bytes32,uint256,uint256,uint256,bytes)[],address[],(address,bool,address,bool),int256[],uint256)\n  \"0x52bbbe29\", // swap((bytes32,uint8,address,address,uint256,bytes),(address,bool,address,bool),uint256,uint256)\n]);\n\nexport function describeBalancerActivity(tx: ChainTx, ctx: DescribeActivityContext): ActivityItem | null {\n  if (!isEvm(tx.chain) || !BALANCER_V2_CHAINS[evmRef(tx.chain)]) return null;\n  if (!matchesCall(tx, [BALANCER_V2_VAULT], BALANCER_VAULT_SELECTORS)) return null;\n  return describeSwapLike(tx, ctx, {protocol: BALANCER_MODULE, subtitle: `Balancer v2 · ${chainLabel(tx.chain)}`, kind: \"swap\"});\n}\n","import type {RemotePins} from \"@anywalletkit/protocol-swap2-core/types\";\nimport {decodeFunctionData, decodeFunctionResult, encodeFunctionData, getAddress, parseAbi, type Hex} from \"viem\";\nimport {describeBalancerActivity} from \"./activity.js\";\nimport {evmRef, isEvm, timeoutSignal, sourceAssetOf} from \"@anywalletkit/protocol-swap2-core/util\";\nimport type {Asset, CrossChainProvider, IntentRef, IntentStatus, Quote, QuoteParams, UnsignedTx} from \"@anywalletkit/protocol-swap2-core/types\";\nimport {bigintToNumber} from \"@anywalletkit/core\";\n\n/**\n * Balancer v2 — the cp0x permissionless Balancer venue (balancer.cp0x.com).\n *\n * Discovery only from the API: Balancer's SOR (`sorGetSwapPaths`, v2 pools)\n * suggests the path. Everything on the money path is on-chain: the Vault\n * prices that exact path (`queryBatchSwap` via eth_call), the quote uses the\n * Vault's number, and `batchSwap` carries `limits` (in ≤ amountIn, out ≥ min)\n * plus a deadline — the Vault itself refuses anything worse. Native coins use\n * the Vault's own ETH sentinel (address 0): it wraps/unwraps through WETH.\n */\n\nconst ZERO = \"0x0000000000000000000000000000000000000000\";\n/** The same Balancer v2 Vault address on every chain it is deployed on. */\nexport const BALANCER_V2_VAULT = \"0xBA12222222228d8Ba445958a75a0704d566BF2C8\";\nconst DEFAULT_API = \"https://api-v3.balancer.fi/\";\nconst DEFAULT_SLIPPAGE_BPS = 50;\nconst DEFAULT_TTL_MS = 300_000;\nconst DEFAULT_DEADLINE_S = 600;\n/** Most pool hops one batch may carry: the SOR's splits are a handful; a batch past this is refused at quote and at preflight. */\nexport const BALANCER_MAX_SWAPS = 16;\n\n/** Chains where the v2 Vault is live, with the SOR API name and the Vault's WETH() (verified on-chain 2026-10-13). */\nexport const BALANCER_V2_CHAINS: Readonly<Record<number, {api: string; weth: `0x${string}`}>> = Object.freeze({\n  1: {api: \"MAINNET\", weth: \"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2\"},\n  10: {api: \"OPTIMISM\", weth: \"0x4200000000000000000000000000000000000006\"},\n  100: {api: \"GNOSIS\", weth: \"0xe91D153E0b41518A2Ce8Dd3D7944Fa863463a97d\"},\n  137: {api: \"POLYGON\", weth: \"0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270\"},\n  146: {api: \"SONIC\", weth: \"0x039e2fB66102314Ce7b64Ce5Ce3E5183bc94aD38\"},\n  8453: {api: \"BASE\", weth: \"0x4200000000000000000000000000000000000006\"},\n  9745: {api: \"PLASMA\", weth: \"0x6100E367285b01F48D07953803A2d8dCA5D19873\"},\n  42161: {api: \"ARBITRUM\", weth: \"0x82aF49447D8a07e3bd95BD0d56f35241523fBab1\"},\n  43114: {api: \"AVALANCHE\", weth: \"0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7\"},\n});\n\nconst SWAP_STEP = \"(bytes32 poolId, uint256 assetInIndex, uint256 assetOutIndex, uint256 amount, bytes userData)\";\nconst FUNDS = \"(address sender, bool fromInternalBalance, address recipient, bool toInternalBalance)\";\nconst VAULT_ABI = parseAbi([\n  `function queryBatchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds) returns (int256[] assetDeltas)`,\n  `function batchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds, int256[] limits, uint256 deadline) payable returns (int256[] assetDeltas)`,\n  \"function WETH() view returns (address)\",\n]);\n\ntype Step = {poolId: Hex; assetInIndex: bigint; assetOutIndex: bigint; amount: bigint; userData: Hex};\ntype Funds = {sender: Hex; fromInternalBalance: boolean; recipient: Hex; toInternalBalance: boolean};\n\nexport interface BalancerProviderConfig {\n  enabled?: boolean;\n  /** JSON-RPC endpoints per EVM chain id (on-chain pricing + receipts). */\n  rpcUrls: Readonly<Record<number, readonly string[]>>;\n  /** Balancer API (SOR) base URL — discovery only. */\n  apiUrl?: string;\n  defaultSlippageBps?: number;\n  quoteTtlMs?: number;\n  deadlineSeconds?: number;\n}\n\ninterface SorPath {\n  pools: string[];\n  tokens: {address: string; decimals: number}[];\n  inputAmountRaw: string;\n  outputAmountRaw: string;\n  protocolVersion: number;\n}\n\n/** Base units → the decimal string the SOR expects (\"1.5\"). */\nfunction human(amount: bigint, decimals: number): string {\n  const s = amount.toString().padStart(decimals + 1, \"0\");\n  const whole = s.slice(0, s.length - decimals);\n  const frac = s.slice(s.length - decimals).replace(/0+$/, \"\");\n  return frac ? `${whole}.${frac}` : whole;\n}\n\nexport function balancerProvider(config: BalancerProviderConfig): CrossChainProvider {\n  const api = config.apiUrl ?? DEFAULT_API;\n  const slippageDefault = config.defaultSlippageBps ?? DEFAULT_SLIPPAGE_BPS;\n  const ttl = config.quoteTtlMs ?? DEFAULT_TTL_MS;\n  const deadlineS = config.deadlineSeconds ?? DEFAULT_DEADLINE_S;\n  const verified = new Map<number, Promise<void>>();\n\n  const chainIdOf = (caip2: string): number | null => {\n    if (!isEvm(caip2)) return null;\n    const id = evmRef(caip2);\n    return BALANCER_V2_CHAINS[id] && config.rpcUrls[id]?.length ? id : null;\n  };\n\n  async function rpc(chainId: number, method: string, params: unknown[]): Promise<unknown> {\n    let lastErr: unknown;\n    for (const url of config.rpcUrls[chainId] ?? []) {\n      try {\n        const res = await fetch(url, {method: \"POST\", headers: {\"content-type\": \"application/json\"}, body: JSON.stringify({jsonrpc: \"2.0\", id: 1, method, params}), signal: timeoutSignal(12_000)});\n        if (!res.ok) throw new Error(`HTTP ${res.status}`);\n        const body = (await res.json()) as {result?: unknown; error?: {message?: string}};\n        if (body.error) throw Object.assign(new Error(body.error.message ?? \"rpc error\"), {rpc: true});\n        return body.result ?? null;\n      } catch (e) {\n        if ((e as {rpc?: boolean}).rpc) throw e; // a revert is an answer, not a dead endpoint\n        lastErr = e;\n      }\n    }\n    throw new Error(`balancer: no RPC answered on chain ${chainId} (${lastErr instanceof Error ? lastErr.message : String(lastErr)})`);\n  }\n\n  /** The Vault is deployed here and wraps through the WETH we pinned. */\n  function verify(chainId: number): Promise<void> {\n    let p = verified.get(chainId);\n    if (!p) {\n      p = (async () => {\n        const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data: encodeFunctionData({abi: VAULT_ABI, functionName: \"WETH\"})}, \"latest\"])) as Hex;\n        const weth = decodeFunctionResult({abi: VAULT_ABI, functionName: \"WETH\", data: raw});\n        if (getAddress(weth) !== getAddress(BALANCER_V2_CHAINS[chainId]!.weth)) throw new Error(`balancer: the Vault on chain ${chainId} is not the pinned deployment — refusing`);\n      })();\n      p.catch(() => verified.delete(chainId));\n      verified.set(chainId, p);\n    }\n    return p;\n  }\n\n  /** Vault.queryBatchSwap on chain: the asset deltas this exact batch would produce. */\n  async function query(chainId: number, swaps: readonly Step[], assets: readonly Hex[], funds: Funds): Promise<readonly bigint[]> {\n    const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"queryBatchSwap\", args: [0, swaps, assets, funds]});\n    const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data}, \"latest\"])) as Hex;\n    return decodeFunctionResult({abi: VAULT_ABI, functionName: \"queryBatchSwap\", data: raw});\n  }\n\n  return {\n    name: \"balancer\",\n    describeActivity: describeBalancerActivity,\n    supportsSameChain: true,\n    enabled: () => config.enabled ?? true,\n    supportsChain: (caip2: string) => chainIdOf(caip2) !== null,\n    supportsChainPair: (from: string, to: string) => from === to && chainIdOf(from) !== null,\n    supportsRoute: (from: Asset, to: Asset) => from.chain === to.chain && chainIdOf(from.chain) !== null,\n\n    async getQuote(params: QuoteParams, signal?: AbortSignal): Promise<Quote | null> {\n      const refuse = (why: string): null => {\n        params.onRefusal?.(`balancer: ${why}`);\n        return null;\n      };\n      if (params.flex) return refuse(\"amount-flexible deposits are not supported\");\n      if (params.sourceChain !== params.destChain) return refuse(\"same-chain swaps only\");\n      const chainId = chainIdOf(params.sourceChain);\n      if (chainId === null) return refuse(`no Balancer v2 Vault or RPC for ${params.sourceChain}`);\n      const chain = BALANCER_V2_CHAINS[chainId]!;\n      const src = sourceAssetOf(params);\n      if (!src) return refuse(`unknown source token ${params.sourceToken}`);\n      const nativeIn = !src.contract;\n      const nativeOut = /^0x0+$/.test(params.destToken);\n      if (!nativeOut && !/^0x[0-9a-fA-F]{40}$/.test(params.destToken)) return refuse(\"destination token must be an EVM address\");\n      if (!/^0x[0-9a-fA-F]{40}$/.test(params.destAddress)) return refuse(\"recipient must be an EVM address\");\n      let amountIn: bigint;\n      try {\n        amountIn = BigInt(params.amountIn);\n      } catch {\n        return refuse(\"amount is not an integer\");\n      }\n      if (amountIn <= 0n) return refuse(\"amount must be positive\");\n      const tokenIn = getAddress(nativeIn ? chain.weth : src.contract!);\n      const tokenOut = getAddress(nativeOut ? chain.weth : params.destToken);\n      if (tokenIn === tokenOut) return refuse(nativeIn || nativeOut ? \"that is a wrap/unwrap, not a swap\" : \"same token in and out\");\n\n      try {\n        await verify(chainId);\n        // 1) Discovery: the SOR's v2 paths (never trusted for price).\n        // Values are inlined (this API ignores GraphQL variables); all are validated\n        // addresses / a decimal number / a fixed enum, so nothing user-shaped is spliced.