@anywalletkit/protocol-swap2-omniston 0.2.8 → 0.3.1

package/dist/validators.d.cts

@@ -1,4 +1,4 @@
-import { OmnistonProviderOptions } from './provider.cjs';
+export { D as DEFAULT_OMNISTON_TON_CODE_HASHES, w as DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS, x as DEFAULT_OMNISTON_TON_SWAP_INTERFACES, M as MAX_OMNISTON_EXCLUSIVITY_SECONDS, y as OmnistonTonDeliveryInput, z as OmnistonTonDeliveryLocatorOptions, B as OmnistonTonValidationOptions, F as TonEscrowBuildExpectation, G as TonOutputPositionInput, I as createOmnistonTonDeliveryLocator, J as createOmnistonTonValidators } from './provider-BBG2zhpu.cjs';
 import '@anywalletkit/protocol-swap2-core/types';
 
 /** How far back (blocks) a factory event is searched, per chain — shared with the EVM input validator. */
@@ -86,97 +86,6 @@ declare function createOmnistonEvmInputValidator(options?: {
     onRefusal?: OmnistonValidatorRefusal;
 }): (input: EvmInputValidationInput) => Promise<boolean>;
 
-/** Audited from the active mainnet Escrow builder on 2026-08-13. These are
- * immutable TVM code cells, not resolver-controlled addresses. A contract
- * upgrade must deliberately update these hashes after reviewing its schema.
- *
- * `authorityKeys` is the optional 256-bit public key in the escrow config: the
- * escrow code checks `CHKSIGNU` against it for its signature-gated operations
- * (disassembly of code 9e77cb9e…, 2026-10-11). It has been the same key since
- * the August audit, so it stays pinned. */
-declare const DEFAULT_OMNISTON_TON_CODE_HASHES: {
-    readonly escrow: readonly ["9e77cb9e8fd7406d4e85e5f57378eb51e51b862424cf988306c783d50ade697a"];
-    readonly execution: readonly ["f6edbc76e6fbcd6bac573cb942401a3d9198ee9605f9403b0f5c8081259210e5"];
-    readonly authorityKeys: readonly ["ed210da12aa96ea42de4f2f61dc172bbaa3da86051a1b2a6f342f69a777d2770"];
-    /** EVM→TON output position: the contract the factory deploys for the
-     *  resolver's jetton lock (observed on every resolver-created position,
-     *  2026-10-15/16), and the escrow code cell it carries in its state. */
-    readonly position: readonly ["e4d5115a321ade7b827e38fb522c20d2f2cd46e4c6b0b5f7dd8b6b096792d77b"];
-    readonly outputEscrow: readonly ["d30423575384773abaad8d3c6f763898afa3d57a5693005904b7c61e95cee630"];
-};
-/** Upper bound on the exclusivity window the escrow config may carry. It is
- * how long the trader's input stays locked when no resolver reserves the
- * position (SDK: "at the end of this period trader's position becomes
- * available for manual withdrawal"); the live value is 300 s. */
-declare const MAX_OMNISTON_EXCLUSIVITY_SECONDS = 3600;
-type PayloadInput = Omit<Parameters<NonNullable<OmnistonProviderOptions["validateTonEscrowPayload"]>>[0], "exclusivityTimeout"> & {
-    exclusivityTimeout?: number;
-};
-/** Code interfaces (tonapi's by-code-hash labels) a same-chain swap message
- *  may pay into. The resolver picks the pool/vault per route, so the check is
- *  "a STON.fi or DeDust contract by code", not a fixed address list — seen
- *  live: native GRAM → DeDust CPMM v2 pool, jettons → STON.fi router v2. */
-declare const DEFAULT_OMNISTON_TON_SWAP_INTERFACES: readonly ["stonfi_router", "stonfi_router_v2", "stonfi_pool", "stonfi_pool_v2", "dedust_vault", "dedust_v2_cpmm", "dedust_pool"];
-/** Proxy-TON (pTON) jetton masters STON.fi routes native TON through. A
- *  native-input swap pays the ROUTER'S pTON wallet — a plain `jetton_wallet`
- *  to tonapi, no DEX code interface — so such a target is accepted only when
- *  its jetton master is pTON AND its owner carries a DEX router interface.
