@anywalletkit/protocol-swap2-omniston 0.2.8 → 0.3.0

package/dist/index.cjs

@@ -43,8 +43,11 @@ __export(src_exports, {
   inMemoryQuoteStore: () => inMemoryQuoteStore,
   inMemorySecretStore: () => inMemorySecretStore,
   omniston: () => omniston,
+  omnistonPins: () => omnistonPins,
   omnistonProvider: () => omnistonProvider,
-  validateEvmToTonOrderExtension: () => validateEvmToTonOrderExtension
+  omnistonVerifyBuild: () => omnistonVerifyBuild,
+  validateEvmToTonOrderExtension: () => validateEvmToTonOrderExtension,
+  validateEvmTypedOrder: () => validateEvmTypedOrder
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -465,7 +468,12 @@ function inMemoryQuoteStore() {
   return {
     save: (id, v) => void map.set(id, v),
     load: (id) => map.get(id),
-    clear: (id) => void map.delete(id)
+    clear: (id) => void map.delete(id),
+    claim: (id, v) => {
+      if (map.has(id)) return false;
+      map.set(id, v);
+      return true;
+    }
   };
 }
 function inMemorySecretStore() {
@@ -1039,6 +1047,13 @@ function validSwapSettlement(q) {
   const v = q.settlementData.value;
   return Array.isArray(v.routes) && v.routes.length > 0 && v.routes.every((route) => Array.isArray(route?.steps) && route.steps.length > 0 && route.steps.every((step) => Array.isArray(step?.chunks) && step.chunks.length > 0 && step.chunks.every((chunk) => typeof chunk?.protocol === "string" && chunk.protocol.length > 0 && isPositiveInteger(chunk.inputUnits) && isPositiveInteger(chunk.outputUnits)))) && isPositiveInteger(v.minOutputAmount) && BigInt(v.minOutputAmount) <= BigInt(q.outputUnits) && (v.recommendedMinOutputAmount === void 0 || isPositiveInteger(v.recommendedMinOutputAmount) && BigInt(v.recommendedMinOutputAmount) <= BigInt(q.outputUnits)) && (q.gasBudget === void 0 || isPositiveInteger(q.gasBudget));
 }
+function swapSteps(v) {
+  if (v.routes.length !== 1) return [{ protocol: `${v.routes.length}-routes`, inputJetton: void 0, outputJetton: void 0 }];
+  return v.routes[0].steps.map((step) => {
+    if (step.chunks.length !== 1) return { protocol: `split(${step.chunks.map((c) => c.protocol).join("|")})`, inputJetton: void 0, outputJetton: void 0 };
+    return { protocol: step.chunks[0].protocol, inputJetton: stepJetton(step.inputAsset), outputJetton: stepJetton(step.outputAsset) };
+  });
+}
 function swapProtocols(v) {
   const names = /* @__PURE__ */ new Set();
   for (const route of v.routes) for (const step of route.steps) for (const chunk of step.chunks) names.add(chunk.protocol);
@@ -1215,6 +1230,66 @@ function mapOrderStatus(order) {
       return { state: "pending", depositReceived };
   }
 }
+function omnistonPins(trustedEvmOrderProtocols) {
+  const byChain = new Map(Object.entries(trustedEvmOrderProtocols).map(([chain, list]) => [chain, list.map((a) => (0, import_viem.getAddress)(a))]));
+  return Object.freeze({ callTargets: () => [], spenders: (chain) => byChain.get(chain) ?? [] });
+}
+function omnistonVerifyBuild(hooks) {
+  return async (quote, tx, params) => {
+    if (tx.bodyBoc === void 0) return null;
+    if (!params) return "the request this quote answered is unknown";
+    if (quote.providerData?.settlement !== "swap") return "only TON swap bodies can be checked on the client";
+    let steps;
+    try {
+      steps = JSON.parse(quote.providerData.routeSteps ?? "");
+    } catch {
+      return "the quote carries no route steps";
+    }
+    if (!Array.isArray(steps) || steps.length === 0) return "the quote carries no route steps";
+    const source = (0, import_swap2_assets.ccAsset)(params.sourceChain, params.sourceToken);
+    const dest = (0, import_swap2_assets.ccAssetByToken)(params.destChain, params.destToken);
+    if (!source || !dest) return "unknown source or destination token";
+    const protocols = (quote.providerData.protocols ?? "").split(",").filter(Boolean);
+    let checked;
+    try {
