@anywalletkit/wallet-ton 0.2.5 → 0.3.0

package/dist/index.d.cts

@@ -237,12 +237,26 @@ declare class SimulationError extends Error {
         aborted?: boolean;
     });
 }
+/**
+ * The external message was handed to the network but no definitive answer came back (no response,
+ * a timeout, a non-JSON body): it MAY be on chain. Do not sign again (the next seqno would pay
+ * twice) — watch `hash`, the body hash `sendTransaction` returns.
+ */
+declare class BroadcastUnknownError extends Error {
+    /** Always true: the transaction may be on its way. */
+    readonly maybeSent = true;
+    /** Hex hash of the signed body. */
+    readonly hash: string;
+    constructor(hash: string, cause: unknown);
+}
 
 /** JSON-RPC over one toncenter v2 endpoint. */
 declare function tonCenterEndpoint(endpoint: TonEndpoint, opts?: {
     fetch?: typeof fetch;
     timeoutMs?: number;
 }): TonRpc;
+/** An endpoint answered with a refusal (`ok: false`): nothing was taken. A thrown fetch, a timeout or a non-JSON body may have been. */
+declare function isAnsweredRefusal(e: unknown): boolean;
 /** One RPC, or a failover RPC walking the configured list (`retries` extra rounds after the first full pass). */
 declare function createTonRpc(config: TonConfig): TonRpc | undefined;
 /** State of a TON account on chain. */
@@ -492,9 +506,14 @@ interface TonDescribedMessage {
     jetton?: TonJettonDetails;
     hasStateInit: boolean;
     bodyBits: number;
+    /**
+     * Send mode the wallet sends the message with (IGNORE_ERRORS is always added for an external).
+     * 128 carries the whole remaining balance, 32 destroys the account when it is left empty.
+     */
+    mode?: number;
 }
 /** Problems a TON description is flagged with. */
-type TonWarningCode = 'zero-value' | 'non-bounceable-contract-call' | 'unknown-body' | 'large-forward-amount' | 'testnet-address' | 'mainnet-address' | 'exotic-workchain' | 'extended-actions';
+type TonWarningCode = 'zero-value' | 'non-bounceable-contract-call' | 'unknown-body' | 'large-forward-amount' | 'testnet-address' | 'mainnet-address' | 'exotic-workchain' | 'extended-actions' | 'carries-all-balance' | 'destroys-account';
 /** One flagged problem; `index` is the message it is about. */
 interface TonWarning {
     code: TonWarningCode;
@@ -584,6 +603,15 @@ declare class WalletAccountReadOnlyTon implements IWalletAccountReadOnly {
      */
     getTokenBalance(token: string): Promise<bigint>;
     protected stateInitOf(src: TonTransaction['stateInit']): StateInit | undefined;
+    /**
+     * A destination address with the checks every payment gets: workchain 0 or -1, and a friendly
+     * address's test-only flag matching the wallet's network. Used for a native message's `to` and a
+     * jetton transfer's recipient and response destination (round 3, L8).
+     */
+    protected checkedAddress(to: string): {
+        address: Address;
+        bounceable: boolean;
+    };
     protected transactionMessage(tx: TonTransaction): V5R1Message;
     protected jettonTransferMessage(o: TonTransferOptions): Promise<V5R1Message>;
     protected toMessages(tx: TonTransaction | TonTransaction[]): V5R1Message[];
@@ -730,6 +758,14 @@ declare class WalletAccountTon extends WalletAccountReadOnlyTon implements IWall
      * Checks → seqno → preflight → signed body. The preflight runs on the
      * zero-signed body (ignore_chksig), so nothing is signed before it passes.
      */
+    /**
+     * Refuse send modes that drain the wallet — 128 (the whole remaining balance) and 32 (the account
+     * destroyed once empty) — unless `allowDrainingTransactions`. Checked locally, before any seqno or
+     * emulation, so it holds with `simulate: false` too (round 3, M11); the emulation check stays.
+     */
+    private assertNoDrain;
+    /** The send modes of a prebuilt V5R1 body; an unreadable body is left to the emulation and the node. */
+    private bodyModes;
     private signMessages;
     private preflight;
     /** Sign without broadcasting. Returns the external-message BODY as base64 BoC (pass it back to sendTransaction as a Cell). */
@@ -782,4 +818,4 @@ declare class WalletManagerTon extends WalletManager<WalletAccountTon, TonConfig
     getFeeRates(): Promise<FeeRates>;
 }
 