- *  Seen live 2026-09-05: GRAM → USDT on StonFiV2 targeted the router's pTON
- *  v2 wallet and the code-interface check alone refused it. */
-declare const DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS: readonly ["EQCM3B12QK1e4yZSf8GtBRT0aLMNyEsBc_DhVfRRtOEffLez", "EQBnGWMCf3-FZZq1W4IWcWiGAc3PHuZ0_H-7sad2oY00o83S"];
-interface OmnistonTonValidationOptions {
-    fetch?: typeof fetch;
-    /** Diagnostics hook: every refusal of validateTonOutputPosition names its check (never a secret). */
-    onRefusal?: (reason: string, details?: Record<string, unknown>) => void;
-    tonApiUrl?: string;
-    tonApiKey?: string;
-    /** Code interfaces accepted as swap targets (default: the STON.fi / DeDust set above). */
-    swapTargetInterfaces?: readonly string[];
-    /** Proxy-TON masters whose router-owned wallets may receive native input (default: pTON v1/v2). */
-    proxyTonMasters?: readonly string[];
-    escrowCodeHashes?: readonly string[];
-    executionCodeHashes?: readonly string[];
-    /** Pinned escrow authority public keys (hex, 32 bytes). */
-    authorityKeys?: readonly string[];
-    /** EVM→TON output position code hashes (default: the observed factory position). */
-    positionCodeHashes?: readonly string[];
-    /** Escrow code cells an output position may carry (default: the observed one). */
-    outputEscrowCodeHashes?: readonly string[];
-    now?: () => number;
-}
-type TonOutputPositionInput = Parameters<NonNullable<OmnistonProviderOptions["validateTonOutputPosition"]>>[0];
-declare function createOmnistonTonValidators(options?: OmnistonTonValidationOptions): Pick<OmnistonProviderOptions, "validateTonJettonWallet" | "validateTonSwapTarget" | "validateTonOutputPosition" | "validateTonSwapLeg"> & {
-    validateTonEscrowPayload: (input: PayloadInput) => boolean | Promise<boolean>;
-};
-interface OmnistonTonDeliveryLocatorOptions {
-    fetch?: typeof fetch;
-    tonApiUrl?: string;
-    tonApiKey?: string;
-    /** Recipient events scanned per call (newest first; the delivery is recent by construction). */
-    limit?: number;
-}
-interface OmnistonTonDeliveryInput {
-    /** The output position that paid out; when absent any sender of a matching transfer counts (backfills). */
-    positionAddress?: string;
-    recipientAddress: string;
-    jettonMasterAddress: string;
-    minUnits: string;
-    /** Unix seconds; events before it are not this delivery (backfills). With it set, the EARLIEST match wins — the one closest to the order, not a later swap's payout. */
-    afterTimestamp?: number;
-    /** Unix seconds; events after it are not this delivery (backfills: the row's completion time plus slack). */
-    beforeTimestamp?: number;
-}
-/**
- * Finds an Omniston TON delivery: the jetton transfer from the output position
- * to the recipient of at least `minUnits`, in the recipient's tonapi events.
- * Returns tonapi's `event_id` — the hash `@anywalletkit/wallet-ton`'s history
- * source gives the same event as a row, so a wallet can pair the TON receive
- * with the swap. Feeds `omnistonProvider({locateTonDelivery})`; a server may
- * also call it with no position to backfill rows completed before the locator
- * existed. Never throws: null when nothing matched or tonapi did not answer.
- */
-declare function createOmnistonTonDeliveryLocator(options?: OmnistonTonDeliveryLocatorOptions): (input: OmnistonTonDeliveryInput) => Promise<string | null>;
-
 /**
  * Settlement contracts this deployment trusts for Omniston, per CAIP-2 chain.