+      checked = checkTonSwapPayload({
+        payloadHex: import_buffer2.Buffer.from(tx.bodyBoc, "base64").toString("hex"),
+        targetAddress: tx.to,
+        sendAmount: BigInt(tx.value),
+        trader: params.refundAddress ?? "",
+        dest: params.destAddress,
+        inputUnits: quote.sourceAmount,
+        minOutputAmount: quote.minDestAmount,
+        inputJetton: source.contract ?? null,
+        outputJetton: dest.contract ?? null,
+        steps: steps.map((st) => ({ protocol: String(st.protocol), inputJetton: st.inputJetton, outputJetton: st.outputJetton })),
+        integratorAddress: hooks.integratorAddress ?? null
+      });
+    } catch (e) {
+      return e instanceof Error ? e.message.replace(/^omniston: /, "") : String(e);
+    }
+    const payload = parseSwapPayload(import_buffer2.Buffer.from(tx.bodyBoc, "base64").toString("hex"));
+    const target = source.contract ? payload.jettonTransfer?.destination : tx.to;
+    if (!target) return "the body names no swap destination";
+    try {
+      if (!await hooks.validateTonSwapTarget({ address: target, protocols })) return `${target} is not a recognized DEX contract for ${protocols.join("+")}`;
+    } catch {
+      return "the swap target could not be checked";
+    }
+    if (hooks.validateTonSwapLeg) {
+      for (const leg of checked.legs) {
+        let ok = false;
+        try {
+          ok = await hooks.validateTonSwapLeg(leg);
+        } catch {
+          ok = false;
+        }
+        if (!ok) return `${leg.kind} v${leg.version} leg not verified`;
+      }
+    }
+    return null;
+  };
+}
 function omnistonProvider(opts = {}) {
   opts = Object.freeze({ ...opts });
   const apiUrl = opts.apiUrl ?? "wss://omni-ws.ston.fi";
@@ -1332,6 +1407,26 @@ function omnistonProvider(opts = {}) {
   async function saveBuilt(quoteId, entry) {
     await quotes.save(quoteId, JSON.stringify(entry));
   }
+  async function claimBuilt(quoteId, entry) {
+    const json = JSON.stringify(entry);
+    if (typeof quotes.claim === "function") {
+      if (await quotes.claim(quoteId, json)) return true;
+    } else if (!await quotes.load(quoteId)) {
+      await quotes.save(quoteId, json);
+      return true;
+    }
+    const existing = await loadBuilt(quoteId);
+    if (!existing) {
+      if (typeof quotes.claim === "function") return await quotes.claim(quoteId, json);
+      await quotes.save(quoteId, json);
+      return true;
+    }
+    const a = existing.bound, b = entry.bound;
+    const same = !!a && !!b && a.kind === b.kind && a.srcChain === b.srcChain && sameIntentAddress(a.trader, b.trader) && sameIntentAddress(a.dest, b.dest);
+    if (!same) return false;
+    await quotes.save(quoteId, json);
+    return true;
+  }
   async function loadBuilt(quoteId) {
     const raw2 = await quotes.load(quoteId);
     if (!raw2) return void 0;
@@ -1498,7 +1593,10 @@ function omnistonProvider(opts = {}) {
     if (BigInt(swap.minOutputAmount) < requiredMin(q.outputUnits)) return null;
     if (q.gasBudget !== void 0 && BigInt(q.gasBudget) > BigInt(maxTonExecutionNano)) return null;
     const minOut = swap.minOutputAmount;
-    await saveBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "swap" } });
+    if (!await claimBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "swap" } })) {
+      traceFor(q.quoteId)("quote-id-reused", { kind: "swap" });
+      return null;
+    }
     const feeUnits = Number(q.protocolFeeUnits || "0") + Number(q.integratorFeeUnits || "0");
     const stableOut = /^(USDT|USDC|USD₮|jUSDT)$/.test(dest.symbol);
     const feeUsd = stableOut ? feeUnits / 10 ** dest.decimals : 0;
@@ -1525,6 +1623,8 @@ function omnistonProvider(opts = {}) {
       providerData: {
         settlement: "swap",
         protocols: swapProtocols(swap).join(","),
+        // For the app's own check of a remote build (omnistonVerifyBuild): the route the body must follow.