-export { CAIP2, DEFAULT_SEND_MODE, DEFAULT_TONAPI, type DecodedBody, type EmulateOptions, type EmulationOutcome, type EmulationSource, type EmulationVerdict, type GetMethodResult, JETTON_TRANSFER_OP, MAINNET_GLOBAL_ID, MAX_ACTIONS, MessageIsTransactionError, type ParsedV5R1Body, SEND_MODE, SimulationError, TESTNET_GLOBAL_ID, TON_BASE_PATH, TON_MNEMONIC_PATH, type TonAccountState, type TonAccountStatus, type TonAddressParts, TonCenter, type TonConfig, type TonDescribedKind, type TonDescribedMessage, type TonDescription, type TonEmulateConfig, type TonEndpoint, type TonFees, type TonJettonDetails, type TonProof, type TonProofRequest, type TonProvider, type TonReceipt, type TonRisk, type TonRpc, type TonSendable, type TonSignDataPayload, type TonSignDataRequest, type TonSignedData, type TonSimulation, type TonSimulationSource, type TonTransaction, type TonTransferOptions, type TonWarning, type TonWarningCode, UnsafeTransactionError, type V5R1Message, type V5R1SigningParams, type V5R1WalletIdParts, V5R1_CODE_HEX, V5R1_OP, WalletAccountReadOnlyTon, WalletAccountTon, WalletManagerTon, commentCell, createTonRpc as createTonClient, createTonRpc, decodeBody, WalletManagerTon as default, describeMessageRelaxed, describeTransaction, emulateExternal, emulateViaTonapi, installBufferGlobal, parseEmulation, parseTonapiConsequences, parseTonapiRisk, parseTonapiTrace, parseV5R1Body, resolveEmulate, runEmulation, tonCenterEndpoint, tonProofDigest, tonSignDataDigest, v5r1Address, v5r1Code, v5r1ExternalMessage, v5r1PackSigned, v5r1PackUnsigned, v5r1SigningMessage, v5r1StateInit, v5r1WalletId };
+export { BroadcastUnknownError, CAIP2, DEFAULT_SEND_MODE, DEFAULT_TONAPI, type DecodedBody, type EmulateOptions, type EmulationOutcome, type EmulationSource, type EmulationVerdict, type GetMethodResult, JETTON_TRANSFER_OP, MAINNET_GLOBAL_ID, MAX_ACTIONS, MessageIsTransactionError, type ParsedV5R1Body, SEND_MODE, SimulationError, TESTNET_GLOBAL_ID, TON_BASE_PATH, TON_MNEMONIC_PATH, type TonAccountState, type TonAccountStatus, type TonAddressParts, TonCenter, type TonConfig, type TonDescribedKind, type TonDescribedMessage, type TonDescription, type TonEmulateConfig, type TonEndpoint, type TonFees, type TonJettonDetails, type TonProof, type TonProofRequest, type TonProvider, type TonReceipt, type TonRisk, type TonRpc, type TonSendable, type TonSignDataPayload, type TonSignDataRequest, type TonSignedData, type TonSimulation, type TonSimulationSource, type TonTransaction, type TonTransferOptions, type TonWarning, type TonWarningCode, UnsafeTransactionError, type V5R1Message, type V5R1SigningParams, type V5R1WalletIdParts, V5R1_CODE_HEX, V5R1_OP, WalletAccountReadOnlyTon, WalletAccountTon, WalletManagerTon, commentCell, createTonRpc as createTonClient, createTonRpc, decodeBody, WalletManagerTon as default, describeMessageRelaxed, describeTransaction, emulateExternal, emulateViaTonapi, installBufferGlobal, isAnsweredRefusal, parseEmulation, parseTonapiConsequences, parseTonapiRisk, parseTonapiTrace, parseV5R1Body, resolveEmulate, runEmulation, tonCenterEndpoint, tonProofDigest, tonSignDataDigest, v5r1Address, v5r1Code, v5r1ExternalMessage, v5r1PackSigned, v5r1PackUnsigned, v5r1SigningMessage, v5r1StateInit, v5r1WalletId };