\n        const query_ = `query { sorGetSwapPaths(chain: ${chain.api}, swapAmount: \"${human(amountIn, src.decimals)}\", swapType: EXACT_IN, tokenIn: \"${tokenIn}\", tokenOut: \"${tokenOut}\", useProtocolVersion: 2) { protocolVersion paths { pools tokens { address decimals } inputAmountRaw outputAmountRaw protocolVersion } } }`;\n        const res = await fetch(api, {\n          method: \"POST\",\n          headers: {\"content-type\": \"application/json\"},\n          body: JSON.stringify({query: query_}),\n          signal: signal ?? timeoutSignal(12_000),\n        });\n        if (!res.ok) return refuse(`SOR answered HTTP ${res.status}`);\n        const body = (await res.json()) as {data?: {sorGetSwapPaths?: {protocolVersion?: number; paths?: SorPath[]}}; errors?: {message?: string}[]};\n        const paths = body.data?.sorGetSwapPaths?.paths ?? [];\n        if (body.errors?.length) return refuse(`SOR: ${body.errors[0]?.message?.slice(0, 120) ?? \"error\"}`);\n        if (!paths.length || paths.some((p) => p.protocolVersion !== 2 || p.pools.length === 0 || p.tokens.length !== p.pools.length + 1)) {\n          return refuse(\"no Balancer v2 pool route for this pair and amount\");\n        }\n        if (paths.reduce((s, p) => s + BigInt(p.inputAmountRaw), 0n) !== amountIn) return refuse(\"the SOR split does not add up to the amount\");\n\n        // 2) Build the batch from the suggested paths.\n        const assets: Hex[] = [];\n        const indexOf = (a: string) => {\n          const addr = getAddress(a);\n          let i = assets.findIndex((x) => x === addr);\n          if (i < 0) i = assets.push(addr) - 1;\n          return BigInt(i);\n        };\n        const swaps: Step[] = [];\n        for (const p of paths) {\n          if (getAddress(p.tokens[0]!.address) !== tokenIn || getAddress(p.tokens[p.tokens.length - 1]!.address) !== tokenOut) return refuse(\"the SOR path does not start/end at the requested tokens\");\n          p.pools.forEach((pool, i) => {\n            if (!/^0x[0-9a-fA-F]{64}$/.test(pool)) throw new Error(\"balancer: malformed pool id from the SOR\");\n            swaps.push({poolId: pool as Hex, assetInIndex: indexOf(p.tokens[i]!.address), assetOutIndex: indexOf(p.tokens[i + 1]!.address), amount: i === 0 ? BigInt(p.inputAmountRaw) : 0n, userData: \"0x\"});\n          });\n        }\n        if (swaps.length > BALANCER_MAX_SWAPS) return refuse(`the SOR route has ${swaps.length} pool hops, more than ${BALANCER_MAX_SWAPS}`);\n        const inIdx = bigintToNumber(indexOf(tokenIn));\n        const outIdx = bigintToNumber(indexOf(tokenOut));\n        // The Vault's ETH sentinel: native in/out wraps/unwraps through its WETH.\n        if (nativeIn || nativeOut) {\n          const wethIdx = assets.findIndex((a) => a === getAddress(chain.weth));\n          if (paths.some((p) => p.tokens.slice(1, -1).some((t) => getAddress(t.address) === getAddress(chain.weth)))) return refuse(\"this route passes through the wrapped native — pick the wrapped token instead\");\n          if (wethIdx >= 0) assets[wethIdx] = ZERO as Hex;\n        }\n        const sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);\n        const recipient = getAddress(params.destAddress);\n        const funds: Funds = {sender, fromInternalBalance: false, recipient, toInternalBalance: false};\n\n        // 3) Price it on-chain — this, not the SOR's number, is the quote.\n        const deltas = await query(chainId, swaps, assets, funds);\n        const paid = deltas[inIdx]!;\n        const out = -deltas[outIdx]!;\n        if (paid !== amountIn) return refuse(`the Vault would take ${paid}, not ${amountIn}`);\n        if (out <= 0n) return refuse(\"the Vault prices this route at zero output\");\n        if (deltas.some((d, i) => i !== inIdx && i !== outIdx && d !== 0n)) return refuse(\"the batch leaves an intermediate balance — refusing\");\n\n        const bps = params.slippageBps ?? slippageDefault;\n        const minOut = (out * BigInt(10_000 - bps)) / 10_000n;\n        if (params.minAmountOut !== undefined && minOut < BigInt(params.minAmountOut)) return refuse(`floor breach (min=${minOut} < floor=${params.minAmountOut})`);\n        const limits = assets.map((_, i) => (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n));\n        const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineS);\n        const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"batchSwap\", args: [0, swaps, assets, funds, limits, deadline]});\n        const gasLimit = 160_000n + 95_000n * BigInt(swaps.length);\n        return {\n          provider: \"balancer\",\n          intentId: `balancer:${chainId}`,\n          depositAddress: \"\",\n          depositMemo: null,\n          txRequest: {\n            to: BALANCER_V2_VAULT,\n            data,\n            value: nativeIn ? amountIn.toString() : \"0\",\n            chainId,\n            gasLimit: gasLimit.toString(),\n            ...(nativeIn ? {} : {approvalAddress: BALANCER_V2_VAULT}),\n          },\n          sourceAmount: amountIn.toString(),\n          destAmount: out.toString(),\n          minDestAmount: minOut.toString(),\n          feeUsd: 0,\n          etaSeconds: 15,\n          reliability: 0.97,\n          validUntilMs: Date.now() + ttl,\n          // Pool swap fees are inside the Vault-priced output; no fee is added on top.\n          providerData: {paths: String(paths.length), hops: String(swaps.length), minOut: minOut.toString(), poolFee: \"pools\"},\n        };\n      } catch (e) {\n        return refuse(e instanceof Error ? e.message.replace(/^balancer: /, \"\") : String(e));\n      }\n    },\n\n    /**\n     * Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum.\n     * Only the quote's own batch is decoded and priced: behind a backend, `tx` is the client's and only the\n     * quote is sealed, so a client's batch (any size, any pools) never reaches the decoder or the RPC\n     * (scan 2026-10-27 modules, F24).\n     */\n    async preflightDeposit(quote: Quote, tx: UnsignedTx): Promise<void> {\n      const chainId = Number(quote.intentId.split(\":\")[1]);\n      const minOut = quote.providerData?.minOut;\n      if (!BALANCER_V2_CHAINS[chainId] || !minOut || !tx.data) return;\n      const quoted = quote.txRequest?.data;\n      if (!quoted || tx.data.length !== quoted.length || tx.data.toLowerCase() !== quoted.toLowerCase()) {\n        throw new Error(\"balancer: the transaction is not the quoted batch. Nothing was sent; refresh the quote.\");\n      }\n      const call = decodeFunctionData({abi: VAULT_ABI, data: quoted as Hex});\n      if (call.functionName !== \"batchSwap\") throw new Error(\"balancer: the transaction is not a Vault batchSwap\");\n      const [, swaps, assets, funds, limits] = call.args;\n      if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) throw new Error(`balancer: the batch has ${swaps.length} pool hops, not 1–${BALANCER_MAX_SWAPS}`);\n      if (swaps.some((step) => step.userData !== \"0x\")) throw new Error(\"balancer: the batch carries pool userData this module never sends\");\n      const outIdx = limits.findIndex((l) => l < 0n);\n      const deltas = await query(chainId, swaps, assets, funds);\n      const out = -deltas[outIdx]!;\n      if (out < BigInt(minOut)) throw new Error(`balancer: price moved — the pools now pay ${out}, under your minimum ${minOut}. Nothing was sent; refresh the quote.`);\n    },\n\n    async buildDeposit(quote: Quote): Promise<UnsignedTx> {\n      const tx = quote.txRequest;\n      if (!tx?.to || !tx.data) throw new Error(\"swap2: Balancer quote has no transaction request\");\n      return {chain: \"\", to: tx.to, value: tx.value ?? \"0\", data: tx.data, ...(tx.chainId !== undefined ? {chainId: tx.chainId} : {}), ...(tx.gasLimit ? {gasLimit: tx.gasLimit} : {}), ...(tx.approvalAddress ? {approvalAddress: tx.approvalAddress} : {})};\n    },\n\n    async trackIntent(ref: IntentRef): Promise<IntentStatus> {\n      if (!ref.sourceTxHash) return {state: \"pending\"};\n      const chainId = Number(ref.intentId.split(\":\")[1]);\n      if (!BALANCER_V2_CHAINS[chainId] || !config.rpcUrls[chainId]?.length) return {state: \"pending\"};\n      try {\n        const receipt = (await rpc(chainId, \"eth_getTransactionReceipt\", [ref.sourceTxHash])) as {status?: string} | null;\n        if (!receipt) return {state: \"pending\"};\n        return receipt.status === \"0x1\" ? {state: \"completed\", destTxHash: ref.sourceTxHash} : {state: \"failed\"};\n      } catch {\n        return {state: \"pending\"};\n      }\n    },\n  };\n}\n\n/**\n * The batch a Balancer quote's Vault call makes, opened on the client against the app's own request (scan 2026-10-28,\n * F2): only `batchSwap` of kind GIVEN_IN on the Vault, with no internal balances and no pool `userData`, at most\n * {@link BALANCER_MAX_SWAPS} hops; funds taken from the sender the provider names (the refund address, else the\n * recipient) and paid to the recipient; every swap that brings in an amount sells the source token (the Vault's ETH\n * sentinel for a native input), the amounts adding up to exactly the input; one hop delivers the destination token;\n * and the limits allow paying exactly the input and receiving at least the quote's minimum, nothing of anything else.\n * `manageUserBalance`, `swap`, `setRelayerApproval` and every other Vault call are refused. The reason it fails, or null.\n */\nexport function balancerVerifyQuote(params: QuoteParams, quote: Quote): string | null {\n  const id = /^eip155:[0-9]+$/.test(params.sourceChain) ? Number(params.sourceChain.slice(7)) : NaN;\n  const chain = Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? BALANCER_V2_CHAINS[id] : undefined;\n  if (!chain || params.destChain !== params.sourceChain) return \"not a same-chain swap on a Balancer v2 chain\";\n  const tx = quote.txRequest;\n  if (!tx?.data || !tx.to || tx.serializedTx !== undefined) return \"the quote carries no Vault call\";\n  if (getAddress(tx.to) !