@anywalletkit/protocol-swap2-omniston 0.5.4 → 0.5.6

package/dist/protocol.d.cts

@@ -1,7 +1,7 @@
 import * as _anywalletkit_protocol_swap2_core_types from '@anywalletkit/protocol-swap2-core/types';
 import { SingleProviderSwap2 } from '@anywalletkit/protocol-swap2-core/swap2/single';
 import { Swap2EngineConfig, Swap2Account } from '@anywalletkit/protocol-swap2-core/swap2/base';
-import { b as OmnistonProviderOptions } from './provider-CcCZB-Cj.cjs';
+import { b as OmnistonProviderOptions } from './provider-BQzNkVvW.cjs';
 
 interface OmnistonSwap2Config extends Swap2EngineConfig, OmnistonProviderOptions {
 }

package/dist/protocol.d.ts

@@ -1,7 +1,7 @@
 import * as _anywalletkit_protocol_swap2_core_types from '@anywalletkit/protocol-swap2-core/types';
 import { SingleProviderSwap2 } from '@anywalletkit/protocol-swap2-core/swap2/single';
 import { Swap2EngineConfig, Swap2Account } from '@anywalletkit/protocol-swap2-core/swap2/base';
-import { b as OmnistonProviderOptions } from './provider-CcCZB-Cj.js';
+import { b as OmnistonProviderOptions } from './provider-BQzNkVvW.js';
 
 interface OmnistonSwap2Config extends Swap2EngineConfig, OmnistonProviderOptions {
 }

package/dist/protocol.js

@@ -1,10 +1,10 @@
 import {
   OmnistonSwap2Protocol
-} from "./chunk-2E6CVWD6.js";
-import "./chunk-4JOTKQOT.js";
+} from "./chunk-IX4NF2J7.js";
+import "./chunk-FDSTD34Z.js";
 import "./chunk-QDXFC6BC.js";
-import "./chunk-AIWAM7BS.js";
-import "./chunk-JWYDIW4V.js";
+import "./chunk-ENAEOF7N.js";
+import "./chunk-IDRZHWWL.js";
 export {
   OmnistonSwap2Protocol
 };

package/dist/{provider-CcCZB-Cj.d.cts → provider-BQzNkVvW.d.cts}

@@ -14,8 +14,24 @@ declare const DEFAULT_OMNISTON_TON_CODE_HASHES: {
     readonly authorityKeys: readonly ["ed210da12aa96ea42de4f2f61dc172bbaa3da86051a1b2a6f342f69a777d2770"];
     /** EVM→TON output position: the contract the factory deploys for the
      *  resolver's jetton lock (observed on every resolver-created position,
-     *  2026-10-15/16), and the escrow code cell it carries in its state. */
-    readonly position: readonly ["e4d5115a321ade7b827e38fb522c20d2f2cd46e4c6b0b5f7dd8b6b096792d77b"];
+     *  2026-10-15/16), and the escrow code cell it carries in its state.
+     *  A position counts only when a trusted factory itself sent its deploy
+     *  message, and a minter deploys only the position code stored in its own
+     *  data, so this list follows the trusted minters in
+     *  AUDITED_OMNISTON_SETTLEMENT_CONTRACTS["ton:-239"]:
+     *  - eb503578…: positions of the rev2 Escrow Minter EQDybO88… (the position
+     *    code stored in its data; reviewed 2026-11-12). The diff to rev1's
+     *    e4d5115a… is 13 sub-VM calls in another mode (RUNVMX 20 -> 276) and 2
+     *    escrow-code whitelist checks. The state layout is the same, and live
+     *    and settled rev2 positions pass every check of
+     *    validateTonOutputPosition.
+     *  - e4d5115a… (positions of the rev1 minter EQAbWJ3Y…) left the default
+     *    with rev1 on 2026-11-12. Only an EVM -> TON order quoted on rev1 less
+     *    than 6 h before an app upgrades can still need it (positionCodeHashes
+     *    with both codes, until those 6 h are over). That pin alone trusts no
+     *    new order: a new quote must name a trusted minter, and a position
+     *    counts only when the minter its quote named deployed it. */
+    readonly position: readonly ["eb503578b4d9cd791c9c0ecd0da6da4064aae2bcb19d3c924d4001c493386bc5"];
     readonly outputEscrow: readonly ["d30423575384773abaad8d3c6f763898afa3d57a5693005904b7c61e95cee630"];
 };
 /** Upper bound on the exclusivity window the escrow config may carry. It is

