@anywalletkit/protocol-swap2-omniston 0.5.3 → 0.5.5

package/dist/chunk-IDRZHWWL.js

@@ -0,0 +1,74 @@
+// src/validators/settlement.ts
+var AUDITED_OMNISTON_SETTLEMENT_CONTRACTS = {
+  // The TON Escrow Minter a new TON <-> EVM order may name. The provider
+  // compares TON addresses as these exact strings, so it is kept in the form
+  // Omniston's quotes use.
+  // - EQDybO88… (code 9737943f…, "rev2"): Omniston's TON <-> EVM quotes name it
+  //   since 2026-11-10 ~19:00Z. Reviewed 2026-11-12, read-only:
+  //   - Deploy tx fkabfHcN8DcrqQyazmlB+UprljBDeEkvFlgaVOi905g=
+  //     (2026-11-10 18:47:06Z). Code and data still equal that StateInit:
+  //     no upgrade since, none pending (no pendingCode, upgradeAfter 0).
+  //   - Same admin (0:408fff62…) as rev1; it is also the admin_address of the
+  //     STON.fi DEX v2 routers api.ston.fi lists. Deployed from the same
+  //     wallet as rev1 (a weak signal on TON: anyone can send a StateInit).
+  //   - The bytecode diff to rev1: escrow / execution code must be in an
+  //     embedded whitelist (9e77…, f6ed…, d304…, pinned in ton.ts, plus 9fe4…
+  //     for TON <-> TON, which the SDK does not pin), the escrow sub-VM must
+  //     return one value, and a failed position deploy now credits the amount
+  //     back to the same account contract instead of aborting (the only new
+  //     path that moves value; no real message has used it). Fees, timelocks,
+  //     payouts, admin and the 7-day upgrade delay are unchanged. Replayed
+  //     through both codes, the real traffic of both minters (~42k
+  //     transactions) and of ~1,070 of their positions gave the same outputs.
+  //   - It deploys positions with code eb503578…, the only code in
+  //     DEFAULT_OMNISTON_TON_CODE_HASHES.position. The address and that pin
+  //     go together: without the pin every EVM -> TON order on this minter
+  //     fills and then fails the disclosure check.
+  // - EQAbWJ3Y… (code f91c43d3…, "rev1", deployed 2026-06-09) is no longer
+  //   trusted by default (2026-11-12). Omniston's quotes moved to rev2 on
+  //   2026-11-10 (rev1 still took a few orders on 2026-11-12), and rev1 lacks the escrow-code whitelist rev2 added: on
+  //   rev1 only the SDK's own pins check the escrow and execution code an
+  //   order carries. A quote that names rev1 is refused with its address
+  //   in the reason, and so is building one cached under an older table; its positions (code e4d5115a…) fail
+  //   position-code-hash. It stays in OMNISTON_ESCROWS (activity.ts), which
+  //   recognizes history and grants no trust. Old orders need nothing from
+  //   this table: trackIntent reads no trust table, and every disclosure
+  //   check refuses a quote older than 6 h, so a rev1 order quoted before
+  //   the switch cannot be closed by any version. Listing rev1 here or in
+  //   trustedProtocolAddresses trusts it again for NEW orders; it does not
+  //   help close an old one.
+  "ton:-239": ["EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA"],
+  "eip155:1": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:56": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:137": ["0x41A392062A4307a6961d48e30FF20bF6823715B8"],
+  "eip155:4663": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:8453": ["0xACa3E2F9b61a44892926bC6c3e104192E7D1c3cd"],
+  "eip155:42161": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:43114": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  // 2026-10-20: one factory address on X Layer, HyperEVM and Plasma. Runtime
+  // bytecode equals Ethereum's 0xafCF… byte for byte except the immutable slots
+  // (escrow implementations, its order protocol, domain hash); it references
+  // the order protocol trusted below on the same chain.
+  "eip155:196": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
+  "eip155:999": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"],
+  "eip155:9745": ["0xd602079AFa5c38F550510a2a988CbFa698Fa0189"]
+};
+var AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS = {
+  "eip155:1": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:56": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:137": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
+  "eip155:8453": ["0xe7405fAcDEDB2512e91F2886BDff13231343aF5E"],
+  "eip155:42161": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:43114": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  // 2026-10-20: bytecode equals Ethereum's 0xb581… except immutables (wrapped
+  // native, own address, chain id 196 / 9745 / 999 at the chain-id slot).
+  "eip155:196": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:9745": ["0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9"],
+  "eip155:999": ["0xD84778bbeEC5D2a8d17c6424249C438EC0b1ABE3"]
+};
+
+export {
+  AUDITED_OMNISTON_SETTLEMENT_CONTRACTS,
+  AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS
+};
+//# sourceMappingURL=chunk-IDRZHWWL.js.map