== BALANCER_V2_VAULT) return `the call targets ${tx.to}, not the Vault`;\n  const src = sourceAssetOf(params);\n  if (!src) return `unknown source token ${params.sourceToken}`;\n  const nativeIn = !src.contract;\n  const nativeOut = /^0x0+$/.test(params.destToken);\n  let tokenIn: Hex, tokenOut: Hex, sender: Hex, recipient: Hex, amountIn: bigint, minOut: bigint;\n  try {\n    tokenIn = getAddress(nativeIn ? ZERO : src.contract!);\n    tokenOut = getAddress(nativeOut ? ZERO : params.destToken);\n    recipient = getAddress(params.destAddress);\n    sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);\n    amountIn = BigInt(params.amountIn);\n    minOut = BigInt(quote.minDestAmount);\n  } catch {\n    return \"the request does not name EVM tokens, a recipient and amounts\";\n  }\n  if (nativeIn ? BigInt(tx.value ?? \"0\") !== amountIn || tx.approvalAddress !== undefined\n    : BigInt(tx.value ?? \"0\") !== 0n || !tx.approvalAddress || getAddress(tx.approvalAddress) !== BALANCER_V2_VAULT) {\n    return nativeIn ? \"a native input is paid as exactly the input in value, with no approval\" : \"a token input attaches no value and approves the Vault\";\n  }\n  let call: ReturnType<typeof decodeFunctionData<typeof VAULT_ABI>>;\n  try { call = decodeFunctionData({abi: VAULT_ABI, data: tx.data as Hex}); } catch { return \"the Vault call is not batchSwap\"; }\n  if (call.functionName !== \"batchSwap\") return `${call.functionName} is not batchSwap`;\n  const [kind, swaps, assets, funds, limits] = call.args;\n  if (kind !== 0) return \"the batch is not GIVEN_IN\";\n  if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) return `the batch has ${swaps.length} pool hops, not 1–${BALANCER_MAX_SWAPS}`;\n  if (funds.fromInternalBalance || funds.toInternalBalance) return \"the batch uses Vault internal balances\";\n  if (getAddress(funds.sender) !== sender || getAddress(funds.recipient) !== recipient) return `the batch takes from ${funds.sender} and pays ${funds.recipient}, not this account and the recipient`;\n  const list = assets.map((a) => getAddress(a));\n  if (new Set(list).size !== list.length) return \"the batch names an asset twice\";\n  if ((nativeIn || nativeOut) && list.includes(getAddress(chain.weth))) return \"a native swap passes through the wrapped native\";\n  const inIdx = list.indexOf(tokenIn);\n  const outIdx = list.indexOf(tokenOut);\n  if (inIdx < 0 || outIdx < 0 || inIdx === outIdx) return \"the batch does not trade the requested tokens\";\n  if (limits.length !== list.length || limits.some((l, i) => l !== (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n))) {\n    return \"the limits are not exactly the input in and the quote's minimum out\";\n  }\n  let given = 0n;\n  for (const step of swaps) {\n    if (step.userData !== \"0x\") return \"the batch carries pool userData this module never sends\";\n    if (step.assetInIndex >= BigInt(list.length) || step.assetOutIndex >= BigInt(list.length) || step.assetInIndex === step.assetOutIndex) return \"a hop names no valid asset pair\";\n    if (step.amount > 0n) {\n      if (step.assetInIndex !== BigInt(inIdx)) return \"a hop brings in an amount of another asset than the input\";\n      given += step.amount;\n    }\n  }\n  if (given !== amountIn) return `the hops sell ${given}, not the ${amountIn} input`;\n  if (!swaps.some((step) => step.assetOutIndex === BigInt(outIdx))) return \"no hop delivers the destination token\";\n  if (call.args[5] <= BigInt(Math.floor(Date.now() / 1000))) return \"the batch deadline has passed\";\n  return null;\n}\n\n/**\n * The Balancer V2 Vault a swap calls and approves on the chains this provider serves, and {@link balancerVerifyQuote}\n * — the app's pins for `remoteProvider({name: \"balancer\", baseUrl, ...balancerPins})` (scan 2026-10-27 modules,\n * F8/F16; scan 2026-10-28, F2).\n */\nexport const balancerPins: RemotePins = Object.freeze({\n  callTargets: (chain: string): readonly string[] => balancerVaultFor(chain),\n  spenders: (chain: string): readonly string[] => balancerVaultFor(chain),\n  verifyQuote: balancerVerifyQuote,\n});\nfunction balancerVaultFor(chain: string): readonly string[] {\n  const id = /^eip155:[0-9]+$/.test(chain) ? Number(chain.slice(7)) : NaN;\n  return Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? [BALANCER_V2_VAULT] : [];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,sBAAwD;AACxD,IAAAA,eAA4B;;;ACN5B,kBAA2G;AAE3G,kBAA0D;AAE1D,kBAA6B;AAa7B,IAAM,OAAO;AAEN,IAAM,oBAAoB;AAM1B,IAAM,qBAAqB;AAG3B,IAAM,qBAAmF,OAAO,OAAO;AAAA,EAC5G,GAAG,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACtE,IAAI,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACvE,KAAK,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,SAAS,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,QAAQ,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACxE,OAAO,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EAC3E,OAAO,EAAC,KAAK,aAAa,MAAM,6CAA4C;AAC9E,CAAC;AAED,IAAM,YAAY;AAClB,IAAM,QAAQ;AACd,IAAM,gBAAY,sBAAS;AAAA,EACzB,uCAAuC,SAAS,+BAA+B,KAAK;AAAA,EACpF,kCAAkC,SAAS,+BAA+B,KAAK;AAAA,EAC/E;AACF,CAAC;AA4QM,SAAS,oBAAoB,QAAqB,OAA6B;AACpF,QAAM,KAAK,kBAAkB,KAAK,OAAO,WAAW,IAAI,OAAO,OAAO,YAAY,MAAM,CAAC,CAAC,IAAI;AAC9F,QAAM,QAAQ,OAAO,UAAU,eAAe,KAAK,oBAAoB,EAAE,IAAI,mBAAmB,EAAE,IAAI;AACtG,MAAI,CAAC,SAAS,OAAO,cAAc,OAAO,YAAa,QAAO;AAC9D,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,MAAM,GAAG,iBAAiB,OAAW,QAAO;AACjE,UAAI,wBAAW,GAAG,EAAE,MAAM,kBAAmB,QAAO,oBAAoB,GAAG,EAAE;AAC7E,QAAM,UAAM,2BAAc,MAAM;AAChC,MAAI,CAAC,IAAK,QAAO,wBAAwB,OAAO,WAAW;AAC3D,QAAM,WAAW,CAAC,IAAI;AACtB,QAAM,YAAY,SAAS,KAAK,OAAO,SAAS;AAChD,MAAI,SAAc,UAAe,QAAa,WAAgB,UAAkB;AAChF,MAAI;AACF,kBAAU,wBAAW,WAAW,OAAO,IAAI,QAAS;AACpD,mBAAW,wBAAW,YAAY,OAAO,OAAO,SAAS;AACzD,oBAAY,wBAAW,OAAO,WAAW;AACzC,iBAAS,wBAAW,OAAO,iBAAiB,sBAAsB,KAAK,OAAO,aAAa,IAAI,OAAO,gBAAgB,OAAO,WAAW;AACxI,eAAW,OAAO,OAAO,QAAQ;AACjC,aAAS,OAAO,MAAM,aAAa;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,WAAW,OAAO,GAAG,SAAS,GAAG,MAAM,YAAY,GAAG,oBAAoB,SAC1E,OAAO,GAAG,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,uBAAmB,wBAAW,GAAG,eAAe,MAAM,mBAAmB;AACjH,WAAO,WAAW,2EAA2E;AAAA,EAC/F;AACA,MAAI;AACJ,MAAI;AAAE,eAAO,gCAAmB,EAAC,KAAK,WAAW,MAAM,GAAG,KAAW,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAmC;AAC7H,MAAI,KAAK,iBAAiB,YAAa,QAAO,GAAG,KAAK,YAAY;AAClE,QAAM,CAAC,MAAM,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK;AAClD,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,mBAAoB,QAAO,iBAAiB,MAAM,MAAM,0BAAqB,kBAAkB;AACxI,MAAI,MAAM,uBAAuB,MAAM,kBAAmB,QAAO;AACjE,UAAI,wBAAW,MAAM,MAAM,MAAM,cAAU,wBAAW,MAAM,SAAS,MAAM,UAAW,QAAO,wBAAwB,MAAM,MAAM,aAAa,MAAM,SAAS;AAC7J,QAAM,OAAO,OAAO,IAAI,CAAC,UAAM,wBAAW,CAAC,CAAC;AAC5C,MAAI,IAAI,IAAI,IAAI,EAAE,SAAS,KAAK,OAAQ,QAAO;AAC/C,OAAK,YAAY,cAAc,KAAK,aAAS,wBAAW,MAAM,IAAI,CAAC,EAAG,QAAO;AAC7E,QAAM,QAAQ,KAAK,QAAQ,OAAO;AAClC,QAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,MAAI,QAAQ,KAAK,SAAS,KAAK,UAAU,OAAQ,QAAO;AACxD,MAAI,OAAO,WAAW,KAAK,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,OAAO,MAAM,QAAQ,WAAW,MAAM,SAAS,CAAC,SAAS,GAAG,GAAG;AACxH,WAAO;AAAA,EACT;AACA,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,aAAa,KAAM,QAAO;AACnC,QAAI,KAAK,gBAAgB,OAAO,KAAK,MAAM,KAAK,KAAK,iBAAiB,OAAO,KAAK,MAAM,KAAK,KAAK,iBAAiB,KAAK,cAAe,QAAO;AAC9I,QAAI,KAAK,SAAS,IAAI;AACpB,UAAI,KAAK,iBAAiB,OAAO,KAAK,EAAG,QAAO;AAChD,eAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACA,MAAI,UAAU,SAAU,QAAO,iBAAiB,KAAK,aAAa,QAAQ;AAC1E,MAAI,CAAC,MAAM,KAAK,CAAC,SAAS,KAAK,kBAAkB,OAAO,MAAM,CAAC,EAAG,QAAO;AACzE,MAAI,KAAK,KAAK,CAAC,KAAK,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC,EAAG,QAAO;AAClE,SAAO;AACT;AAOO,IAAM,eAA2B,OAAO,OAAO;AAAA,EACpD,aAAa,CAAC,UAAqC,iBAAiB,KAAK;AAAA,EACzE,UAAU,CAAC,UAAqC,iBAAiB,KAAK;AAAA,EACtE,aAAa;AACf,CAAC;AACD,SAAS,iBAAiB,OAAkC;AAC1D,QAAM,KAAK,kBAAkB,KAAK,KAAK,IAAI,OAAO,MAAM,MAAM,CAAC,CAAC,IAAI;AACpE,SAAO,OAAO,UAAU,eAAe,KAAK,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;AAC/F;;;ADxXO,IAAM,kBAAkB;AAGxB,IAAM,2BAAgD,oBAAI,IAAI;AAAA,EACnE;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAEM,SAAS,yBAAyB,IAAa,KAAmD;AACvG,MAAI,KAAC,oBAAM,GAAG,KAAK,KAAK,CAAC,uBAAmB,qBAAO,GAAG,KAAK,CAAC,EAAG,QAAO;AACtE,MAAI,KAAC,6BAAY,IAAI,CAAC,iBAAiB,GAAG,wBAAwB,EAAG,QAAO;AAC5E,aAAO,kCAAiB,IAAI,KAAK,EAAC,UAAU,iBAAiB,UAAU,wBAAiB,4BAAW,GAAG,KAAK,CAAC,IAAI,MAAM,OAAM,CAAC;AAC/H;","names":["import_util"]}

package/dist/activity.js

@@ -2,7 +2,7 @@ import {
   BALANCER_MODULE,
   BALANCER_VAULT_SELECTORS,
   describeBalancerActivity
-} from "./chunk-3YTDA5OS.js";
+} from "./chunk-YF3UW4GH.js";
 export {
   BALANCER_MODULE,
   BALANCER_VAULT_SELECTORS,

package/dist/{chunk-E2XTZEXA.js → chunk-JFRZJ6N5.js}

@@ -1,7 +1,7 @@
 import {
   BALANCER_V2_CHAINS,
   balancerProvider
-} from "./chunk-3YTDA5OS.js";
+} from "./chunk-YF3UW4GH.js";
 
 // src/protocol.ts
 import { SingleProviderSwap2 } from "@anywalletkit/protocol-swap2-core/swap2/single";
@@ -25,4 +25,4 @@ var BalancerSwap2Protocol = class extends SingleProviderSwap2 {
 export {
   BalancerSwap2Protocol
 };
-//# sourceMappingURL=chunk-E2XTZEXA.js.map
+//# sourceMappingURL=chunk-JFRZJ6N5.js.map

package/dist/{chunk-3YTDA5OS.js → chunk-YF3UW4GH.js}

@@ -12,6 +12,7 @@ var DEFAULT_API = "https://api-v3.balancer.fi/";
 var DEFAULT_SLIPPAGE_BPS = 50;
 var DEFAULT_TTL_MS = 3e5;
 var DEFAULT_DEADLINE_S = 600;
+var BALANCER_MAX_SWAPS = 16;
 var BALANCER_V2_CHAINS = Object.freeze({
   1: { api: "MAINNET", weth: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" },
   10: { api: "OPTIMISM", weth: "0x4200000000000000000000000000000000000006" },
@@ -147,6 +148,7 @@ function balancerProvider(config) {
             swaps.push({ poolId: pool, assetInIndex: indexOf(p.tokens[i].address), assetOutIndex: indexOf(p.tokens[i + 1].address), amount: i === 0 ? BigInt(p.inputAmountRaw) : 0n, userData: "0x" });
           });
         }
+        if (swaps.length > BALANCER_MAX_SWAPS) return refuse(`the SOR route has ${swaps.length} pool hops, more than ${BALANCER_MAX_SWAPS}`);
         const inIdx = bigintToNumber(indexOf(tokenIn));
         const outIdx = bigintToNumber(indexOf(tokenOut));
         if (nativeIn || nativeOut) {
@@ -197,14 +199,25 @@ function balancerProvider(config) {
         return refuse(e instanceof Error ? e.message.replace(/^balancer: /, "") : String(e));
       }
     },
-    /** Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum. */
+    /**
+     * Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum.
+     * Only the quote's own batch is decoded and priced: behind a backend, `tx` is the client's and only the
+     * quote is sealed, so a client's batch (any size, any pools) never reaches the decoder or the RPC
+     * (scan 2026-10-27 modules, F24).