package/dist/{provider-CcCZB-Cj.d.ts → provider-BQzNkVvW.d.ts}

@@ -14,8 +14,24 @@ declare const DEFAULT_OMNISTON_TON_CODE_HASHES: {
     readonly authorityKeys: readonly ["ed210da12aa96ea42de4f2f61dc172bbaa3da86051a1b2a6f342f69a777d2770"];
     /** EVM→TON output position: the contract the factory deploys for the
      *  resolver's jetton lock (observed on every resolver-created position,
-     *  2026-10-15/16), and the escrow code cell it carries in its state. */
-    readonly position: readonly ["e4d5115a321ade7b827e38fb522c20d2f2cd46e4c6b0b5f7dd8b6b096792d77b"];
+     *  2026-10-15/16), and the escrow code cell it carries in its state.
+     *  A position counts only when a trusted factory itself sent its deploy
+     *  message, and a minter deploys only the position code stored in its own
+     *  data, so this list follows the trusted minters in
+     *  AUDITED_OMNISTON_SETTLEMENT_CONTRACTS["ton:-239"]:
+     *  - eb503578…: positions of the rev2 Escrow Minter EQDybO88… (the position
+     *    code stored in its data; reviewed 2026-11-12). The diff to rev1's
+     *    e4d5115a… is 13 sub-VM calls in another mode (RUNVMX 20 -> 276) and 2
+     *    escrow-code whitelist checks. The state layout is the same, and live
+     *    and settled rev2 positions pass every check of
+     *    validateTonOutputPosition.
+     *  - e4d5115a… (positions of the rev1 minter EQAbWJ3Y…) left the default
+     *    with rev1 on 2026-11-12. Only an EVM -> TON order quoted on rev1 less
+     *    than 6 h before an app upgrades can still need it (positionCodeHashes
+     *    with both codes, until those 6 h are over). That pin alone trusts no
+     *    new order: a new quote must name a trusted minter, and a position
+     *    counts only when the minter its quote named deployed it. */
+    readonly position: readonly ["eb503578b4d9cd791c9c0ecd0da6da4064aae2bcb19d3c924d4001c493386bc5"];
     readonly outputEscrow: readonly ["d30423575384773abaad8d3c6f763898afa3d57a5693005904b7c61e95cee630"];
 };
 /** Upper bound on the exclusivity window the escrow config may carry. It is

package/dist/provider.cjs

@@ -53,7 +53,10 @@ var STONFI_ROUTERS = [
   "EQCS4UEa5UaJLzOyyKieqQOQ2P9M-7kXpkO5HnP3Bv250cN3",
   "EQB3ncyBUTjZUA5EnFKR5_EnOMI9V1tTEAAPaiU71gc4TiUt"
 ];
-var OMNISTON_ESCROWS = ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"];
+var OMNISTON_ESCROWS = [
+  "EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ",
+  "EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA"
+];
 function raw(address) {
   if (!address) return null;
   try {
@@ -431,7 +434,44 @@ function sameJetton(a, b) {
 