package/dist/index.d.ts

@@ -237,12 +237,26 @@ declare class SimulationError extends Error {
         aborted?: boolean;
     });
 }
+/**
+ * The external message was handed to the network but no definitive answer came back (no response,
+ * a timeout, a non-JSON body): it MAY be on chain. Do not sign again (the next seqno would pay
+ * twice) — watch `hash`, the body hash `sendTransaction` returns.
+ */
+declare class BroadcastUnknownError extends Error {
+    /** Always true: the transaction may be on its way. */
+    readonly maybeSent = true;
+    /** Hex hash of the signed body. */
+    readonly hash: string;
+    constructor(hash: string, cause: unknown);
+}
 
 /** JSON-RPC over one toncenter v2 endpoint. */
 declare function tonCenterEndpoint(endpoint: TonEndpoint, opts?: {
     fetch?: typeof fetch;
     timeoutMs?: number;
 }): TonRpc;
+/** An endpoint answered with a refusal (`ok: false`): nothing was taken. A thrown fetch, a timeout or a non-JSON body may have been. */
+declare function isAnsweredRefusal(e: unknown): boolean;
 /** One RPC, or a failover RPC walking the configured list (`retries` extra rounds after the first full pass). */
 declare function createTonRpc(config: TonConfig): TonRpc | undefined;
 /** State of a TON account on chain. */
@@ -492,9 +506,14 @@ interface TonDescribedMessage {
     jetton?: TonJettonDetails;
     hasStateInit: boolean;
     bodyBits: number;
+    /**
+     * Send mode the wallet sends the message with (IGNORE_ERRORS is always added for an external).
+     * 128 carries the whole remaining balance, 32 destroys the account when it is left empty.
+     */
+    mode?: number;
 }
 /** Problems a TON description is flagged with. */
-type TonWarningCode = 'zero-value' | 'non-bounceable-contract-call' | 'unknown-body' | 'large-forward-amount' | 'testnet-address' | 'mainnet-address' | 'exotic-workchain' | 'extended-actions';
+type TonWarningCode = 'zero-value' | 'non-bounceable-contract-call' | 'unknown-body' | 'large-forward-amount' | 'testnet-address' | 'mainnet-address' | 'exotic-workchain' | 'extended-actions' | 'carries-all-balance' | 'destroys-account';
 /** One flagged problem; `index` is the message it is about. */
 interface TonWarning {
     code: TonWarningCode;
@@ -584,6 +603,15 @@ declare class WalletAccountReadOnlyTon implements IWalletAccountReadOnly {
      */
     getTokenBalance(token: string): Promise<bigint>;
     protected stateInitOf(src: TonTransaction['stateInit']): StateInit | undefined;
+    /**
+     * A destination address with the checks every payment gets: workchain 0 or -1, and a friendly
+     * address's test-only flag matching the wallet's network. Used for a native message's `to` and a
+     * jetton transfer's recipient and response destination (round 3, L8).
+     */
+    protected checkedAddress(to: string): {
+        address: Address;
+        bounceable: boolean;
+    };
     protected transactionMessage(tx: TonTransaction): V5R1Message;
     protected jettonTransferMessage(o: TonTransferOptions): Promise<V5R1Message>;
     protected toMessages(tx: TonTransaction | TonTransaction[]): V5R1Message[];
@@ -730,6 +758,14 @@ declare class WalletAccountTon extends WalletAccountReadOnlyTon implements IWall
      * Checks → seqno → preflight → signed body. The preflight runs on the
      * zero-signed body (ignore_chksig), so nothing is signed before it passes.
      */
+    /**
+     * Refuse send modes that drain the wallet — 128 (the whole remaining balance) and 32 (the account
+     * destroyed once empty) — unless `allowDrainingTransactions`. Checked locally, before any seqno or
+     * emulation, so it holds with `simulate: false` too (round 3, M11); the emulation check stays.
+     */
+    private assertNoDrain;
+    /** The send modes of a prebuilt V5R1 body; an unreadable body is left to the emulation and the node. */
+    private bodyModes;
     private signMessages;
     private preflight;
     /** Sign without broadcasting. Returns the external-message BODY as base64 BoC (pass it back to sendTransaction as a Cell). */
@@ -782,4 +818,4 @@ declare class WalletManagerTon extends WalletManager<WalletAccountTon, TonConfig
     getFeeRates(): Promise<FeeRates>;
 }
 