  * Audited public addresses — no secret — so both the server wiring and the
@@ -196,4 +105,4 @@ declare const AUDITED_OMNISTON_SETTLEMENT_CONTRACTS: Record<string, string[]>;
  */
 declare const AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS: Record<string, string[]>;
 
-export { AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS, AUDITED_OMNISTON_SETTLEMENT_CONTRACTS, DEFAULT_OMNISTON_TON_CODE_HASHES, DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS, DEFAULT_OMNISTON_TON_SWAP_INTERFACES, type EvmInputValidationInput, type EvmOutputValidationInput, MAX_OMNISTON_EXCLUSIVITY_SECONDS, OMNISTON_EVM_LOOKBACK_BLOCKS, OMNISTON_EVM_MIN_CONFIRMATIONS, type OmnistonEvmOutputRefusal, type OmnistonRpcRequest, type OmnistonRpcUrls, type OmnistonTonDeliveryInput, type OmnistonTonDeliveryLocatorOptions, type OmnistonTonValidationOptions, type OmnistonValidatorRefusal, SRC_ESCROW_CREATED_TOPIC, type TonOutputPositionInput, createOmnistonEvmDeliveryLocator, createOmnistonEvmInputValidator, createOmnistonEvmOutputValidator, createOmnistonTonDeliveryLocator, createOmnistonTonValidators, omnistonEvmRpcRequest };
+export { AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS, AUDITED_OMNISTON_SETTLEMENT_CONTRACTS, type EvmInputValidationInput, type EvmOutputValidationInput, OMNISTON_EVM_LOOKBACK_BLOCKS, OMNISTON_EVM_MIN_CONFIRMATIONS, type OmnistonEvmOutputRefusal, type OmnistonRpcRequest, type OmnistonRpcUrls, type OmnistonValidatorRefusal, SRC_ESCROW_CREATED_TOPIC, createOmnistonEvmDeliveryLocator, createOmnistonEvmInputValidator, createOmnistonEvmOutputValidator, omnistonEvmRpcRequest };

package/dist/validators.d.ts

@@ -1,4 +1,4 @@
-import { OmnistonProviderOptions } from './provider.js';
+export { D as DEFAULT_OMNISTON_TON_CODE_HASHES, w as DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS, x as DEFAULT_OMNISTON_TON_SWAP_INTERFACES, M as MAX_OMNISTON_EXCLUSIVITY_SECONDS, y as OmnistonTonDeliveryInput, z as OmnistonTonDeliveryLocatorOptions, B as OmnistonTonValidationOptions, F as TonEscrowBuildExpectation, G as TonOutputPositionInput, I as createOmnistonTonDeliveryLocator, J as createOmnistonTonValidators } from './provider-BBG2zhpu.js';
 import '@anywalletkit/protocol-swap2-core/types';
 
 /** How far back (blocks) a factory event is searched, per chain — shared with the EVM input validator. */
@@ -86,97 +86,6 @@ declare function createOmnistonEvmInputValidator(options?: {
     onRefusal?: OmnistonValidatorRefusal;
 }): (input: EvmInputValidationInput) => Promise<boolean>;
 
-/** Audited from the active mainnet Escrow builder on 2026-08-13. These are
- * immutable TVM code cells, not resolver-controlled addresses. A contract
- * upgrade must deliberately update these hashes after reviewing its schema.