package/dist/chunk-IDRZHWWL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/validators/settlement.ts"],"sourcesContent":["/**\n * Settlement contracts this deployment trusts for Omniston, per CAIP-2 chain.\n * Audited public addresses — no secret — so both the server wiring and the\n * browser-side provider import them from here.\n * See how-to-project/OMNISTON-NETWORK-ONBOARDING.md before adding a network.\n */\nexport const AUDITED_OMNISTON_SETTLEMENT_CONTRACTS: Record<string, string[]> = {\n  // The TON Escrow Minter a new TON <-> EVM order may name. The provider\n  // compares TON addresses as these exact strings, so it is kept in the form\n  // Omniston's quotes use.\n  // - EQDybO88… (code 9737943f…, \"rev2\"): Omniston's TON <-> EVM quotes name it\n  //   since 2026-11-10 ~19:00Z. Reviewed 2026-11-12, read-only:\n  //   - Deploy tx fkabfHcN8DcrqQyazmlB+UprljBDeEkvFlgaVOi905g=\n  //     (2026-11-10 18:47:06Z). Code and data still equal that StateInit:\n  //     no upgrade since, none pending (no pendingCode, upgradeAfter 0).\n  //   - Same admin (0:408fff62…) as rev1; it is also the admin_address of the\n  //     STON.fi DEX v2 routers api.ston.fi lists. Deployed from the same\n  //     wallet as rev1 (a weak signal on TON: anyone can send a StateInit).\n  //   - The bytecode diff to rev1: escrow / execution code must be in an\n  //     embedded whitelist (9e77…, f6ed…, d304…, pinned in ton.ts, plus 9fe4…\n  //     for TON <-> TON, which the SDK does not pin), the escrow sub-VM must\n  //     return one value, and a failed position deploy now credits the amount\n  //     back to the same account contract instead of aborting (the only new\n  //     path that moves value; no real message has used it). Fees, timelocks,\n  //     payouts, admin and the 7-day upgrade delay are unchanged. Replayed\n  //     through both codes, the real traffic of both minters (~42k\n  //     transactions) and of ~1,070 of their positions gave the same outputs.\n  //   - It deploys positions with code eb503578…, the only code in\n  //     DEFAULT_OMNISTON_TON_CODE_HASHES.position. The address and that pin\n  //     go together: without the pin every EVM -> TON order on this minter\n  //     fills and then fails the disclosure check.\n  // - EQAbWJ3Y… (code f91c43d3…, \"rev1\", deployed 2026-06-09) is no longer\n  //   trusted by default (2026-11-12). Omniston's quotes moved to rev2 on\n  //   2026-11-10 (rev1 still took a few orders on 2026-11-12), and rev1 lacks the escrow-code whitelist rev2 added: on\n  //   rev1 only the SDK's own pins check the escrow and execution code an\n  //   order carries. A quote that names rev1 is refused with its address\n  //   in the reason, and so is building one cached under an older table; its positions (code e4d5115a…) fail\n  //   position-code-hash. It stays in OMNISTON_ESCROWS (activity.ts), which\n  //   recognizes history and grants no trust. Old orders need nothing from\n  //   this table: trackIntent reads no trust table, and every disclosure\n  //   check refuses a quote older than 6 h, so a rev1 order quoted before\n  //   the switch cannot be closed by any version. Listing rev1 here or in\n  //   trustedProtocolAddresses trusts it again for NEW orders; it does not\n  //   help close an old one.\n  \"ton:-239\": [\"EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA\"],\n  \"eip155:1\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  \"eip155:56\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  \"eip155:137\": [\"0x41A392062A4307a6961d48e30FF20bF6823715B8\"],\n  \"eip155:4663\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  \"eip155:8453\": [\"0xACa3E2F9b61a44892926bC6c3e104192E7D1c3cd\"],\n  \"eip155:42161\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  \"eip155:43114\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  // 2026-10-20: one factory address on X Layer, HyperEVM and Plasma. Runtime\n  // bytecode equals Ethereum's 0xafCF… byte for byte except the immutable slots\n  // (escrow implementations, its order protocol, domain hash); it references\n  // the order protocol trusted below on the same chain.\n  \"eip155:196\": [\"0xd602079AFa5c38F550510a2a988CbFa698Fa0189\"],\n  \"eip155:999\": [\"0xd602079AFa5c38F550510a2a988CbFa698Fa0189\"],\n  \"eip155:9745\": [\"0xd602079AFa5c38F550510a2a988CbFa698Fa0189\"],\n};\n\n/**\n * EVM order protocols (Omniston's fork of the 1inch Limit Order Protocol v4 —\n * NOT the canonical 1inch deployment) an EVM→TON order is signed against. The\n * wallet approves this contract for the input amount and signs an EIP-712\n * order whose domain names it; on fill it moves the input into the escrow the\n * factory above deploys. One address, different roles per chain (0xafCF… is\n * the factory elsewhere and the order protocol on Polygon), so this table is\n * separate from the factory table and CAIP-scoped. Runtime code hashes are in\n * how-to-project/OMNISTON-NETWORK-ONBOARDING.md (snapshot 2026-10-16).\n */\nexport const AUDITED_OMNISTON_EVM_ORDER_PROTOCOLS: Record<string, string[]> = {\n  \"eip155:1\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  \"eip155:56\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  \"eip155:137\": [\"0xafCF681272AF10959736f45616eeCBC22D7095E2\"],\n  \"eip155:8453\": [\"0xe7405fAcDEDB2512e91F2886BDff13231343aF5E\"],\n  \"eip155:42161\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  \"eip155:43114\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  // 2026-10-20: bytecode equals Ethereum's 0xb581… except immutables (wrapped\n  // native, own address, chain id 196 / 9745 / 999 at the chain-id slot).\n  \"eip155:196\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  \"eip155:9745\": [\"0xb5810aCfD45D85Eaa938bF90a5857295513DA7E9\"],\n  \"eip155:999\": [\"0xD84778bbeEC5D2a8d17c6424249C438EC0b1ABE3\"],\n};\n"],"mappings":";AAMO,IAAM,wCAAkE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsC7E,YAAY,CAAC,kDAAkD;AAAA,EAC/D,YAAY,CAAC,4CAA4C;AAAA,EACzD,aAAa,CAAC,4CAA4C;AAAA,EAC1D,cAAc,CAAC,4CAA4C;AAAA,EAC3D,eAAe,CAAC,4CAA4C;AAAA,EAC5D,eAAe,CAAC,4CAA4C;AAAA,EAC5D,gBAAgB,CAAC,4CAA4C;AAAA,EAC7D,gBAAgB,CAAC,4CAA4C;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7D,cAAc,CAAC,4CAA4C;AAAA,EAC3D,cAAc,CAAC,4CAA4C;AAAA,EAC3D,eAAe,CAAC,4CAA4C;AAC9D;AAYO,IAAM,uCAAiE;AAAA,EAC5E,YAAY,CAAC,4CAA4C;AAAA,EACzD,aAAa,CAAC,4CAA4C;AAAA,EAC1D,cAAc,CAAC,4CAA4C;AAAA,EAC3D,eAAe,CAAC,4CAA4C;AAAA,EAC5D,gBAAgB,CAAC,4CAA4C;AAAA,EAC7D,gBAAgB,CAAC,4CAA4C;AAAA;AAAA;AAAA,EAG7D,cAAc,CAAC,4CAA4C;AAAA,EAC3D,eAAe,CAAC,4CAA4C;AAAA,EAC5D,cAAc,CAAC,4CAA4C;AAC7D;","names":[]}

