@anywalletkit/protocol-swap2-core 0.7.0 → 0.9.0

package/dist/swap2/base.js

@@ -7,7 +7,7 @@ import {
   nativeUnits,
   normalizeTypedDomain,
   swap2ChainId
-} from "../chunk-5E5FWYZQ.js";
+} from "../chunk-PU5NM3Y6.js";
 import "../chunk-IVR3SREQ.js";
 import "../chunk-2KC734UX.js";
 export {

package/dist/swap2/single.cjs

@@ -764,12 +764,15 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
       }
     }
     const executionModels = [unsigned.data !== void 0, unsigned.bodyBoc !== void 0, unsigned.typedData !== void 0].filter(Boolean).length;
-    if (executionModels > 1 || unsigned.memo !== void 0 && (unsigned.bodyBoc !== void 0 || unsigned.typedData !== void 0)) {
+    if (executionModels > 1 || unsigned.memo !== void 0 && (unsigned.bodyBoc !== void 0 || unsigned.typedData !== void 0) || unsigned.orderExtension !== void 0 && unsigned.typedData === void 0) {
       throw new Error("swap2: provider returned ambiguous execution payloads");
     }
     if (unsigned.approvalAddress && !unsigned.data && !unsigned.typedData) {
       throw new Error("swap2: approval is only valid for calldata or typed-order execution");
     }
+    if (provider.remote === true && provider.depositAddressRoutes !== true && unsigned.data === void 0 && unsigned.bodyBoc === void 0 && unsigned.typedData === void 0 && !serialized) {
+      throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' sends the input to ${unsigned.to}, an address its backend named, and the app did not allow deposit-address routes for it (remoteProvider depositAddressRoutes) \u2014 refused`);
+    }
     const tronSource = this.fromChain.startsWith("tron:");
     const nearSource = this.fromChain.startsWith("near:");
     if (unsigned.memo && !this.fromChain.startsWith("ton:") && !tronSource && !nearSource) {
@@ -876,6 +879,9 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
       throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' asks to approve ${unsigned.approvalAddress} on ${this.fromChain}, which the app did not pin as a spender (remoteProvider spenders) \u2014 refused`);
     }
     if (unsigned.typedData !== void 0) {
+      if (remote && provider.verifiesBuilds !== true) {
+        throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' asks to sign a typed order, which needs the app's own validator (remoteProvider verifyBuild) \u2014 refused`);
+      }
       const chainId = this.fromChain.startsWith("eip155:") ? Number(this.fromChain.slice("eip155:".length)) : null;
       assertTypedOrder(unsigned.typedData, unsigned.approvalAddress, { self: selfAddress, token: source.contract ?? void 0, amount: q.sourceAmount, chainId });
     }
@@ -901,6 +907,8 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
         }
       } else if (remote && !pinnedTargets.includes(unsigned.to.toLowerCase())) {
         throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' calls ${(0, import_viem.getAddress)(unsigned.to)} on ${this.fromChain}, which the app did not pin as a call target (remoteProvider callTargets) \u2014 refused`);
+      } else if (remote && provider.verifiesQuotes !== true && provider.verifiesBuilds !== true) {
+        throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' calls ${(0, import_viem.getAddress)(unsigned.to)} with calldata the app does not check (remoteProvider verifyQuote / verifyBuild) \u2014 refused`);
       }
     }
     const needsApproval = !!unsigned.approvalAddress && !!source.contract;
@@ -1373,8 +1381,13 @@ function validQuote(q, params, provider) {
   }
 }
 function remotePinRefusal(provider, q, chain) {
-  if (provider.remote !== true || !chain.startsWith("eip155:")) return null;
+  if (provider.remote !== true) return null;
   const tx = q.txRequest;
+  const plain = tx ? tx.data === void 0 && tx.serializedTx === void 0 : typeof q.depositAddress === "string" && q.depositAddress !== "";
+  if (plain && provider.depositAddressRoutes !== true) {
+    return `${provider.name}: the route pays ${tx?.to || q.depositAddress}, an address the backend named, and the app did not allow deposit-address routes for this provider (remoteProvider depositAddressRoutes)`;
+  }
+  if (!chain.startsWith("eip155:")) return null;
   if (!tx || tx.serializedTx !== void 0) return null;
   const pinned = (list, address) => (list ?? []).some((a) => typeof a === "string" && a.toLowerCase() === address.toLowerCase());
   if (tx.approvalAddress && !pinned(provider.spenders?.(chain), tx.approvalAddress)) {
@@ -1383,6 +1396,9 @@ function remotePinRefusal(provider, q, chain) {
   if (tx.data !== void 0 && tx.to && !pinned(provider.callTargets?.(chain), tx.to)) {
     return `${provider.name}: the route calls ${tx.to}, which the app did not pin as a call target on ${chain} (remoteProvider callTargets)`;
   }
+  if (tx.data !== void 0 && provider.verifiesQuotes !== true && provider.verifiesBuilds !== true) {
+    return `${provider.name}: the route's calldata is not checked by the app (remoteProvider verifyQuote / verifyBuild) \u2014 a pinned target alone does not say whom it pays`;
+  }
   return null;
 }