- *
- * `authorityKeys` is the optional 256-bit public key in the escrow config: the
- * escrow code checks `CHKSIGNU` against it for its signature-gated operations
- * (disassembly of code 9e77cb9e…, 2026-10-11). It has been the same key since
- * the August audit, so it stays pinned. */
-declare const DEFAULT_OMNISTON_TON_CODE_HASHES: {
-    readonly escrow: readonly ["9e77cb9e8fd7406d4e85e5f57378eb51e51b862424cf988306c783d50ade697a"];
-    readonly execution: readonly ["f6edbc76e6fbcd6bac573cb942401a3d9198ee9605f9403b0f5c8081259210e5"];
-    readonly authorityKeys: readonly ["ed210da12aa96ea42de4f2f61dc172bbaa3da86051a1b2a6f342f69a777d2770"];
-    /** EVM→TON output position: the contract the factory deploys for the
-     *  resolver's jetton lock (observed on every resolver-created position,
-     *  2026-10-15/16), and the escrow code cell it carries in its state. */
-    readonly position: readonly ["e4d5115a321ade7b827e38fb522c20d2f2cd46e4c6b0b5f7dd8b6b096792d77b"];
-    readonly outputEscrow: readonly ["d30423575384773abaad8d3c6f763898afa3d57a5693005904b7c61e95cee630"];
-};
-/** Upper bound on the exclusivity window the escrow config may carry. It is
- * how long the trader's input stays locked when no resolver reserves the
- * position (SDK: "at the end of this period trader's position becomes
- * available for manual withdrawal"); the live value is 300 s. */
-declare const MAX_OMNISTON_EXCLUSIVITY_SECONDS = 3600;
-type PayloadInput = Omit<Parameters<NonNullable<OmnistonProviderOptions["validateTonEscrowPayload"]>>[0], "exclusivityTimeout"> & {
-    exclusivityTimeout?: number;
-};
-/** Code interfaces (tonapi's by-code-hash labels) a same-chain swap message
- *  may pay into. The resolver picks the pool/vault per route, so the check is
- *  "a STON.fi or DeDust contract by code", not a fixed address list — seen
- *  live: native GRAM → DeDust CPMM v2 pool, jettons → STON.fi router v2. */
-declare const DEFAULT_OMNISTON_TON_SWAP_INTERFACES: readonly ["stonfi_router", "stonfi_router_v2", "stonfi_pool", "stonfi_pool_v2", "dedust_vault", "dedust_v2_cpmm", "dedust_pool"];
-/** Proxy-TON (pTON) jetton masters STON.fi routes native TON through. A
- *  native-input swap pays the ROUTER'S pTON wallet — a plain `jetton_wallet`
- *  to tonapi, no DEX code interface — so such a target is accepted only when
- *  its jetton master is pTON AND its owner carries a DEX router interface.
- *  Seen live 2026-09-05: GRAM → USDT on StonFiV2 targeted the router's pTON
- *  v2 wallet and the code-interface check alone refused it. */
-declare const DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS: readonly ["EQCM3B12QK1e4yZSf8GtBRT0aLMNyEsBc_DhVfRRtOEffLez", "EQBnGWMCf3-FZZq1W4IWcWiGAc3PHuZ0_H-7sad2oY00o83S"];
-interface OmnistonTonValidationOptions {
-    fetch?: typeof fetch;
-    /** Diagnostics hook: every refusal of validateTonOutputPosition names its check (never a secret). */
-    onRefusal?: (reason: string, details?: Record<string, unknown>) => void;
-    tonApiUrl?: string;
-    tonApiKey?: string;
-    /** Code interfaces accepted as swap targets (default: the STON.fi / DeDust set above). */
-    swapTargetInterfaces?: readonly string[];
-    /** Proxy-TON masters whose router-owned wallets may receive native input (default: pTON v1/v2). */
-    proxyTonMasters?: readonly string[];
-    escrowCodeHashes?: readonly string[];
-    executionCodeHashes?: readonly string[];
-    /** Pinned escrow authority public keys (hex, 32 bytes). */
-    authorityKeys?: readonly string[];
-    /** EVM→TON output position code hashes (default: the observed factory position). */
-    positionCodeHashes?: readonly string[];
-    /** Escrow code cells an output position may carry (default: the observed one). */
-    outputEscrowCodeHashes?: readonly string[];
-    now?: () => number;
-}
-type TonOutputPositionInput = Parameters<NonNullable<OmnistonProviderOptions["validateTonOutputPosition"]>>[0];
-declare function createOmnistonTonValidators(options?: OmnistonTonValidationOptions): Pick<OmnistonProviderOptions, "validateTonJettonWallet" | "validateTonSwapTarget" | "validateTonOutputPosition" | "validateTonSwapLeg"> & {
-    validateTonEscrowPayload: (input: PayloadInput) => boolean | Promise<boolean>;
-};
-interface OmnistonTonDeliveryLocatorOptions {
-    fetch?: typeof fetch;