+     */
     async preflightDeposit(quote, tx) {
       const chainId = Number(quote.intentId.split(":")[1]);
       const minOut = quote.providerData?.minOut;
       if (!BALANCER_V2_CHAINS[chainId] || !minOut || !tx.data) return;
-      const call = decodeFunctionData({ abi: VAULT_ABI, data: tx.data });
+      const quoted = quote.txRequest?.data;
+      if (!quoted || tx.data.length !== quoted.length || tx.data.toLowerCase() !== quoted.toLowerCase()) {
+        throw new Error("balancer: the transaction is not the quoted batch. Nothing was sent; refresh the quote.");
+      }
+      const call = decodeFunctionData({ abi: VAULT_ABI, data: quoted });
       if (call.functionName !== "batchSwap") throw new Error("balancer: the transaction is not a Vault batchSwap");
       const [, swaps, assets, funds, limits] = call.args;
+      if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) throw new Error(`balancer: the batch has ${swaps.length} pool hops, not 1\u2013${BALANCER_MAX_SWAPS}`);
+      if (swaps.some((step) => step.userData !== "0x")) throw new Error("balancer: the batch carries pool userData this module never sends");
       const outIdx = limits.findIndex((l) => l < 0n);
       const deltas = await query(chainId, swaps, assets, funds);
       const out = -deltas[outIdx];
@@ -229,6 +242,75 @@ function balancerProvider(config) {
     }
   };
 }
+function balancerVerifyQuote(params, quote) {
+  const id = /^eip155:[0-9]+$/.test(params.sourceChain) ? Number(params.sourceChain.slice(7)) : NaN;
+  const chain = Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? BALANCER_V2_CHAINS[id] : void 0;
+  if (!chain || params.destChain !== params.sourceChain) return "not a same-chain swap on a Balancer v2 chain";
+  const tx = quote.txRequest;
+  if (!tx?.data || !tx.to || tx.serializedTx !== void 0) return "the quote carries no Vault call";
+  if (getAddress(tx.to) !== BALANCER_V2_VAULT) return `the call targets ${tx.to}, not the Vault`;
+  const src = sourceAssetOf(params);
+  if (!src) return `unknown source token ${params.sourceToken}`;
+  const nativeIn = !src.contract;
+  const nativeOut = /^0x0+$/.test(params.destToken);
+  let tokenIn, tokenOut, sender, recipient, amountIn, minOut;
+  try {
+    tokenIn = getAddress(nativeIn ? ZERO : src.contract);
+    tokenOut = getAddress(nativeOut ? ZERO : params.destToken);
+    recipient = getAddress(params.destAddress);
+    sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);
+    amountIn = BigInt(params.amountIn);
+    minOut = BigInt(quote.minDestAmount);
+  } catch {
+    return "the request does not name EVM tokens, a recipient and amounts";
+  }
+  if (nativeIn ? BigInt(tx.value ?? "0") !== amountIn || tx.approvalAddress !== void 0 : BigInt(tx.value ?? "0") !== 0n || !tx.approvalAddress || getAddress(tx.approvalAddress) !== BALANCER_V2_VAULT) {
+    return nativeIn ? "a native input is paid as exactly the input in value, with no approval" : "a token input attaches no value and approves the Vault";
+  }
+  let call;
+  try {
+    call = decodeFunctionData({ abi: VAULT_ABI, data: tx.data });
+  } catch {
+    return "the Vault call is not batchSwap";
+  }
+  if (call.functionName !== "batchSwap") return `${call.functionName} is not batchSwap`;
+  const [kind, swaps, assets, funds, limits] = call.args;
+  if (kind !== 0) return "the batch is not GIVEN_IN";
+  if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) return `the batch has ${swaps.length} pool hops, not 1\u2013${BALANCER_MAX_SWAPS}`;
+  if (funds.fromInternalBalance || funds.toInternalBalance) return "the batch uses Vault internal balances";
+  if (getAddress(funds.sender) !== sender || getAddress(funds.recipient) !== recipient) return `the batch takes from ${funds.sender} and pays ${funds.recipient}, not this account and the recipient`;
+  const list = assets.map((a) => getAddress(a));
+  if (new Set(list).size !== list.length) return "the batch names an asset twice";
+  if ((nativeIn || nativeOut) && list.includes(getAddress(chain.weth))) return "a native swap passes through the wrapped native";
+  const inIdx = list.indexOf(tokenIn);
+  const outIdx = list.indexOf(tokenOut);
+  if (inIdx < 0 || outIdx < 0 || inIdx === outIdx) return "the batch does not trade the requested tokens";
+  if (limits.length !== list.length || limits.some((l, i) => l !== (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n))) {
+    return "the limits are not exactly the input in and the quote's minimum out";
+  }
+  let given = 0n;
+  for (const step of swaps) {
+    if (step.userData !== "0x") return "the batch carries pool userData this module never sends";
+    if (step.assetInIndex >= BigInt(list.length) || step.assetOutIndex >= BigInt(list.length) || step.assetInIndex === step.assetOutIndex) return "a hop names no valid asset pair";
+    if (step.amount > 0n) {
+      if (step.assetInIndex !== BigInt(inIdx)) return "a hop brings in an amount of another asset than the input";
+      given += step.amount;
+    }
+  }
+  if (given !== amountIn) return `the hops sell ${given}, not the ${amountIn} input`;
+  if (!swaps.some((step) => step.assetOutIndex === BigInt(outIdx))) return "no hop delivers the destination token";
+  if (call.args[5] <= BigInt(Math.floor(Date.now() / 1e3))) return "the batch deadline has passed";
+  return null;
+}
+var balancerPins = Object.freeze({
+  callTargets: (chain) => balancerVaultFor(chain),
+  spenders: (chain) => balancerVaultFor(chain),
+  verifyQuote: balancerVerifyQuote
+});
+function balancerVaultFor(chain) {
+  const id = /^eip155:[0-9]+$/.test(chain) ? Number(chain.slice(7)) : NaN;
+  return Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? [BALANCER_V2_VAULT] : [];
+}
 
 // src/activity.ts
 var BALANCER_MODULE = "@anywalletkit/protocol-swap2-balancer";
@@ -249,7 +331,10 @@ export {
   BALANCER_VAULT_SELECTORS,
   describeBalancerActivity,
   BALANCER_V2_VAULT,
+  BALANCER_MAX_SWAPS,
   BALANCER_V2_CHAINS,
-  balancerProvider
+  balancerProvider,
+  balancerVerifyQuote,
+  balancerPins
 };
-//# sourceMappingURL=chunk-3YTDA5OS.js.map
+//# sourceMappingURL=chunk-YF3UW4GH.js.map

package/dist/chunk-YF3UW4GH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/activity.ts","../src/provider.ts"],"sourcesContent":["/**\n * Activity recognition for Balancer v2: `swap` / `batchSwap` on the Vault\n * (one address on every chain) on a chain the module serves → `swap`,\n * \"Swapped A → B\" from the owner's net transfers.\n */\nimport type {ActivityItem, ChainTx, DescribeActivityContext} from \"@anywalletkit/core\";\nimport {chainLabel, describeSwapLike, matchesCall} from \"@anywalletkit/protocol-swap2-core/activity\";\nimport {evmRef, isEvm} from \"@anywalletkit/protocol-swap2-core/util\";\nimport {BALANCER_V2_CHAINS, BALANCER_V2_VAULT} from \"./provider.js\";\n\nexport const BALANCER_MODULE = \"@anywalletkit/protocol-swap2-balancer\";\n\n/** Vault swap entry points (`viem toFunctionSelector`, 2026-10-14). */\nexport const BALANCER_VAULT_SELECTORS: ReadonlySet<string> = new Set([\n  \"0x945bcec9\", // batchSwap(uint8,(bytes32,uint256,uint256,uint256,bytes)[],address[],(address,bool,address,bool),int256[],uint256)\n  \"0x52bbbe29\", // swap((bytes32,uint8,address,address,uint256,bytes),(address,bool,address,bool),uint256,uint256)\n]);\n\nexport function describeBalancerActivity(tx: ChainTx, ctx: DescribeActivityContext): ActivityItem | null {\n  if (!isEvm(tx.chain) || !BALANCER_V2_CHAINS[evmRef(tx.chain)]) return null;\n  if (!matchesCall(tx, [BALANCER_V2_VAULT], BALANCER_VAULT_SELECTORS)) return null;\n  return describeSwapLike(tx, ctx, {protocol: BALANCER_MODULE, subtitle: `Balancer v2 · ${chainLabel(tx.chain)}`, kind: \"swap\"});\n}\n","import type {RemotePins} from \"@anywalletkit/protocol-swap2-core/types\";\nimport {decodeFunctionData, decodeFunctionResult, encodeFunctionData, getAddress, parseAbi, type Hex} from \"viem\";\nimport {describeBalancerActivity} from \"./activity.js\";\nimport {evmRef, isEvm, timeoutSignal, sourceAssetOf} from \"@anywalletkit/protocol-swap2-core/util\";\nimport type {Asset, CrossChainProvider, IntentRef, IntentStatus, Quote, QuoteParams, UnsignedTx} from \"@anywalletkit/protocol-swap2-core/types\";\nimport {bigintToNumber} from \"@anywalletkit/core\";\n\n/**\n * Balancer v2 — the cp0x permissionless Balancer venue (balancer.cp0x.com).\n *\n * Discovery only from the API: Balancer's SOR (`sorGetSwapPaths`, v2 pools)\n * suggests the path. Everything on the money path is on-chain: the Vault\n * prices that exact path (`queryBatchSwap` via eth_call), the quote uses the\n * Vault's number, and `batchSwap` carries `limits` (in ≤ amountIn, out ≥ min)\n * plus a deadline — the Vault itself refuses anything worse. Native coins use\n * the Vault's own ETH sentinel (address 0): it wraps/unwraps through WETH.\n */\n\nconst ZERO = \"0x0000000000000000000000000000000000000000\";\n/** The same Balancer v2 Vault address on every chain it is deployed on. */\nexport const BALANCER_V2_VAULT = \"0xBA12222222228d8Ba445958a75a0704d566BF2C8\";\nconst DEFAULT_API = \"https://api-v3.balancer.fi/\";\nconst DEFAULT_SLIPPAGE_BPS = 50;\nconst DEFAULT_TTL_MS = 300_000;\nconst DEFAULT_DEADLINE_S = 600;\n/** Most pool hops one batch may carry: the SOR's splits are a handful; a batch past this is refused at quote and at preflight. */\nexport const BALANCER_MAX_SWAPS = 16;\n\n/** Chains where the v2 Vault is live, with the SOR API name and the Vault's WETH() (verified on-chain 2026-10-13). */\nexport const BALANCER_V2_CHAINS: Readonly<Record<number, {api: string; weth: `0x${string}`}>> = Object.freeze({\n  1: {api: \"MAINNET\", weth: \"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2\"},\n  10: {api: \"OPTIMISM\", weth: \"0x4200000000000000000000000000000000000006\"},\n  100: {api: \"GNOSIS\", weth: \"0xe91D153E0b41518A2Ce8Dd3D7944Fa863463a97d\"},\n  137: {api: \"POLYGON\", weth: \"0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270\"},\n  146: {api: \"SONIC\", weth: \"0x039e2fB66102314Ce7b64Ce5Ce3E5183bc94aD38\"},\n  8453: {api: \"BASE\", weth: \"0x4200000000000000000000000000000000000006\"},\n  9745: {api: \"PLASMA\", weth: \"0x6100E367285b01F48D07953803A2d8dCA5D19873\"},\n  42161: {api: \"ARBITRUM\", weth: \"0x82aF49447D8a07e3bd95BD0d56f35241523fBab1\"},\n  43114: {api: \"AVALANCHE\", weth: \"0xB31f66AA3C1e785363F0875A1B74E27b85FD66c7\"},\n});\n\nconst SWAP_STEP = \"(bytes32 poolId, uint256 assetInIndex, uint256 assetOutIndex, uint256 amount, bytes userData)\";\nconst FUNDS = \"(address sender, bool fromInternalBalance, address recipient, bool toInternalBalance)\";\nconst VAULT_ABI = parseAbi([\n  `function queryBatchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds) returns (int256[] assetDeltas)`,\n  `function batchSwap(uint8 kind, ${SWAP_STEP}[] swaps, address[] assets, ${FUNDS} funds, int256[] limits, uint256 deadline) payable returns (int256[] assetDeltas)`,\n  \"function WETH() view returns (address)\",\n]);\n\ntype Step = {poolId: Hex; assetInIndex: bigint; assetOutIndex: bigint; amount: bigint; userData: Hex};\ntype Funds = {sender: Hex; fromInternalBalance: boolean; recipient: Hex; toInternalBalance: boolean};\n\nexport interface BalancerProviderConfig {\n  enabled?: boolean;\n  /** JSON-RPC endpoints per EVM chain id (on-chain pricing + receipts). */\n  rpcUrls: Readonly<Record<number, readonly string[]>>;\n  /** Balancer API (SOR) base URL — discovery only. */\n  apiUrl?: string;\n  defaultSlippageBps?: number;\n  quoteTtlMs?: number;\n  deadlineSeconds?: number;\n}\n\ninterface SorPath {\n  pools: string[];\n  tokens: {address: string; decimals: number}[];\n  inputAmountRaw: string;\n  outputAmountRaw: string;\n  protocolVersion: number;\n}\n\n/** Base units → the decimal string the SOR expects (\"1.5\"). */\nfunction human(amount: bigint, decimals: number): string {\n  const s = amount.toString().padStart(decimals + 1, \"0\");\n  const whole = s.slice(0, s.length - decimals);\n  const frac = s.slice(s.length - decimals).replace(/0+$/, \"\");\n  return frac ? `${whole}.