+        routeSteps: JSON.stringify(swapSteps(swap)),
         ...q.gasBudget ? { gasBudget: q.gasBudget } : {},
         ...q.estimatedGasConsumption ? { gasEstimate: q.estimatedGasConsumption } : {}
       }
@@ -1625,10 +1725,7 @@ function omnistonProvider(opts = {}) {
         minOutputAmount: swap.minOutputAmount,
         inputJetton,
         outputJetton: assetContract(q.outputAsset),
-        steps: swap.routes.length === 1 ? routeSteps.map((step) => {
-          if (step.chunks.length !== 1) return { protocol: `split(${step.chunks.map((c) => c.protocol).join("|")})`, inputJetton: void 0, outputJetton: void 0 };
-          return { protocol: step.chunks[0].protocol, inputJetton: stepJetton(step.inputAsset), outputJetton: stepJetton(step.outputAsset) };
-        }) : [{ protocol: `${swap.routes.length}-routes`, inputJetton: void 0, outputJetton: void 0 }],
+        steps: swapSteps(swap),
         integratorAddress: q.integratorAddress?.chain.$case === "ton" ? q.integratorAddress.chain.value : null
       });
     } catch (error) {
@@ -1916,7 +2013,9 @@ function omnistonProvider(opts = {}) {
       const outputScaled = BigInt(q.outputUnits) * 10n ** BigInt(source.decimals);
       if (outputScaled * 2n < inputScaled || outputScaled > inputScaled * 2n) return refuse2("quoted output is outside 0.5x\u20132x of the input");
       if (await quoteIdInUse(q.quoteId)) return refuse2("the platform reused a quote id that already belongs to an order");
-      await saveBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "order" } });
+      if (!await claimBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "order" } })) {
+        return refuse2("the platform reused a quote id that already holds another user's quote");
+      }
       const feeUnits = Number(q.protocolFeeUnits || "0") + Number(q.integratorFeeUnits || "0");
       const feeUsd = feeUnits / 10 ** dest.decimals;
       return {
@@ -2048,6 +2147,7 @@ function omnistonProvider(opts = {}) {
         await forget();
         throw error;
       }
+      await saveBuilt(ref.quoteId, { quote: q, at: Date.now(), ...cached.bound ? { bound: cached.bound } : {} });
       return {
         chain: srcChain,
         to: message.targetAddress,
@@ -2091,8 +2191,15 @@ function omnistonProvider(opts = {}) {
         })
       );
       if (!order) return { state: "pending" };
-      const secretsHex = await store.load(decoded.quoteId);
+      let secretsHex = await store.load(decoded.quoteId);
       if (!secretsHex || cached?.quote.settlementData.$case !== "order") trace("disclosure-skipped", { gate: "context", secrets: !!secretsHex, cached: !!cached, feedStatus: order.status });
+      if (secretsHex && cached?.quote.settlementData.$case === "order") {
+        const [lockedTo] = await store.load(bindKey(decoded.quoteId)) ?? [];
+        if (lockedTo !== orderBinding(bound, cached.quote)) {
+          trace("disclosure-skipped", { gate: "binding", bound: lockedTo !== void 0, feedStatus: order.status });
+          secretsHex = void 0;
+        }
+      }
       if (secretsHex && cached?.quote.settlementData.$case === "order") {
         const q = cached.quote;
         const settlement = q.settlementData.value;