-    tonApiUrl?: string;
-    tonApiKey?: string;
-    /** Recipient events scanned per call (newest first; the delivery is recent by construction). */
-    limit?: number;
-}
-interface OmnistonTonDeliveryInput {
-    /** The output position that paid out; when absent any sender of a matching transfer counts (backfills). */
-    positionAddress?: string;
-    recipientAddress: string;
-    jettonMasterAddress: string;
-    minUnits: string;
-    /** Unix seconds; events before it are not this delivery (backfills). With it set, the EARLIEST match wins — the one closest to the order, not a later swap's payout. */
-    afterTimestamp?: number;
-    /** Unix seconds; events after it are not this delivery (backfills: the row's completion time plus slack). */
-    beforeTimestamp?: number;
-}
-/**
- * Finds an Omniston TON delivery: the jetton transfer from the output position
- * to the recipient of at least `minUnits`, in the recipient's tonapi events.
- * Returns tonapi's `event_id` — the hash `@anywalletkit/wallet-ton`'s history
- * source gives the same event as a row, so a wallet can pair the TON receive
- * with the swap. Feeds `omnistonProvider({locateTonDelivery})`; a server may
- * also call it with no position to backfill rows completed before the locator
- * existed. Never throws: null when nothing matched or tonapi did not answer.
- */
-declare function createOmnistonTonDeliveryLocator(options?: OmnistonTonDeliveryLocatorOptions): (input: OmnistonTonDeliveryInput) => Promise<string | null>;
-
 /**
  * Settlement contracts this deployment trusts for Omniston, per CAIP-2 chain.
  * Audited public addresses — no secret — so both the server wiring and the
@@ -196,4 +105,4 @@ declare const AUDITED_OMNISTON_SETTLEMENT_CONTRACTS: Record<string, string[]>;
  */
 declare const AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS: Record<string, string[]>;
 
-export { AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS, AUDITED_OMNISTON_SETTLEMENT_CONTRACTS, DEFAULT_OMNISTON_TON_CODE_HASHES, DEFAULT_OMNISTON_TON_PROXY_TON_MASTERS, DEFAULT_OMNISTON_TON_SWAP_INTERFACES, type EvmInputValidationInput, type EvmOutputValidationInput, MAX_OMNISTON_EXCLUSIVITY_SECONDS, OMNISTON_EVM_LOOKBACK_BLOCKS, OMNISTON_EVM_MIN_CONFIRMATIONS, type OmnistonEvmOutputRefusal, type OmnistonRpcRequest, type OmnistonRpcUrls, type OmnistonTonDeliveryInput, type OmnistonTonDeliveryLocatorOptions, type OmnistonTonValidationOptions, type OmnistonValidatorRefusal, SRC_ESCROW_CREATED_TOPIC, type TonOutputPositionInput, createOmnistonEvmDeliveryLocator, createOmnistonEvmInputValidator, createOmnistonEvmOutputValidator, createOmnistonTonDeliveryLocator, createOmnistonTonValidators, omnistonEvmRpcRequest };
+export { AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS, AUDITED_OMNISTON_SETTLEMENT_CONTRACTS, type EvmInputValidationInput, type EvmOutputValidationInput, OMNISTON_EVM_LOOKBACK_BLOCKS, OMNISTON_EVM_MIN_CONFIRMATIONS, type OmnistonEvmOutputRefusal, type OmnistonRpcRequest, type OmnistonRpcUrls, type OmnistonValidatorRefusal, SRC_ESCROW_CREATED_TOPIC, createOmnistonEvmDeliveryLocator, createOmnistonEvmInputValidator, createOmnistonEvmOutputValidator, omnistonEvmRpcRequest };

package/dist/validators.js

@@ -507,6 +507,40 @@ function createOmnistonEvmInputValidator(options = {}) {
 import { Buffer } from "buffer";
 import { Address, Cell } from "@ton/core";
 import { bigintToNumber as bigintToNumber2 } from "@anywalletkit/core";
+
+// src/validators/settlement.ts
+var AUDITED_OMNISTON_SETTLEMENT_CONTRACTS = {
+  "ton:-239": ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"],
+  "eip155:1": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:56": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:137": ["0x41A392062A4307a6961d48e30FF20bF6823715B8"],
+  "eip155:4663": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:8453": ["0xACa3E2F9b61a44892926bC6c3e104192E7D1c3cd"],
+  "eip155:42161": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:43114": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  // 2026-10-20: one factory address on X Layer, HyperEVM and Plasma. Runtime
+  // bytecode equals Ethereum's 0xafCF… byte for byte except the immutable slots
+  // (escrow implementations, its order protocol, domain hash); it references
+  // the order protocol trusted below on the same chain.