${frac}` : whole;\n}\n\nexport function balancerProvider(config: BalancerProviderConfig): CrossChainProvider {\n  const api = config.apiUrl ?? DEFAULT_API;\n  const slippageDefault = config.defaultSlippageBps ?? DEFAULT_SLIPPAGE_BPS;\n  const ttl = config.quoteTtlMs ?? DEFAULT_TTL_MS;\n  const deadlineS = config.deadlineSeconds ?? DEFAULT_DEADLINE_S;\n  const verified = new Map<number, Promise<void>>();\n\n  const chainIdOf = (caip2: string): number | null => {\n    if (!isEvm(caip2)) return null;\n    const id = evmRef(caip2);\n    return BALANCER_V2_CHAINS[id] && config.rpcUrls[id]?.length ? id : null;\n  };\n\n  async function rpc(chainId: number, method: string, params: unknown[]): Promise<unknown> {\n    let lastErr: unknown;\n    for (const url of config.rpcUrls[chainId] ?? []) {\n      try {\n        const res = await fetch(url, {method: \"POST\", headers: {\"content-type\": \"application/json\"}, body: JSON.stringify({jsonrpc: \"2.0\", id: 1, method, params}), signal: timeoutSignal(12_000)});\n        if (!res.ok) throw new Error(`HTTP ${res.status}`);\n        const body = (await res.json()) as {result?: unknown; error?: {message?: string}};\n        if (body.error) throw Object.assign(new Error(body.error.message ?? \"rpc error\"), {rpc: true});\n        return body.result ?? null;\n      } catch (e) {\n        if ((e as {rpc?: boolean}).rpc) throw e; // a revert is an answer, not a dead endpoint\n        lastErr = e;\n      }\n    }\n    throw new Error(`balancer: no RPC answered on chain ${chainId} (${lastErr instanceof Error ? lastErr.message : String(lastErr)})`);\n  }\n\n  /** The Vault is deployed here and wraps through the WETH we pinned. */\n  function verify(chainId: number): Promise<void> {\n    let p = verified.get(chainId);\n    if (!p) {\n      p = (async () => {\n        const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data: encodeFunctionData({abi: VAULT_ABI, functionName: \"WETH\"})}, \"latest\"])) as Hex;\n        const weth = decodeFunctionResult({abi: VAULT_ABI, functionName: \"WETH\", data: raw});\n        if (getAddress(weth) !== getAddress(BALANCER_V2_CHAINS[chainId]!.weth)) throw new Error(`balancer: the Vault on chain ${chainId} is not the pinned deployment — refusing`);\n      })();\n      p.catch(() => verified.delete(chainId));\n      verified.set(chainId, p);\n    }\n    return p;\n  }\n\n  /** Vault.queryBatchSwap on chain: the asset deltas this exact batch would produce. */\n  async function query(chainId: number, swaps: readonly Step[], assets: readonly Hex[], funds: Funds): Promise<readonly bigint[]> {\n    const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"queryBatchSwap\", args: [0, swaps, assets, funds]});\n    const raw = (await rpc(chainId, \"eth_call\", [{to: BALANCER_V2_VAULT, data}, \"latest\"])) as Hex;\n    return decodeFunctionResult({abi: VAULT_ABI, functionName: \"queryBatchSwap\", data: raw});\n  }\n\n  return {\n    name: \"balancer\",\n    describeActivity: describeBalancerActivity,\n    supportsSameChain: true,\n    enabled: () => config.enabled ?? true,\n    supportsChain: (caip2: string) => chainIdOf(caip2) !== null,\n    supportsChainPair: (from: string, to: string) => from === to && chainIdOf(from) !== null,\n    supportsRoute: (from: Asset, to: Asset) => from.chain === to.chain && chainIdOf(from.chain) !== null,\n\n    async getQuote(params: QuoteParams, signal?: AbortSignal): Promise<Quote | null> {\n      const refuse = (why: string): null => {\n        params.onRefusal?.(`balancer: ${why}`);\n        return null;\n      };\n      if (params.flex) return refuse(\"amount-flexible deposits are not supported\");\n      if (params.sourceChain !== params.destChain) return refuse(\"same-chain swaps only\");\n      const chainId = chainIdOf(params.sourceChain);\n      if (chainId === null) return refuse(`no Balancer v2 Vault or RPC for ${params.sourceChain}`);\n      const chain = BALANCER_V2_CHAINS[chainId]!;\n      const src = sourceAssetOf(params);\n      if (!src) return refuse(`unknown source token ${params.sourceToken}`);\n      const nativeIn = !src.contract;\n      const nativeOut = /^0x0+$/.test(params.destToken);\n      if (!nativeOut && !/^0x[0-9a-fA-F]{40}$/.test(params.destToken)) return refuse(\"destination token must be an EVM address\");\n      if (!/^0x[0-9a-fA-F]{40}$/.test(params.destAddress)) return refuse(\"recipient must be an EVM address\");\n      let amountIn: bigint;\n      try {\n        amountIn = BigInt(params.amountIn);\n      } catch {\n        return refuse(\"amount is not an integer\");\n      }\n      if (amountIn <= 0n) return refuse(\"amount must be positive\");\n      const tokenIn = getAddress(nativeIn ? chain.weth : src.contract!);\n      const tokenOut = getAddress(nativeOut ? chain.weth : params.destToken);\n      if (tokenIn === tokenOut) return refuse(nativeIn || nativeOut ? \"that is a wrap/unwrap, not a swap\" : \"same token in and out\");\n\n      try {\n        await verify(chainId);\n        // 1) Discovery: the SOR's v2 paths (never trusted for price).\n        // Values are inlined (this API ignores GraphQL variables); all are validated\n        // addresses / a decimal number / a fixed enum, so nothing user-shaped is spliced.\n        const query_ = `query { sorGetSwapPaths(chain: ${chain.api}, swapAmount: \"${human(amountIn, src.decimals)}\", swapType: EXACT_IN, tokenIn: \"${tokenIn}\", tokenOut: \"${tokenOut}\", useProtocolVersion: 2) { protocolVersion paths { pools tokens { address decimals } inputAmountRaw outputAmountRaw protocolVersion } } }`;\n        const res = await fetch(api, {\n          method: \"POST\",\n          headers: {\"content-type\": \"application/json\"},\n          body: JSON.stringify({query: query_}),\n          signal: signal ?? timeoutSignal(12_000),\n        });\n        if (!res.ok) return refuse(`SOR answered HTTP ${res.status}`);\n        const body = (await res.json()) as {data?: {sorGetSwapPaths?: {protocolVersion?: number; paths?: SorPath[]}}; errors?: {message?: string}[]};\n        const paths = body.data?.sorGetSwapPaths?.paths ?? [];\n        if (body.errors?.length) return refuse(`SOR: ${body.errors[0]?.message?.slice(0, 120) ?? \"error\"}`);\n        if (!paths.length || paths.some((p) => p.protocolVersion !== 2 || p.pools.length === 0 || p.tokens.length !== p.pools.length + 1)) {\n          return refuse(\"no Balancer v2 pool route for this pair and amount\");\n        }\n        if (paths.reduce((s, p) => s + BigInt(p.inputAmountRaw), 0n) !== amountIn) return refuse(\"the SOR split does not add up to the amount\");\n\n        // 2) Build the batch from the suggested paths.\n        const assets: Hex[] = [];\n        const indexOf = (a: string) => {\n          const addr = getAddress(a);\n          let i = assets.findIndex((x) => x === addr);\n          if (i < 0) i = assets.push(addr) - 1;\n          return BigInt(i);\n        };\n        const swaps: Step[] = [];\n        for (const p of paths) {\n          if (getAddress(p.tokens[0]!.address) !== tokenIn || getAddress(p.tokens[p.tokens.length - 1]!.address) !== tokenOut) return refuse(\"the SOR path does not start/end at the requested tokens\");\n          p.pools.forEach((pool, i) => {\n            if (!/^0x[0-9a-fA-F]{64}$/.test(pool)) throw new Error(\"balancer: malformed pool id from the SOR\");\n            swaps.push({poolId: pool as Hex, assetInIndex: indexOf(p.tokens[i]!.address), assetOutIndex: indexOf(p.tokens[i + 1]!.address), amount: i === 0 ? BigInt(p.inputAmountRaw) : 0n, userData: \"0x\"});\n          });\n        }\n        if (swaps.length > BALANCER_MAX_SWAPS) return refuse(`the SOR route has ${swaps.length} pool hops, more than ${BALANCER_MAX_SWAPS}`);\n        const inIdx = bigintToNumber(indexOf(tokenIn));\n        const outIdx = bigintToNumber(indexOf(tokenOut));\n        // The Vault's ETH sentinel: native in/out wraps/unwraps through its WETH.\n        if (nativeIn || nativeOut) {\n          const wethIdx = assets.findIndex((a) => a === getAddress(chain.weth));\n          if (paths.some((p) => p.tokens.slice(1, -1).some((t) => getAddress(t.address) === getAddress(chain.weth)))) return refuse(\"this route passes through the wrapped native — pick the wrapped token instead\");\n          if (wethIdx >= 0) assets[wethIdx] = ZERO as Hex;\n        }\n        const sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);\n        const recipient = getAddress(params.destAddress);\n        const funds: Funds = {sender, fromInternalBalance: false, recipient, toInternalBalance: false};\n\n        // 3) Price it on-chain — this, not the SOR's number, is the quote.\n        const deltas = await query(chainId, swaps, assets, funds);\n        const paid = deltas[inIdx]!;\n        const out = -deltas[outIdx]!;\n        if (paid !== amountIn) return refuse(`the Vault would take ${paid}, not ${amountIn}`);\n        if (out <= 0n) return refuse(\"the Vault prices this route at zero output\");\n        if (deltas.some((d, i) => i !== inIdx && i !== outIdx && d !