package/dist/{chunk-2E6CVWD6.js → chunk-IX4NF2J7.js}

@@ -1,6 +1,6 @@
 import {
   omnistonProvider
-} from "./chunk-4JOTKQOT.js";
+} from "./chunk-FDSTD34Z.js";
 import {
   omniston
 } from "./chunk-QDXFC6BC.js";
@@ -24,4 +24,4 @@ var OmnistonSwap2Protocol = class extends SingleProviderSwap2 {
 export {
   OmnistonSwap2Protocol
 };
-//# sourceMappingURL=chunk-2E6CVWD6.js.map
+//# sourceMappingURL=chunk-IX4NF2J7.js.map

package/dist/index.cjs

@@ -88,7 +88,10 @@ var STONFI_ROUTERS = [
   "EQCS4UEa5UaJLzOyyKieqQOQ2P9M-7kXpkO5HnP3Bv250cN3",
   "EQB3ncyBUTjZUA5EnFKR5_EnOMI9V1tTEAAPaiU71gc4TiUt"
 ];
-var OMNISTON_ESCROWS = ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"];
+var OMNISTON_ESCROWS = [
+  "EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ",
+  "EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA"
+];
 function raw(address) {
   if (!address) return null;
   try {
@@ -440,7 +443,44 @@ function sameJetton(a, b) {
 