+  "eip155:196": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
+  "eip155:999": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
+  "eip155:9745": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"]
+};
+var AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS = {
+  "eip155:1": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:56": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:137": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:8453": ["0xe7405fAcDEDB2512e91F2886BDff13231343aF5E"],
+  "eip155:42161": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:43114": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  // 2026-10-20: bytecode equals Ethereum's 0xb581… except immutables (wrapped
+  // native, own address, chain id 196 / 9745 / 999 at the chain-id slot).
+  "eip155:196": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:9745": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:999": ["0xD84778bbeEC5D2a8d17c6424249C438EC0b1ABE3"]
+};
+
+// src/validators/ton.ts
 var JETTON_TRANSFER_OP = 260734629;
 var ESCROW_CREATE_OP = 3232100569;
 var ESCROW_CONFIG_OP = 4073126499;
@@ -683,6 +717,11 @@ function exactCellEnd(slice) {
   return slice.remainingBits === 0 && slice.remainingRefs === 0;
 }
 function destinationChainId(chain) {
+  const caip2 = /^eip155:([0-9]{1,10})$/.exec(chain);
+  if (caip2) {
+    const id = BigInt(caip2[1]);
+    return [1n, 56n, 137n, 4663n, 8453n, 42161n, 43114n, 196n, 999n, 9745n].includes(id) ? id : null;
+  }
   const ids = {
     ethereum: 1n,
     bnb: 56n,
@@ -697,6 +736,65 @@ function destinationChainId(chain) {
   };
   return ids[chain] ?? null;
 }
+function readTonEscrowBody(payloadBocHex) {
+  const outer = oneRoot(payloadBocHex, "payload").beginParse();
+  if (outer.loadUint(32) !== JETTON_TRANSFER_OP) throw new Error("not a jetton transfer");
+  outer.loadUintBig(64);
+  const amount = outer.loadCoins();
+  const protocol = outer.loadAddressAny();
+  if (!(protocol instanceof Address)) throw new Error("no protocol address");
+  outer.loadAddressAny();
+  if (outer.loadMaybeRef() !== null) throw new Error("custom payload");
+  outer.loadCoins();
+  if (!outer.loadBit() || outer.remainingRefs !== 1) throw new Error("no forward payload");
+  const forward = outer.loadRef();
+  const root = forward.beginParse();
+  if (root.loadUint(32) !== ESCROW_CREATE_OP) throw new Error("not an escrow create");
+  const quoteId = Buffer.from(root.loadBuffer(32)).toString("hex");
+  root.loadBit();
+  root.loadAddressAny();
+  root.loadCoins();
+  root.loadBit();
+  if (root.remainingRefs !== 4) throw new Error("escrow refs");
+  const config = root.loadRef().beginParse();
+  if (config.loadUint(32) !== ESCROW_CONFIG_OP) throw new Error("escrow config");
+  const resolver = config.loadAddressAny();
+  if (!(resolver instanceof Address)) throw new Error("no resolver");
+  if (config.loadBit()) config.loadBuffer(32);
+  const exclusivity = config.loadUintBig(64);
+  config.loadUintBig(64);
+  if (config.remainingRefs !== 2) throw new Error("escrow config refs");
+  const state = config.loadRef();
+  if (!config.loadBit()) throw new Error("no destination");