== 0n)) return refuse(\"the batch leaves an intermediate balance — refusing\");\n\n        const bps = params.slippageBps ?? slippageDefault;\n        const minOut = (out * BigInt(10_000 - bps)) / 10_000n;\n        if (params.minAmountOut !== undefined && minOut < BigInt(params.minAmountOut)) return refuse(`floor breach (min=${minOut} < floor=${params.minAmountOut})`);\n        const limits = assets.map((_, i) => (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n));\n        const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineS);\n        const data = encodeFunctionData({abi: VAULT_ABI, functionName: \"batchSwap\", args: [0, swaps, assets, funds, limits, deadline]});\n        const gasLimit = 160_000n + 95_000n * BigInt(swaps.length);\n        return {\n          provider: \"balancer\",\n          intentId: `balancer:${chainId}`,\n          depositAddress: \"\",\n          depositMemo: null,\n          txRequest: {\n            to: BALANCER_V2_VAULT,\n            data,\n            value: nativeIn ? amountIn.toString() : \"0\",\n            chainId,\n            gasLimit: gasLimit.toString(),\n            ...(nativeIn ? {} : {approvalAddress: BALANCER_V2_VAULT}),\n          },\n          sourceAmount: amountIn.toString(),\n          destAmount: out.toString(),\n          minDestAmount: minOut.toString(),\n          feeUsd: 0,\n          etaSeconds: 15,\n          reliability: 0.97,\n          validUntilMs: Date.now() + ttl,\n          // Pool swap fees are inside the Vault-priced output; no fee is added on top.\n          providerData: {paths: String(paths.length), hops: String(swaps.length), minOut: minOut.toString(), poolFee: \"pools\"},\n        };\n      } catch (e) {\n        return refuse(e instanceof Error ? e.message.replace(/^balancer: /, \"\") : String(e));\n      }\n    },\n\n    /**\n     * Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum.\n     * Only the quote's own batch is decoded and priced: behind a backend, `tx` is the client's and only the\n     * quote is sealed, so a client's batch (any size, any pools) never reaches the decoder or the RPC\n     * (scan 2026-10-27 modules, F24).\n     */\n    async preflightDeposit(quote: Quote, tx: UnsignedTx): Promise<void> {\n      const chainId = Number(quote.intentId.split(\":\")[1]);\n      const minOut = quote.providerData?.minOut;\n      if (!BALANCER_V2_CHAINS[chainId] || !minOut || !tx.data) return;\n      const quoted = quote.txRequest?.data;\n      if (!quoted || tx.data.length !== quoted.length || tx.data.toLowerCase() !== quoted.toLowerCase()) {\n        throw new Error(\"balancer: the transaction is not the quoted batch. Nothing was sent; refresh the quote.\");\n      }\n      const call = decodeFunctionData({abi: VAULT_ABI, data: quoted as Hex});\n      if (call.functionName !== \"batchSwap\") throw new Error(\"balancer: the transaction is not a Vault batchSwap\");\n      const [, swaps, assets, funds, limits] = call.args;\n      if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) throw new Error(`balancer: the batch has ${swaps.length} pool hops, not 1–${BALANCER_MAX_SWAPS}`);\n      if (swaps.some((step) => step.userData !== \"0x\")) throw new Error(\"balancer: the batch carries pool userData this module never sends\");\n      const outIdx = limits.findIndex((l) => l < 0n);\n      const deltas = await query(chainId, swaps, assets, funds);\n      const out = -deltas[outIdx]!;\n      if (out < BigInt(minOut)) throw new Error(`balancer: price moved — the pools now pay ${out}, under your minimum ${minOut}. Nothing was sent; refresh the quote.`);\n    },\n\n    async buildDeposit(quote: Quote): Promise<UnsignedTx> {\n      const tx = quote.txRequest;\n      if (!tx?.to || !tx.data) throw new Error(\"swap2: Balancer quote has no transaction request\");\n      return {chain: \"\", to: tx.to, value: tx.value ?? \"0\", data: tx.data, ...(tx.chainId !== undefined ? {chainId: tx.chainId} : {}), ...(tx.gasLimit ? {gasLimit: tx.gasLimit} : {}), ...(tx.approvalAddress ? {approvalAddress: tx.approvalAddress} : {})};\n    },\n\n    async trackIntent(ref: IntentRef): Promise<IntentStatus> {\n      if (!ref.sourceTxHash) return {state: \"pending\"};\n      const chainId = Number(ref.intentId.split(\":\")[1]);\n      if (!BALANCER_V2_CHAINS[chainId] || !config.rpcUrls[chainId]?.length) return {state: \"pending\"};\n      try {\n        const receipt = (await rpc(chainId, \"eth_getTransactionReceipt\", [ref.sourceTxHash])) as {status?: string} | null;\n        if (!receipt) return {state: \"pending\"};\n        return receipt.status === \"0x1\" ? {state: \"completed\", destTxHash: ref.sourceTxHash} : {state: \"failed\"};\n      } catch {\n        return {state: \"pending\"};\n      }\n    },\n  };\n}\n\n/**\n * The batch a Balancer quote's Vault call makes, opened on the client against the app's own request (scan 2026-10-28,\n * F2): only `batchSwap` of kind GIVEN_IN on the Vault, with no internal balances and no pool `userData`, at most\n * {@link BALANCER_MAX_SWAPS} hops; funds taken from the sender the provider names (the refund address, else the\n * recipient) and paid to the recipient; every swap that brings in an amount sells the source token (the Vault's ETH\n * sentinel for a native input), the amounts adding up to exactly the input; one hop delivers the destination token;\n * and the limits allow paying exactly the input and receiving at least the quote's minimum, nothing of anything else.\n * `manageUserBalance`, `swap`, `setRelayerApproval` and every other Vault call are refused. The reason it fails, or null.\n */\nexport function balancerVerifyQuote(params: QuoteParams, quote: Quote): string | null {\n  const id = /^eip155:[0-9]+$/.test(params.sourceChain) ? Number(params.sourceChain.slice(7)) : NaN;\n  const chain = Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? BALANCER_V2_CHAINS[id] : undefined;\n  if (!chain || params.destChain !== params.sourceChain) return \"not a same-chain swap on a Balancer v2 chain\";\n  const tx = quote.txRequest;\n  if (!tx?.data || !tx.to || tx.serializedTx !== undefined) return \"the quote carries no Vault call\";\n  if (getAddress(tx.to) !== BALANCER_V2_VAULT) return `the call targets ${tx.to}, not the Vault`;\n  const src = sourceAssetOf(params);\n  if (!src) return `unknown source token ${params.sourceToken}`;\n  const nativeIn = !src.contract;\n  const nativeOut = /^0x0+$/.test(params.destToken);\n  let tokenIn: Hex, tokenOut: Hex, sender: Hex, recipient: Hex, amountIn: bigint, minOut: bigint;\n  try {\n    tokenIn = getAddress(nativeIn ? ZERO : src.contract!);\n    tokenOut = getAddress(nativeOut ? ZERO : params.destToken);\n    recipient = getAddress(params.destAddress);\n    sender = getAddress(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);\n    amountIn = BigInt(params.amountIn);\n    minOut = BigInt(quote.minDestAmount);\n  } catch {\n    return \"the request does not name EVM tokens, a recipient and amounts\";\n  }\n  if (nativeIn ? BigInt(tx.value ?? \"0\") !== amountIn || tx.approvalAddress !== undefined\n    : BigInt(tx.value ?? \"0\") !== 0n || !tx.approvalAddress || getAddress(tx.approvalAddress) !== BALANCER_V2_VAULT) {\n    return nativeIn ? \"a native input is paid as exactly the input in value, with no approval\" : \"a token input attaches no value and approves the Vault\";\n  }\n  let call: ReturnType<typeof decodeFunctionData<typeof VAULT_ABI>>;\n  try { call = decodeFunctionData({abi: VAULT_ABI, data: tx.data as Hex}); } catch { return \"the Vault call is not batchSwap\"; }\n  if (call.functionName !== \"batchSwap\") return `${call.functionName} is not batchSwap`;\n  const [kind, swaps, assets, funds, limits] = call.args;\n  if (kind !== 0) return \"the batch is not GIVEN_IN\";\n  if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) return `the batch has ${swaps.length} pool hops, not 1–${BALANCER_MAX_SWAPS}`;\n  if (funds.fromInternalBalance || funds.toInternalBalance) return \"the batch uses Vault internal balances\";\n  if (getAddress(funds.sender) !== sender || getAddress(funds.recipient) !== recipient) return `the batch takes from ${funds.sender} and pays ${funds.recipient}, not this account and the recipient`;\n  const list = assets.map((a) => getAddress(a));\n  if (new Set(list).size !== list.length) return \"the batch names an asset twice\";\n  if ((nativeIn || nativeOut) && list.includes(getAddress(chain.weth))) return \"a native swap passes through the wrapped native\";\n  const inIdx = list.indexOf(tokenIn);\n  const outIdx = list.indexOf(tokenOut);\n  if (inIdx < 0 || outIdx < 0 || inIdx === outIdx) return \"the batch does not trade the requested tokens\";\n  if (limits.length !== list.length || limits.some((l, i) => l !== (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n))) {\n    return \"the limits are not exactly the input in and the quote's minimum out\";\n  }\n  let given = 0n;\n  for (const step of swaps) {\n    if (step.userData !== \"0x\") return \"the batch carries pool userData this module never sends\";\n    if (step.assetInIndex >= BigInt(list.length) || step.assetOutIndex >= BigInt(list.length) || step.assetInIndex === step.assetOutIndex) return \"a hop names no valid asset pair\";\n    if (step.amount > 0n) {\n      if (step.assetInIndex !== BigInt(inIdx)) return \"a hop brings in an amount of another asset than the input\";\n      given += step.amount;\n    }\n  }\n  if (given !== amountIn) return `the hops sell ${given}, not the ${amountIn} input`;\n  if (!swaps.some((step) => step.assetOutIndex === BigInt(outIdx))) return \"no hop delivers the destination token\";\n  if (call.args[5] <= BigInt(Math.floor(Date.now() / 1000))) return \"the batch deadline has passed\";\n  return null;\n}\n\n/**\n * The Balancer V2 Vault a swap calls and approves on the chains this provider serves, and {@link balancerVerifyQuote}\n * — the app's pins for `remoteProvider({name: \"balancer\", baseUrl, ...balancerPins})` (scan 2026-10-27 modules,\n * F8/F16; scan 2026-10-28, F2).