 // src/validators/settlement.ts
 var AUDITED_OMNISTON_SETTLEMENT_CONTRACTS = {
-  "ton:-239": ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"],
+  // The TON Escrow Minter a new TON <-> EVM order may name. The provider
+  // compares TON addresses as these exact strings, so it is kept in the form
+  // Omniston's quotes use.
+  // - EQDybO88… (code 9737943f…, "rev2"): Omniston's TON <-> EVM quotes name it
+  //   since 2026-11-10 ~19:00Z. Reviewed 2026-11-12, read-only:
+  //   - Deploy tx fkabfHcN8DcrqQyazmlB+UprljBDeEkvFlgaVOi905g=
+  //     (2026-11-10 18:47:06Z). Code and data still equal that StateInit:
+  //     no upgrade since, none pending (no pendingCode, upgradeAfter 0).
+  //   - Same admin (0:408fff62…) as rev1; it is also the admin_address of the
+  //     STON.fi DEX v2 routers api.ston.fi lists. Deployed from the same
+  //     wallet as rev1 (a weak signal on TON: anyone can send a StateInit).
+  //   - The bytecode diff to rev1: escrow / execution code must be in an
+  //     embedded whitelist (9e77…, f6ed…, d304…, pinned in ton.ts, plus 9fe4…
+  //     for TON <-> TON, which the SDK does not pin), the escrow sub-VM must
+  //     return one value, and a failed position deploy now credits the amount
+  //     back to the same account contract instead of aborting (the only new
+  //     path that moves value; no real message has used it). Fees, timelocks,
+  //     payouts, admin and the 7-day upgrade delay are unchanged. Replayed
+  //     through both codes, the real traffic of both minters (~42k
+  //     transactions) and of ~1,070 of their positions gave the same outputs.
+  //   - It deploys positions with code eb503578…, the only code in
+  //     DEFAULT_OMNISTON_TON_CODE_HASHES.position. The address and that pin
+  //     go together: without the pin every EVM -> TON order on this minter
+  //     fills and then fails the disclosure check.
+  // - EQAbWJ3Y… (code f91c43d3…, "rev1", deployed 2026-06-09) is no longer
+  //   trusted by default (2026-11-12). Omniston's quotes moved to rev2 on
+  //   2026-11-10 (rev1 still took a few orders on 2026-11-12), and rev1 lacks the escrow-code whitelist rev2 added: on
+  //   rev1 only the SDK's own pins check the escrow and execution code an
+  //   order carries. A quote that names rev1 is refused with its address
+  //   in the reason, and so is building one cached under an older table; its positions (code e4d5115a…) fail
+  //   position-code-hash. It stays in OMNISTON_ESCROWS (activity.ts), which
+  //   recognizes history and grants no trust. Old orders need nothing from
+  //   this table: trackIntent reads no trust table, and every disclosure
+  //   check refuses a quote older than 6 h, so a rev1 order quoted before
+  //   the switch cannot be closed by any version. Listing rev1 here or in
+  //   trustedProtocolAddresses trusts it again for NEW orders; it does not
+  //   help close an old one.
+  "ton:-239": ["EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA"],
   "eip155:1": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
   "eip155:56": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
   "eip155:137": ["0x41A392062A4307a6961d48e30FF20bF6823715B8"],
@@ -2007,6 +2047,9 @@ function omnistonProvider(opts = {}) {
     const inputToken = assetContract(q.inputAsset);
     const outputToken = assetContract(q.outputAsset);
     const destChainId = tonDest ? null : evmRef2(destChain);
+    if (factory?.chain.$case === destCase && !isTrusted(destChain, factory.chain.value)) {
+      throw new Error(`omniston: untrusted ${destChain} settlement contract ${factory.chain.value}`);
+    }
     if (protocol.chain.$case !== srcCase || !isTrustedOrderProtocol(srcChain, protocol.chain.value) || resolver?.chain.$case !== srcCase || !validEvmAddress(resolver.chain.value) || factory?.chain.$case !== destCase || !isTrusted(destChain, factory.chain.value) || !inputToken || !outputToken || !Number.isSafeInteger(settlement.protocolFeePips) || !tonDest && (destChainId === null || !validEvmAddress(outputToken) || !isPositiveInteger(settlement.dstSecurityDepositUnits ?? ""))) throw new Error("omniston: incomplete EVM order settlement binding in quote");
     const { secrets, created } = await secretsFor(ref, q, 1);
     const hashes = secrets.map((secret) => hashlock(secret, settlement.htlcHashingFunction));
@@ -2251,6 +2294,10 @@ function omnistonProvider(opts = {}) {
       const destCase = q.outputAsset.chain.$case;
       const traderDst = destCase === "ton" ? null : { chain: { $case: destCase, value: (0, import_viem.getAddress)(ref.dest) } };
       if (!traderDst) throw new Error("omniston: TON-destination orders are not supported");
+      const minter = q.settlementData.value.srcProtocolContractAddress;
+      if (minter.chain.$case !== "ton" || !isTrusted(srcChain, minter.chain.value)) {
+        throw new Error(`omniston: untrusted TON settlement contract ${minter.chain.value}`);
+      }
       const settlement = q.settlementData;
       const hashingFunction = settlement.$case === "order" ? settlement.value.htlcHashingFunction : void 0;
       const { secrets, created } = await secretsFor(ref, q, maxExecutions);