+  const destination = config.loadRef().beginParse();
+  if (state.refs.length !== 2) throw new Error("escrow state");
+  const execution = state.refs[1].beginParse();
+  execution.loadUint(32);
+  const secretHash = new Uint8Array(execution.loadBuffer(32));
+  execution.loadAddressAny();
+  for (let i = 0; i < 4; i++) execution.loadUintBig(64);
+  const ownerData = execution.loadRef().beginParse();
+  ownerData.loadAddressAny();
+  ownerData.loadBit();
+  const deposit = ownerData.loadCoins();
+  destination.loadUintBig(64);
+  destination.loadBuffer(20);
+  destination.loadBuffer(20);
+  const resolverSends = destination.loadCoins();
+  if (exclusivity > BigInt(MAX_OMNISTON_EXCLUSIVITY_SECONDS)) throw new Error("exclusivity");
+  return {
+    amount,
+    protocolAddress: protocol.toString(),
+    forwardPayloadBocHex: Buffer.from(forward.toBoc()).toString("hex"),
+    quoteId,
+    initialResolverAddress: resolver.toString(),
+    exclusivityTimeout: Number(exclusivity.toString()),
+    // bounded above
+    secretHash,
+    depositUnits: deposit.toString(),
+    resolverSendsUnits: resolverSends.toString()
+  };
+}
 function validatePayload(input, trusted) {
   const exclusivityTimeout = input.exclusivityTimeout;
   if (typeof exclusivityTimeout !== "number" || !Number.isSafeInteger(exclusivityTimeout) || exclusivityTimeout < 1 || exclusivityTimeout > MAX_OMNISTON_EXCLUSIVITY_SECONDS) return false;
@@ -814,6 +912,7 @@ function createOmnistonTonValidators(options = {}) {
     position: new Set((options.positionCodeHashes ?? DEFAULT_OMNISTON_TON_CODE_HASHES.position).map((value) => value.toLowerCase())),
     outputEscrow: new Set((options.outputEscrowCodeHashes ?? DEFAULT_OMNISTON_TON_CODE_HASHES.outputEscrow).map((value) => value.toLowerCase()))
   };
+  const trustedProtocols = new Set((options.trustedProtocolAddresses ?? AUDITED_OMNISTON_SETTLEMENT_CONTRACTS["ton:-239"] ?? []).map((value) => Address.parse(value).toRawString()));
   const jettonWalletOf = async (ownerAddress, jettonMasterAddress) => {
     const response = await get(`/v2/accounts/${encodeURIComponent(ownerAddress)}/jettons/${encodeURIComponent(jettonMasterAddress)}`);
     if (!response.ok) return null;
@@ -845,6 +944,51 @@ function createOmnistonTonValidators(options = {}) {
         return false;
       }
     },
+    /**
+     * The app's own check of a TON → EVM escrow build behind `remoteProvider` (through `omnistonVerifyBuild`): the
+     * structural check `validateTonEscrowPayload` runs on the server, with every field that decides where the
+     * trader's money goes taken from the app — the jetton amount, the owner the excess and refunds go to, the
+     * destination chain, address and token, a delivery of at least `minResolverSendsUnits`, and a protocol contract
+     * from `trustedProtocolAddresses`. The fields the server and the resolver choose (quote id, resolver, hashlock,
+     * exclusivity, deposit) are read from the body and held to the same pins and bounds: audited escrow and
+     * execution code, authority key, one execution, the reviewed timelocks, no Dutch auction. A reason, or `null`.