-export { CAIP2, DEFAULT_SEND_MODE, DEFAULT_TONAPI, type DecodedBody, type EmulateOptions, type EmulationOutcome, type EmulationSource, type EmulationVerdict, type GetMethodResult, JETTON_TRANSFER_OP, MAINNET_GLOBAL_ID, MAX_ACTIONS, MessageIsTransactionError, type ParsedV5R1Body, SEND_MODE, SimulationError, TESTNET_GLOBAL_ID, TON_BASE_PATH, TON_MNEMONIC_PATH, type TonAccountState, type TonAccountStatus, type TonAddressParts, TonCenter, type TonConfig, type TonDescribedKind, type TonDescribedMessage, type TonDescription, type TonEmulateConfig, type TonEndpoint, type TonFees, type TonJettonDetails, type TonProof, type TonProofRequest, type TonProvider, type TonReceipt, type TonRisk, type TonRpc, type TonSendable, type TonSignDataPayload, type TonSignDataRequest, type TonSignedData, type TonSimulation, type TonSimulationSource, type TonTransaction, type TonTransferOptions, type TonWarning, type TonWarningCode, UnsafeTransactionError, type V5R1Message, type V5R1SigningParams, type V5R1WalletIdParts, V5R1_CODE_HEX, V5R1_OP, WalletAccountReadOnlyTon, WalletAccountTon, WalletManagerTon, commentCell, createTonRpc as createTonClient, createTonRpc, decodeBody, WalletManagerTon as default, describeMessageRelaxed, describeTransaction, emulateExternal, emulateViaTonapi, installBufferGlobal, parseEmulation, parseTonapiConsequences, parseTonapiRisk, parseTonapiTrace, parseV5R1Body, resolveEmulate, runEmulation, tonCenterEndpoint, tonProofDigest, tonSignDataDigest, v5r1Address, v5r1Code, v5r1ExternalMessage, v5r1PackSigned, v5r1PackUnsigned, v5r1SigningMessage, v5r1StateInit, v5r1WalletId };
+export { BroadcastUnknownError, CAIP2, DEFAULT_SEND_MODE, DEFAULT_TONAPI, type DecodedBody, type EmulateOptions, type EmulationOutcome, type EmulationSource, type EmulationVerdict, type GetMethodResult, JETTON_TRANSFER_OP, MAINNET_GLOBAL_ID, MAX_ACTIONS, MessageIsTransactionError, type ParsedV5R1Body, SEND_MODE, SimulationError, TESTNET_GLOBAL_ID, TON_BASE_PATH, TON_MNEMONIC_PATH, type TonAccountState, type TonAccountStatus, type TonAddressParts, TonCenter, type TonConfig, type TonDescribedKind, type TonDescribedMessage, type TonDescription, type TonEmulateConfig, type TonEndpoint, type TonFees, type TonJettonDetails, type TonProof, type TonProofRequest, type TonProvider, type TonReceipt, type TonRisk, type TonRpc, type TonSendable, type TonSignDataPayload, type TonSignDataRequest, type TonSignedData, type TonSimulation, type TonSimulationSource, type TonTransaction, type TonTransferOptions, type TonWarning, type TonWarningCode, UnsafeTransactionError, type V5R1Message, type V5R1SigningParams, type V5R1WalletIdParts, V5R1_CODE_HEX, V5R1_OP, WalletAccountReadOnlyTon, WalletAccountTon, WalletManagerTon, commentCell, createTonRpc as createTonClient, createTonRpc, decodeBody, WalletManagerTon as default, describeMessageRelaxed, describeTransaction, emulateExternal, emulateViaTonapi, installBufferGlobal, isAnsweredRefusal, parseEmulation, parseTonapiConsequences, parseTonapiRisk, parseTonapiTrace, parseV5R1Body, resolveEmulate, runEmulation, tonCenterEndpoint, tonProofDigest, tonSignDataDigest, v5r1Address, v5r1Code, v5r1ExternalMessage, v5r1PackSigned, v5r1PackUnsigned, v5r1SigningMessage, v5r1StateInit, v5r1WalletId };