\n */\nexport const balancerPins: RemotePins = Object.freeze({\n  callTargets: (chain: string): readonly string[] => balancerVaultFor(chain),\n  spenders: (chain: string): readonly string[] => balancerVaultFor(chain),\n  verifyQuote: balancerVerifyQuote,\n});\nfunction balancerVaultFor(chain: string): readonly string[] {\n  const id = /^eip155:[0-9]+$/.test(chain) ? Number(chain.slice(7)) : NaN;\n  return Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? [BALANCER_V2_VAULT] : [];\n}\n"],"mappings":";AAMA,SAAQ,YAAY,kBAAkB,mBAAkB;AACxD,SAAQ,UAAAA,SAAQ,SAAAC,cAAY;;;ACN5B,SAAQ,oBAAoB,sBAAsB,oBAAoB,YAAY,gBAAyB;AAE3G,SAAQ,QAAQ,OAAO,eAAe,qBAAoB;AAE1D,SAAQ,sBAAqB;AAa7B,IAAM,OAAO;AAEN,IAAM,oBAAoB;AACjC,IAAM,cAAc;AACpB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAEpB,IAAM,qBAAqB;AAG3B,IAAM,qBAAmF,OAAO,OAAO;AAAA,EAC5G,GAAG,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACtE,IAAI,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACvE,KAAK,EAAC,KAAK,WAAW,MAAM,6CAA4C;AAAA,EACxE,KAAK,EAAC,KAAK,SAAS,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,QAAQ,MAAM,6CAA4C;AAAA,EACtE,MAAM,EAAC,KAAK,UAAU,MAAM,6CAA4C;AAAA,EACxE,OAAO,EAAC,KAAK,YAAY,MAAM,6CAA4C;AAAA,EAC3E,OAAO,EAAC,KAAK,aAAa,MAAM,6CAA4C;AAC9E,CAAC;AAED,IAAM,YAAY;AAClB,IAAM,QAAQ;AACd,IAAM,YAAY,SAAS;AAAA,EACzB,uCAAuC,SAAS,+BAA+B,KAAK;AAAA,EACpF,kCAAkC,SAAS,+BAA+B,KAAK;AAAA,EAC/E;AACF,CAAC;AAyBD,SAAS,MAAM,QAAgB,UAA0B;AACvD,QAAM,IAAI,OAAO,SAAS,EAAE,SAAS,WAAW,GAAG,GAAG;AACtD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,SAAS,QAAQ;AAC5C,QAAM,OAAO,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,QAAQ,OAAO,EAAE;AAC3D,SAAO,OAAO,GAAG,KAAK,IAAI,IAAI,KAAK;AACrC;AAEO,SAAS,iBAAiB,QAAoD;AACnF,QAAM,MAAM,OAAO,UAAU;AAC7B,QAAM,kBAAkB,OAAO,sBAAsB;AACrD,QAAM,MAAM,OAAO,cAAc;AACjC,QAAM,YAAY,OAAO,mBAAmB;AAC5C,QAAM,WAAW,oBAAI,IAA2B;AAEhD,QAAM,YAAY,CAAC,UAAiC;AAClD,QAAI,CAAC,MAAM,KAAK,EAAG,QAAO;AAC1B,UAAM,KAAK,OAAO,KAAK;AACvB,WAAO,mBAAmB,EAAE,KAAK,OAAO,QAAQ,EAAE,GAAG,SAAS,KAAK;AAAA,EACrE;AAEA,iBAAe,IAAI,SAAiB,QAAgB,QAAqC;AACvF,QAAI;AACJ,eAAW,OAAO,OAAO,QAAQ,OAAO,KAAK,CAAC,GAAG;AAC/C,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,KAAK,EAAC,QAAQ,QAAQ,SAAS,EAAC,gBAAgB,mBAAkB,GAAG,MAAM,KAAK,UAAU,EAAC,SAAS,OAAO,IAAI,GAAG,QAAQ,OAAM,CAAC,GAAG,QAAQ,cAAc,IAAM,EAAC,CAAC;AAC1L,YAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACjD,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,YAAI,KAAK,MAAO,OAAM,OAAO,OAAO,IAAI,MAAM,KAAK,MAAM,WAAW,WAAW,GAAG,EAAC,KAAK,KAAI,CAAC;AAC7F,eAAO,KAAK,UAAU;AAAA,MACxB,SAAS,GAAG;AACV,YAAK,EAAsB,IAAK,OAAM;AACtC,kBAAU;AAAA,MACZ;AAAA,IACF;AACA,UAAM,IAAI,MAAM,sCAAsC,OAAO,KAAK,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO,CAAC,GAAG;AAAA,EACnI;AAGA,WAAS,OAAO,SAAgC;AAC9C,QAAI,IAAI,SAAS,IAAI,OAAO;AAC5B,QAAI,CAAC,GAAG;AACN,WAAK,YAAY;AACf,cAAM,MAAO,MAAM,IAAI,SAAS,YAAY,CAAC,EAAC,IAAI,mBAAmB,MAAM,mBAAmB,EAAC,KAAK,WAAW,cAAc,OAAM,CAAC,EAAC,GAAG,QAAQ,CAAC;AACjJ,cAAM,OAAO,qBAAqB,EAAC,KAAK,WAAW,cAAc,QAAQ,MAAM,IAAG,CAAC;AACnF,YAAI,WAAW,IAAI,MAAM,WAAW,mBAAmB,OAAO,EAAG,IAAI,EAAG,OAAM,IAAI,MAAM,gCAAgC,OAAO,+CAA0C;AAAA,MAC3K,GAAG;AACH,QAAE,MAAM,MAAM,SAAS,OAAO,OAAO,CAAC;AACtC,eAAS,IAAI,SAAS,CAAC;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,MAAM,SAAiB,OAAwB,QAAwB,OAA0C;AAC9H,UAAM,OAAO,mBAAmB,EAAC,KAAK,WAAW,cAAc,kBAAkB,MAAM,CAAC,GAAG,OAAO,QAAQ,KAAK,EAAC,CAAC;AACjH,UAAM,MAAO,MAAM,IAAI,SAAS,YAAY,CAAC,EAAC,IAAI,mBAAmB,KAAI,GAAG,QAAQ,CAAC;AACrF,WAAO,qBAAqB,EAAC,KAAK,WAAW,cAAc,kBAAkB,MAAM,IAAG,CAAC;AAAA,EACzF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,kBAAkB;AAAA,IAClB,mBAAmB;AAAA,IACnB,SAAS,MAAM,OAAO,WAAW;AAAA,IACjC,eAAe,CAAC,UAAkB,UAAU,KAAK,MAAM;AAAA,IACvD,mBAAmB,CAAC,MAAc,OAAe,SAAS,MAAM,UAAU,IAAI,MAAM;AAAA,IACpF,eAAe,CAAC,MAAa,OAAc,KAAK,UAAU,GAAG,SAAS,UAAU,KAAK,KAAK,MAAM;AAAA,IAEhG,MAAM,SAAS,QAAqB,QAA6C;AAC/E,YAAM,SAAS,CAAC,QAAsB;AACpC,eAAO,YAAY,aAAa,GAAG,EAAE;AACrC,eAAO;AAAA,MACT;AACA,UAAI,OAAO,KAAM,QAAO,OAAO,4CAA4C;AAC3E,UAAI,OAAO,gBAAgB,OAAO,UAAW,QAAO,OAAO,uBAAuB;AAClF,YAAM,UAAU,UAAU,OAAO,WAAW;AAC5C,UAAI,YAAY,KAAM,QAAO,OAAO,mCAAmC,OAAO,WAAW,EAAE;AAC3F,YAAM,QAAQ,mBAAmB,OAAO;AACxC,YAAM,MAAM,cAAc,MAAM;AAChC,UAAI,CAAC,IAAK,QAAO,OAAO,wBAAwB,OAAO,WAAW,EAAE;AACpE,YAAM,WAAW,CAAC,IAAI;AACtB,YAAM,YAAY,SAAS,KAAK,OAAO,SAAS;AAChD,UAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,OAAO,SAAS,EAAG,QAAO,OAAO,0CAA0C;AACzH,UAAI,CAAC,sBAAsB,KAAK,OAAO,WAAW,EAAG,QAAO,OAAO,kCAAkC;AACrG,UAAI;AACJ,UAAI;AACF,mBAAW,OAAO,OAAO,QAAQ;AAAA,MACnC,QAAQ;AACN,eAAO,OAAO,0BAA0B;AAAA,MAC1C;AACA,UAAI,YAAY,GAAI,QAAO,OAAO,yBAAyB;AAC3D,YAAM,UAAU,WAAW,WAAW,MAAM,OAAO,IAAI,QAAS;AAChE,YAAM,WAAW,WAAW,YAAY,MAAM,OAAO,OAAO,SAAS;AACrE,UAAI,YAAY,SAAU,QAAO,OAAO,YAAY,YAAY,sCAAsC,uBAAuB;AAE7H,UAAI;AACF,cAAM,OAAO,OAAO;AAIpB,cAAM,SAAS,kCAAkC,MAAM,GAAG,kBAAkB,MAAM,UAAU,IAAI,QAAQ,CAAC,oCAAoC,OAAO,iBAAiB,QAAQ;AAC7K,cAAM,MAAM,MAAM,MAAM,KAAK;AAAA,UAC3B,QAAQ;AAAA,UACR,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,UAC5C,MAAM,KAAK,UAAU,EAAC,OAAO,OAAM,CAAC;AAAA,UACpC,QAAQ,UAAU,cAAc,IAAM;AAAA,QACxC,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,QAAO,OAAO,qBAAqB,IAAI,MAAM,EAAE;AAC5D,cAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,cAAM,QAAQ,KAAK,MAAM,iBAAiB,SAAS,CAAC;AACpD,YAAI,KAAK,QAAQ,OAAQ,QAAO,OAAO,QAAQ,KAAK,OAAO,CAAC,GAAG,SAAS,MAAM,GAAG,GAAG,KAAK,OAAO,EAAE;AAClG,YAAI,CAAC,MAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,oBAAoB,KAAK,EAAE,MAAM,WAAW,KAAK,EAAE,OAAO,WAAW,EAAE,MAAM,SAAS,CAAC,GAAG;AACjI,iBAAO,OAAO,oDAAoD;AAAA,QACpE;AACA,YAAI,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,cAAc,GAAG,EAAE,MAAM,SAAU,QAAO,OAAO,6CAA6C;AAGtI,cAAM,SAAgB,CAAC;AACvB,cAAM,UAAU,CAAC,MAAc;AAC7B,gBAAM,OAAO,WAAW,CAAC;AACzB,cAAI,IAAI,OAAO,UAAU,CAAC,MAAM,MAAM,IAAI;AAC1C,cAAI,IAAI,EAAG,KAAI,OAAO,KAAK,IAAI,IAAI;AACnC,iBAAO,OAAO,CAAC;AAAA,QACjB;AACA,cAAM,QAAgB,CAAC;AACvB,mBAAW,KAAK,OAAO;AACrB,cAAI,WAAW,EAAE,OAAO,CAAC,EAAG,OAAO,MAAM,WAAW,WAAW,EAAE,OAAO,EAAE,OAAO,SAAS,CAAC,EAAG,OAAO,MAAM,SAAU,QAAO,OAAO,yDAAyD;AAC5L,YAAE,MAAM,QAAQ,CAAC,MAAM,MAAM;AAC3B,gBAAI,CAAC,sBAAsB,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,0CAA0C;AACjG,kBAAM,KAAK,EAAC,QAAQ,MAAa,cAAc,QAAQ,EAAE,OAAO,CAAC,EAAG,OAAO,GAAG,eAAe,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAG,OAAO,GAAG,QAAQ,MAAM,IAAI,OAAO,EAAE,cAAc,IAAI,IAAI,UAAU,KAAI,CAAC;AAAA,UAClM,CAAC;AAAA,QACH;AACA,YAAI,MAAM,SAAS,mBAAoB,QAAO,OAAO,qBAAqB,MAAM,MAAM,yBAAyB,kBAAkB,EAAE;AACnI,cAAM,QAAQ,eAAe,QAAQ,OAAO,CAAC;AAC7C,cAAM,SAAS,eAAe,QAAQ,QAAQ,CAAC;AAE/C,YAAI,YAAY,WAAW;AACzB,gBAAM,UAAU,OAAO,UAAU,CAAC,MAAM,MAAM,WAAW,MAAM,IAAI,CAAC;AACpE,cAAI,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,WAAW,MAAM,IAAI,CAAC,CAAC,EAAG,QAAO,OAAO,oFAA+E;AACzM,cAAI,WAAW,EAAG,QAAO,OAAO,IAAI;AAAA,QACtC;AACA,cAAM,SAAS,WAAW,OAAO,iBAAiB,sBAAsB,KAAK,OAAO,aAAa,IAAI,OAAO,gBAAgB,OAAO,WAAW;AAC9I,cAAM,YAAY,WAAW,OAAO,WAAW;AAC/C,cAAM,QAAe,EAAC,QAAQ,qBAAqB,OAAO,WAAW,mBAAmB,MAAK;AAG7F,cAAM,SAAS,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK;AACxD,cAAM,OAAO,OAAO,KAAK;AACzB,cAAM,MAAM,CAAC,OAAO,MAAM;AAC1B,YAAI,SAAS,SAAU,QAAO,OAAO,wBAAwB,IAAI,SAAS,QAAQ,EAAE;AACpF,YAAI,OAAO,GAAI,QAAO,OAAO,4CAA4C;AACzE,YAAI,OAAO,KAAK,CAAC,GAAG,MAAM,MAAM,SAAS,MAAM,UAAU,MAAM,EAAE,EAAG,QAAO,OAAO,0DAAqD;AAEvI,cAAM,MAAM,OAAO,eAAe;AAClC,cAAM,SAAU,MAAM,OAAO,MAAS,GAAG,IAAK;AAC9C,YAAI,OAAO,iBAAiB,UAAa,SAAS,OAAO,OAAO,YAAY,EAAG,QAAO,OAAO,qBAAqB,MAAM,YAAY,OAAO,YAAY,GAAG;AAC1J,cAAM,SAAS,OAAO,IAAI,CAAC,GAAG,MAAO,MAAM,QAAQ,WAAW,MAAM,SAAS,CAAC,SAAS,EAAG;AAC1F,cAAM,WAAW,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AACjE,cAAM,OAAO,mBAAmB,EAAC,KAAK,WAAW,cAAc,aAAa,MAAM,CAAC,GAAG,OAAO,QAAQ,OAAO,QAAQ,QAAQ,EAAC,CAAC;AAC9H,cAAM,WAAW,UAAW,SAAU,OAAO,MAAM,MAAM;AACzD,eAAO;AAAA,UACL,UAAU;AAAA,UACV,UAAU,YAAY,OAAO;AAAA,UAC7B,gBAAgB;AAAA,UAChB,aAAa;AAAA,UACb,WAAW;AAAA,YACT,IAAI;AAAA,YACJ;AAAA,YACA,OAAO,WAAW,SAAS,SAAS,IAAI;AAAA,YACxC;AAAA,YACA,UAAU,SAAS,SAAS;AAAA,YAC5B,GAAI,WAAW,CAAC,IAAI,EAAC,iBAAiB,kBAAiB;AAAA,UACzD;AAAA,UACA,cAAc,SAAS,SAAS;AAAA,UAChC,YAAY,IAAI,SAAS;AAAA,UACzB,eAAe,OAAO,SAAS;AAAA,UAC/B,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,cAAc,KAAK,IAAI,IAAI;AAAA;AAAA,UAE3B,cAAc,EAAC,OAAO,OAAO,MAAM,MAAM,GAAG,MAAM,OAAO,MAAM,MAAM,GAAG,QAAQ,OAAO,SAAS,GAAG,SAAS,QAAO;AAAA,QACrH;AAAA,MACF,SAAS,GAAG;AACV,eAAO,OAAO,aAAa,QAAQ,EAAE,QAAQ,QAAQ,eAAe,EAAE,IAAI,OAAO,CAAC,CAAC;AAAA,MACrF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,iBAAiB,OAAc,IAA+B;AAClE,YAAM,UAAU,OAAO,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC,CAAC;AACnD,YAAM,SAAS,MAAM,cAAc;AACnC,UAAI,CAAC,mBAAmB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,KAAM;AACzD,YAAM,SAAS,MAAM,WAAW;AAChC,UAAI,CAAC,UAAU,GAAG,KAAK,WAAW,OAAO,UAAU,GAAG,KAAK,YAAY,MAAM,OAAO,YAAY,GAAG;AACjG,cAAM,IAAI,MAAM,yFAAyF;AAAA,MAC3G;AACA,YAAM,OAAO,mBAAmB,EAAC,KAAK,WAAW,MAAM,OAAa,CAAC;AACrE,UAAI,KAAK,iBAAiB,YAAa,OAAM,IAAI,MAAM,oDAAoD;AAC3G,YAAM,CAAC,EAAE,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK;AAC9C,UAAI,MAAM,WAAW,KAAK,MAAM,SAAS,mBAAoB,OAAM,IAAI,MAAM,2BAA2B,MAAM,MAAM,0BAAqB,kBAAkB,EAAE;AAC7J,UAAI,MAAM,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,EAAG,OAAM,IAAI,MAAM,mEAAmE;AACrI,YAAM,SAAS,OAAO,UAAU,CAAC,MAAM,IAAI,EAAE;AAC7C,YAAM,SAAS,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK;AACxD,YAAM,MAAM,CAAC,OAAO,MAAM;AAC1B,UAAI,MAAM,OAAO,MAAM,EAAG,OAAM,IAAI,MAAM,kDAA6C,GAAG,wBAAwB,MAAM,wCAAwC;AAAA,IAClK;AAAA,IAEA,MAAM,aAAa,OAAmC;AACpD,YAAM,KAAK,MAAM;AACjB,UAAI,CAAC,IAAI,MAAM,CAAC,GAAG,KAAM,OAAM,IAAI,MAAM,kDAAkD;AAC3F,aAAO,EAAC,OAAO,IAAI,IAAI,GAAG,IAAI,OAAO,GAAG,SAAS,KAAK,MAAM,GAAG,MAAM,GAAI,GAAG,YAAY,SAAY,EAAC,SAAS,GAAG,QAAO,IAAI,CAAC,GAAI,GAAI,GAAG,WAAW,EAAC,UAAU,GAAG,SAAQ,IAAI,CAAC,GAAI,GAAI,GAAG,kBAAkB,EAAC,iBAAiB,GAAG,gBAAe,IAAI,CAAC,EAAE;AAAA,IACxP;AAAA,IAEA,MAAM,YAAY,KAAuC;AACvD,UAAI,CAAC,IAAI,aAAc,QAAO,EAAC,OAAO,UAAS;AAC/C,YAAM,UAAU,OAAO,IAAI,SAAS,MAAM,GAAG,EAAE,CAAC,CAAC;AACjD,UAAI,CAAC,mBAAmB,OAAO,KAAK,CAAC,OAAO,QAAQ,OAAO,GAAG,OAAQ,QAAO,EAAC,OAAO,UAAS;AAC9F,UAAI;AACF,cAAM,UAAW,MAAM,IAAI,SAAS,6BAA6B,CAAC,IAAI,YAAY,CAAC;AACnF,YAAI,CAAC,QAAS,QAAO,EAAC,OAAO,UAAS;AACtC,eAAO,QAAQ,WAAW,QAAQ,EAAC,OAAO,aAAa,YAAY,IAAI,aAAY,IAAI,EAAC,OAAO,SAAQ;AAAA,MACzG,QAAQ;AACN,eAAO,EAAC,OAAO,UAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,oBAAoB,QAAqB,OAA6B;AACpF,QAAM,KAAK,kBAAkB,KAAK,OAAO,WAAW,IAAI,OAAO,OAAO,YAAY,MAAM,CAAC,CAAC,IAAI;AAC9F,QAAM,QAAQ,OAAO,UAAU,eAAe,KAAK,oBAAoB,EAAE,IAAI,mBAAmB,EAAE,IAAI;AACtG,MAAI,CAAC,SAAS,OAAO,cAAc,OAAO,YAAa,QAAO;AAC9D,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,MAAM,GAAG,iBAAiB,OAAW,QAAO;AACjE,MAAI,WAAW,GAAG,EAAE,MAAM,kBAAmB,QAAO,oBAAoB,GAAG,EAAE;AAC7E,QAAM,MAAM,cAAc,MAAM;AAChC,MAAI,CAAC,IAAK,QAAO,wBAAwB,OAAO,WAAW;AAC3D,QAAM,WAAW,CAAC,IAAI;AACtB,QAAM,YAAY,SAAS,KAAK,OAAO,SAAS;AAChD,MAAI,SAAc,UAAe,QAAa,WAAgB,UAAkB;AAChF,MAAI;AACF,cAAU,WAAW,WAAW,OAAO,IAAI,QAAS;AACpD,eAAW,WAAW,YAAY,OAAO,OAAO,SAAS;AACzD,gBAAY,WAAW,OAAO,WAAW;AACzC,aAAS,WAAW,OAAO,iBAAiB,sBAAsB,KAAK,OAAO,aAAa,IAAI,OAAO,gBAAgB,OAAO,WAAW;AACxI,eAAW,OAAO,OAAO,QAAQ;AACjC,aAAS,OAAO,MAAM,aAAa;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,WAAW,OAAO,GAAG,SAAS,GAAG,MAAM,YAAY,GAAG,oBAAoB,SAC1E,OAAO,GAAG,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,mBAAmB,WAAW,GAAG,eAAe,MAAM,mBAAmB;AACjH,WAAO,WAAW,2EAA2E;AAAA,EAC/F;AACA,MAAI;AACJ,MAAI;AAAE,WAAO,mBAAmB,EAAC,KAAK,WAAW,MAAM,GAAG,KAAW,