+     */
+    verifyTonEscrowBuild(input) {
+      let body;
+      try {
+        body = readTonEscrowBody(input.payloadBocHex);
+      } catch {
+        return "the escrow body is not an Omniston escrow transfer";
+      }
+      if (!trustedProtocols.has(Address.parse(body.protocolAddress).toRawString())) return `the escrow transfer pays ${body.protocolAddress}, not an Omniston protocol contract this app trusts`;
+      if (!/^\d{1,40}$/.test(input.inputUnits) || body.amount !== BigInt(input.inputUnits)) return `the escrow transfer moves ${body.amount}, not the ${input.inputUnits} this swap sells`;
+      if (!/^\d{1,80}$/.test(input.minResolverSendsUnits) || BigInt(body.resolverSendsUnits) < BigInt(input.minResolverSendsUnits)) {
+        return `the resolver is bound to deliver ${body.resolverSendsUnits}, under the quote's minimum ${input.minResolverSendsUnits}`;
+      }
+      let ok = false;
+      try {
+        ok = validatePayload({
+          payloadBocHex: input.payloadBocHex,
+          forwardPayloadBocHex: body.forwardPayloadBocHex,
+          quoteId: body.quoteId,
+          inputUnits: input.inputUnits,
+          resolverSendsUnits: body.resolverSendsUnits,
+          srcHtlcSecurityDepositUnits: body.depositUnits,
+          protocolAddress: body.protocolAddress,
+          ownerAddress: input.ownerAddress,
+          destinationChain: input.destinationChain,
+          destinationAddress: input.destinationAddress,
+          outputTokenAddress: input.outputTokenAddress,
+          initialResolverAddress: body.initialResolverAddress,
+          secretHashes: [body.secretHash],
+          hashingFunction: "HASHING_FUNCTION_KECCAK256",
+          exclusivityTimeout: body.exclusivityTimeout
+        }, trusted);
+      } catch {
+        ok = false;
+      }
+      return ok ? null : "the escrow body is not this swap's (owner, destination chain, address or token) or not the audited escrow (code, authority, timelocks)";
+    },
     /**
      * EVM→TON: the position the tracking feed named must be (1) an active
      * contract with the pinned position code, (2) carrying state that binds
@@ -1015,38 +1159,6 @@ function createOmnistonTonDeliveryLocator(options = {}) {
     }
   };
 }
-
-// src/validators/settlement.ts
-var AUDITED_OMNISTON_SETTLEMENT_CONTRACTS = {
-  "ton:-239": ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"],
-  "eip155:1": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  "eip155:56": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  "eip155:137": ["0x41A392062A4307a6961d48e30FF20bF6823715B8"],
-  "eip155:4663": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  "eip155:8453": ["0xACa3E2F9b61a44892926bC6c3e104192E7D1c3cd"],
-  "eip155:42161": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  "eip155:43114": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  // 2026-10-20: one factory address on X Layer, HyperEVM and Plasma. Runtime
-  // bytecode equals Ethereum's 0xafCF… byte for byte except the immutable slots
-  // (escrow implementations, its order protocol, domain hash); it references
-  // the order protocol trusted below on the same chain.
-  "eip155:196": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
-  "eip155:999": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
-  "eip155:9745": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"]
-};
-var AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS = {
-  "eip155:1": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  "eip155:56": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  "eip155:137": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
-  "eip155:8453": ["0xe7405fAcDEDB2512e91F2886BDff13231343aF5E"],
-  "eip155:42161": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  "eip155:43114": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  // 2026-10-20: bytecode equals Ethereum's 0xb581… except immutables (wrapped
-  // native, own address, chain id 196 / 9745 / 999 at the chain-id slot).
-  "eip155:196": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  "eip155:9745": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
-  "eip155:999": ["0xD84778bbeEC5D2a8d17c6424249C438EC0b1ABE3"]
-};
 export {
   AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS,
   AUDITED_OMNISTON_SETTLEMENT_CONTRACTS,