 // src/validators/settlement.ts
 var AUDITED_OMNISTON_SETTLEMENT_CONTRACTS = {
-  "ton:-239": ["EQAbWJ3Y1HgIIvcMq1prG1anlDC0T3cZlAU7luPT6LmTpmrZ"],
+  // The TON Escrow Minter a new TON <-> EVM order may name. The provider
+  // compares TON addresses as these exact strings, so it is kept in the form
+  // Omniston's quotes use.
+  // - EQDybO88… (code 9737943f…, "rev2"): Omniston's TON <-> EVM quotes name it
+  //   since 2026-11-10 ~19:00Z. Reviewed 2026-11-12, read-only:
+  //   - Deploy tx fkabfHcN8DcrqQyazmlB+UprljBDeEkvFlgaVOi905g=
+  //     (2026-11-10 18:47:06Z). Code and data still equal that StateInit:
+  //     no upgrade since, none pending (no pendingCode, upgradeAfter 0).
+  //   - Same admin (0:408fff62…) as rev1; it is also the admin_address of the
+  //     STON.fi DEX v2 routers api.ston.fi lists. Deployed from the same
+  //     wallet as rev1 (a weak signal on TON: anyone can send a StateInit).
+  //   - The bytecode diff to rev1: escrow / execution code must be in an
+  //     embedded whitelist (9e77…, f6ed…, d304…, pinned in ton.ts, plus 9fe4…
+  //     for TON <-> TON, which the SDK does not pin), the escrow sub-VM must
+  //     return one value, and a failed position deploy now credits the amount
+  //     back to the same account contract instead of aborting (the only new
+  //     path that moves value; no real message has used it). Fees, timelocks,
+  //     payouts, admin and the 7-day upgrade delay are unchanged. Replayed
+  //     through both codes, the real traffic of both minters (~42k
+  //     transactions) and of ~1,070 of their positions gave the same outputs.
+  //   - It deploys positions with code eb503578…, the only code in
+  //     DEFAULT_OMNISTON_TON_CODE_HASHES.position. The address and that pin
+  //     go together: without the pin every EVM -> TON order on this minter
+  //     fills and then fails the disclosure check.
+  // - EQAbWJ3Y… (code f91c43d3…, "rev1", deployed 2026-06-09) is no longer
+  //   trusted by default (2026-11-12). Omniston's quotes moved to rev2 on
+  //   2026-11-10 (rev1 still took a few orders on 2026-11-12), and rev1 lacks the escrow-code whitelist rev2 added: on
+  //   rev1 only the SDK's own pins check the escrow and execution code an
+  //   order carries. A quote that names rev1 is refused with its address
+  //   in the reason, and so is building one cached under an older table; its positions (code e4d5115a…) fail
+  //   position-code-hash. It stays in OMNISTON_ESCROWS (activity.ts), which
+  //   recognizes history and grants no trust. Old orders need nothing from
+  //   this table: trackIntent reads no trust table, and every disclosure
+  //   check refuses a quote older than 6 h, so a rev1 order quoted before
+  //   the switch cannot be closed by any version. Listing rev1 here or in
+  //   trustedProtocolAddresses trusts it again for NEW orders; it does not
+  //   help close an old one.
+  "ton:-239": ["EQDybO88l2lrrAmALRUqpmgEE_tuxk510F4Yd4xjbQZxC9IA"],
   "eip155:1": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
   "eip155:56": ["0xafCF681272AF10959736f45616eeCBC22D7095E2"],
   "eip155:137": ["0x41A392062A4307a6961d48e30FF20bF6823715B8"],
@@ -1998,6 +2038,9 @@ function omnistonProvider(opts = {}) {
     const inputToken = assetContract(q.inputAsset);
     const outputToken = assetContract(q.outputAsset);
     const destChainId = tonDest ? null : evmRef2(destChain);
+    if (factory?.chain.$case === destCase && !isTrusted(destChain, factory.chain.value)) {
+      throw new Error(`omniston: untrusted ${destChain} settlement contract ${factory.chain.value}`);
+    }
     if (protocol.chain.$case !== srcCase || !isTrustedOrderProtocol(srcChain, protocol.chain.value) || resolver?.chain.$case !== srcCase || !validEvmAddress(resolver.chain.value) || factory?.chain.$case !== destCase || !isTrusted(destChain, factory.chain.value) || !inputToken || !outputToken || !Number.isSafeInteger(settlement.protocolFeePips) || !tonDest && (destChainId === null || !validEvmAddress(outputToken) || !isPositiveInteger(settlement.dstSecurityDepositUnits ?? ""))) throw new Error("omniston: incomplete EVM order settlement binding in quote");
     const { secrets, created } = await secretsFor(ref, q, 1);
     const hashes = secrets.map((secret) => hashlock(secret, settlement.htlcHashingFunction));
@@ -2242,6 +2285,10 @@ function omnistonProvider(opts = {}) {
       const destCase = q.outputAsset.chain.$case;
       const traderDst = destCase === "ton" ? null : { chain: { $case: destCase, value: (0, import_viem.getAddress)(ref.dest) } };
       if (!traderDst) throw new Error("omniston: TON-destination orders are not supported");
+      const minter = q.settlementData.value.srcProtocolContractAddress;
+      if (minter.chain.$case !== "ton" || !isTrusted(srcChain, minter.chain.value)) {
+        throw new Error(`omniston: untrusted TON settlement contract ${minter.chain.value}`);
+      }
       const settlement = q.settlementData;
       const hashingFunction = settlement.$case === "order" ? settlement.value.htlcHashingFunction : void 0;
       const { secrets, created } = await secretsFor(ref, q, maxExecutions);