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAmC;AAC7H,MAAI,KAAK,iBAAiB,YAAa,QAAO,GAAG,KAAK,YAAY;AAClE,QAAM,CAAC,MAAM,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK;AAClD,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,mBAAoB,QAAO,iBAAiB,MAAM,MAAM,0BAAqB,kBAAkB;AACxI,MAAI,MAAM,uBAAuB,MAAM,kBAAmB,QAAO;AACjE,MAAI,WAAW,MAAM,MAAM,MAAM,UAAU,WAAW,MAAM,SAAS,MAAM,UAAW,QAAO,wBAAwB,MAAM,MAAM,aAAa,MAAM,SAAS;AAC7J,QAAM,OAAO,OAAO,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;AAC5C,MAAI,IAAI,IAAI,IAAI,EAAE,SAAS,KAAK,OAAQ,QAAO;AAC/C,OAAK,YAAY,cAAc,KAAK,SAAS,WAAW,MAAM,IAAI,CAAC,EAAG,QAAO;AAC7E,QAAM,QAAQ,KAAK,QAAQ,OAAO;AAClC,QAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,MAAI,QAAQ,KAAK,SAAS,KAAK,UAAU,OAAQ,QAAO;AACxD,MAAI,OAAO,WAAW,KAAK,UAAU,OAAO,KAAK,CAAC,GAAG,MAAM,OAAO,MAAM,QAAQ,WAAW,MAAM,SAAS,CAAC,SAAS,GAAG,GAAG;AACxH,WAAO;AAAA,EACT;AACA,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,aAAa,KAAM,QAAO;AACnC,QAAI,KAAK,gBAAgB,OAAO,KAAK,MAAM,KAAK,KAAK,iBAAiB,OAAO,KAAK,MAAM,KAAK,KAAK,iBAAiB,KAAK,cAAe,QAAO;AAC9I,QAAI,KAAK,SAAS,IAAI;AACpB,UAAI,KAAK,iBAAiB,OAAO,KAAK,EAAG,QAAO;AAChD,eAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACA,MAAI,UAAU,SAAU,QAAO,iBAAiB,KAAK,aAAa,QAAQ;AAC1E,MAAI,CAAC,MAAM,KAAK,CAAC,SAAS,KAAK,kBAAkB,OAAO,MAAM,CAAC,EAAG,QAAO;AACzE,MAAI,KAAK,KAAK,CAAC,KAAK,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC,EAAG,QAAO;AAClE,SAAO;AACT;AAOO,IAAM,eAA2B,OAAO,OAAO;AAAA,EACpD,aAAa,CAAC,UAAqC,iBAAiB,KAAK;AAAA,EACzE,UAAU,CAAC,UAAqC,iBAAiB,KAAK;AAAA,EACtE,aAAa;AACf,CAAC;AACD,SAAS,iBAAiB,OAAkC;AAC1D,QAAM,KAAK,kBAAkB,KAAK,KAAK,IAAI,OAAO,MAAM,MAAM,CAAC,CAAC,IAAI;AACpE,SAAO,OAAO,UAAU,eAAe,KAAK,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;AAC/F;;;ADxXO,IAAM,kBAAkB;AAGxB,IAAM,2BAAgD,oBAAI,IAAI;AAAA,EACnE;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAEM,SAAS,yBAAyB,IAAa,KAAmD;AACvG,MAAI,CAACC,OAAM,GAAG,KAAK,KAAK,CAAC,mBAAmBC,QAAO,GAAG,KAAK,CAAC,EAAG,QAAO;AACtE,MAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,GAAG,wBAAwB,EAAG,QAAO;AAC5E,SAAO,iBAAiB,IAAI,KAAK,EAAC,UAAU,iBAAiB,UAAU,oBAAiB,WAAW,GAAG,KAAK,CAAC,IAAI,MAAM,OAAM,CAAC;AAC/H;","names":["evmRef","isEvm","isEvm","evmRef"]}

package/dist/index.cjs

@@ -20,12 +20,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  BALANCER_MAX_SWAPS: () => BALANCER_MAX_SWAPS,
   BALANCER_MODULE: () => BALANCER_MODULE,
   BALANCER_V2_CHAINS: () => BALANCER_V2_CHAINS,
   BALANCER_V2_VAULT: () => BALANCER_V2_VAULT,
   BALANCER_VAULT_SELECTORS: () => BALANCER_VAULT_SELECTORS,
   BalancerSwap2Protocol: () => BalancerSwap2Protocol,
+  balancerPins: () => balancerPins,
   balancerProvider: () => balancerProvider,
+  balancerVerifyQuote: () => balancerVerifyQuote,
   default: () => BalancerSwap2Protocol,
   describeBalancerActivity: () => describeBalancerActivity
 });
@@ -59,6 +62,7 @@ var DEFAULT_API = "https://api-v3.balancer.fi/";
 var DEFAULT_SLIPPAGE_BPS = 50;
 var DEFAULT_TTL_MS = 3e5;
 var DEFAULT_DEADLINE_S = 600;
+var BALANCER_MAX_SWAPS = 16;
 var BALANCER_V2_CHAINS = Object.freeze({
   1: { api: "MAINNET", weth: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" },
   10: { api: "OPTIMISM", weth: "0x4200000000000000000000000000000000000006" },
@@ -194,6 +198,7 @@ function balancerProvider(config) {
             swaps.push({ poolId: pool, assetInIndex: indexOf(p.tokens[i].address), assetOutIndex: indexOf(p.tokens[i + 1].address), amount: i === 0 ? BigInt(p.inputAmountRaw) : 0n, userData: "0x" });
           });
         }
+        if (swaps.length > BALANCER_MAX_SWAPS) return refuse(`the SOR route has ${swaps.length} pool hops, more than ${BALANCER_MAX_SWAPS}`);
         const inIdx = (0, import_core.bigintToNumber)(indexOf(tokenIn));
         const outIdx = (0, import_core.bigintToNumber)(indexOf(tokenOut));
         if (nativeIn || nativeOut) {
@@ -244,14 +249,25 @@ function balancerProvider(config) {
         return refuse(e instanceof Error ? e.message.replace(/^balancer: /, "") : String(e));
       }
     },
-    /** Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum. */
+    /**
+     * Re-price the exact signed batch right before broadcast; refuse when the pools now pay under the minimum.
+     * Only the quote's own batch is decoded and priced: behind a backend, `tx` is the client's and only the
+     * quote is sealed, so a client's batch (any size, any pools) never reaches the decoder or the RPC
+     * (scan 2026-10-27 modules, F24).
+     */
     async preflightDeposit(quote, tx) {
       const chainId = Number(quote.intentId.split(":")[1]);
       const minOut = quote.providerData?.minOut;
       if (!BALANCER_V2_CHAINS[chainId] || !minOut || !tx.data) return;
-      const call = (0, import_viem.decodeFunctionData)({ abi: VAULT_ABI, data: tx.data });
+      const quoted = quote.txRequest?.data;
+      if (!quoted || tx.data.length !== quoted.length || tx.data.toLowerCase() !== quoted.toLowerCase()) {
+        throw new Error("balancer: the transaction is not the quoted batch. Nothing was sent; refresh the quote.");
+      }
+      const call = (0, import_viem.decodeFunctionData)({ abi: VAULT_ABI, data: quoted });
       if (call.functionName !== "batchSwap") throw new Error("balancer: the transaction is not a Vault batchSwap");
       const [, swaps, assets, funds, limits] = call.args;
+      if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) throw new Error(`balancer: the batch has ${swaps.length} pool hops, not 1\u2013${BALANCER_MAX_SWAPS}`);
+      if (swaps.some((step) => step.userData !== "0x")) throw new Error("balancer: the batch carries pool userData this module never sends");
       const outIdx = limits.findIndex((l) => l < 0n);
       const deltas = await query(chainId, swaps, assets, funds);
       const out = -deltas[outIdx];
@@ -276,6 +292,75 @@ function balancerProvider(config) {
     }
   };
 }
+function balancerVerifyQuote(params, quote) {
+  const id = /^eip155:[0-9]+$/.test(params.sourceChain) ? Number(params.sourceChain.slice(7)) : NaN;
+  const chain = Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? BALANCER_V2_CHAINS[id] : void 0;
+  if (!chain || params.destChain !== params.sourceChain) return "not a same-chain swap on a Balancer v2 chain";
+  const tx = quote.txRequest;
+  if (!tx?.data || !tx.to || tx.serializedTx !== void 0) return "the quote carries no Vault call";
+  if ((0, import_viem.getAddress)(tx.to) !== BALANCER_V2_VAULT) return `the call targets ${tx.to}, not the Vault`;
+  const src = (0, import_util2.sourceAssetOf)(params);
+  if (!src) return `unknown source token ${params.sourceToken}`;
+  const nativeIn = !src.contract;
+  const nativeOut = /^0x0+$/.test(params.destToken);
+  let tokenIn, tokenOut, sender, recipient, amountIn, minOut;
+  try {
+    tokenIn = (0, import_viem.getAddress)(nativeIn ? ZERO : src.contract);
+    tokenOut = (0, import_viem.getAddress)(nativeOut ? ZERO : params.destToken);
+    recipient = (0, import_viem.getAddress)(params.destAddress);
+    sender = (0, import_viem.getAddress)(params.refundAddress && /^0x[0-9a-fA-F]{40}$/.test(params.refundAddress) ? params.refundAddress : params.destAddress);
+    amountIn = BigInt(params.amountIn);
+    minOut = BigInt(quote.minDestAmount);
+  } catch {
+    return "the request does not name EVM tokens, a recipient and amounts";
+  }
+  if (nativeIn ? BigInt(tx.value ?? "0") !== amountIn || tx.approvalAddress !== void 0 : BigInt(tx.value ?? "0") !== 0n || !tx.approvalAddress || (0, import_viem.getAddress)(tx.approvalAddress) !== BALANCER_V2_VAULT) {
+    return nativeIn ? "a native input is paid as exactly the input in value, with no approval" : "a token input attaches no value and approves the Vault";
+  }
+  let call;
+  try {
+    call = (0, import_viem.decodeFunctionData)({ abi: VAULT_ABI, data: tx.data });
+  } catch {
+    return "the Vault call is not batchSwap";
+  }
+  if (call.functionName !== "batchSwap") return `${call.functionName} is not batchSwap`;
+  const [kind, swaps, assets, funds, limits] = call.args;
+  if (kind !== 0) return "the batch is not GIVEN_IN";
+  if (swaps.length === 0 || swaps.length > BALANCER_MAX_SWAPS) return `the batch has ${swaps.length} pool hops, not 1\u2013${BALANCER_MAX_SWAPS}`;
+  if (funds.fromInternalBalance || funds.toInternalBalance) return "the batch uses Vault internal balances";
+  if ((0, import_viem.getAddress)(funds.sender) !== sender || (0, import_viem.getAddress)(funds.recipient) !== recipient) return `the batch takes from ${funds.sender} and pays ${funds.recipient}, not this account and the recipient`;
+  const list = assets.map((a) => (0, import_viem.getAddress)(a));
+  if (new Set(list).size !== list.length) return "the batch names an asset twice";
+  if ((nativeIn || nativeOut) && list.includes((0, import_viem.getAddress)(chain.weth))) return "a native swap passes through the wrapped native";
+  const inIdx = list.indexOf(tokenIn);
+  const outIdx = list.indexOf(tokenOut);
+  if (inIdx < 0 || outIdx < 0 || inIdx === outIdx) return "the batch does not trade the requested tokens";
+  if (limits.length !== list.length || limits.some((l, i) => l !== (i === inIdx ? amountIn : i === outIdx ? -minOut : 0n))) {
+    return "the limits are not exactly the input in and the quote's minimum out";
+  }
+  let given = 0n;
+  for (const step of swaps) {
+    if (step.userData !== "0x") return "the batch carries pool userData this module never sends";
+    if (step.assetInIndex >= BigInt(list.length) || step.assetOutIndex >= BigInt(list.length) || step.assetInIndex === step.assetOutIndex) return "a hop names no valid asset pair";
+    if (step.amount > 0n) {
+      if (step.assetInIndex !== BigInt(inIdx)) return "a hop brings in an amount of another asset than the input";
+      given += step.amount;
+    }
+  }
+  if (given !== amountIn) return `the hops sell ${given}, not the ${amountIn} input`;
+  if (!swaps.some((step) => step.assetOutIndex === BigInt(outIdx))) return "no hop delivers the destination token";
+  if (call.args[5] <= BigInt(Math.floor(Date.now() / 1e3))) return "the batch deadline has passed";
+  return null;
+}
+var balancerPins = Object.freeze({
+  callTargets: (chain) => balancerVaultFor(chain),
+  spenders: (chain) => balancerVaultFor(chain),
+  verifyQuote: balancerVerifyQuote
+});
+function balancerVaultFor(chain) {
+  const id = /^eip155:[0-9]+$/.test(chain) ? Number(chain.slice(7)) : NaN;
+  return Object.prototype.hasOwnProperty.call(BALANCER_V2_CHAINS, id) ? [BALANCER_V2_VAULT] : [];
+}
 
 // src/protocol.ts
 var import_single = require("@anywalletkit/protocol-swap2-core/swap2/single");