package/dist/index.js

@@ -47,6 +47,17 @@ var SimulationError = class extends Error {
     this.aborted = details.aborted ?? false;
   }
 };
+var BroadcastUnknownError = class extends Error {
+  /** Always true: the transaction may be on its way. */
+  maybeSent = true;
+  /** Hex hash of the signed body. */
+  hash;
+  constructor(hash, cause) {
+    super(`Broadcast outcome unknown for ${hash}: ${cause instanceof Error ? cause.message.slice(0, 200) : String(cause).slice(0, 200)}`, { cause });
+    this.name = "BroadcastUnknownError";
+    this.hash = hash;
+  }
+};
 
 // src/toncenter.ts
 import { NetworkError } from "@anywalletkit/core";
@@ -84,12 +95,15 @@ function tonCenterEndpoint(endpoint, opts = {}) {
       }
       if (!res.ok || json.ok !== true) {
         const detail = typeof json.error === "string" ? json.error : JSON.stringify(json.error ?? json);
-        throw new NetworkError(`${method}: ${detail} (HTTP ${res.status})`, { provider: url });
+        throw Object.assign(new NetworkError(`${method}: ${detail} (HTTP ${res.status})`, { provider: url }), { answered: true });
       }
       return json.result;
     }
   };
 }
+function isAnsweredRefusal(e) {
+  return e?.answered === true;
+}
 function createTonRpc(config) {
   const target = config.tonClient ?? config.provider;
   if (target === void 0) return void 0;
@@ -102,14 +116,17 @@ function createTonRpc(config) {
   return {
     async call(method, params) {
       let lastError;
+      let answered = true;
       for (let i = 0; i < attempts; i++) {
         try {
           return await list[i % list.length].call(method, params);
         } catch (e) {
           lastError = e;
+          answered &&= isAnsweredRefusal(e);
         }
       }
-      throw new NetworkError(`All TON endpoints failed for ${method}`, { cause: lastError });
+      const err = new NetworkError(`All TON endpoints failed for ${method}`, { cause: lastError });
+      throw answered ? Object.assign(err, { answered: true }) : err;
     }
   };
 }
@@ -645,6 +662,19 @@ function describeOne(i, to, value, body, hasStateInit, bounceableOverride, warni
   return item;
 }
 var hex = (n) => `0x${n.toString(16).padStart(8, "0")}`;
+var IGNORE_ERRORS = 2;
+function sendModeOf(sendMode) {
+  return (sendMode ?? DEFAULT_SEND_MODE) | IGNORE_ERRORS;
+}
+function drainModes(mode) {
+  return [...(mode & 128) !== 0 ? ["carries-all-balance"] : [], ...(mode & 32) !== 0 ? ["destroys-account"] : []];
+}
+function withMode(i, item, mode, warnings) {
+  for (const code of drainModes(mode)) {
+    warnings.push({ code, message: code === "carries-all-balance" ? "send mode 128: the message carries the whole remaining balance" : "send mode 32: the wallet account is destroyed once it is empty", index: i });
+  }
+  return { ...item, mode };
+}
 function describeMessageRelaxed(i, m, warnings, ctx = {}) {
   if (m.info.type !== "internal") {
     warnings.push({ code: "unknown-body", message: "not an internal message", index: i });
@@ -666,7 +696,7 @@ function describeTransaction(tx, ctx = {}) {
       return { kind: "contract-call", items, warnings };
     }
     external2 = { seqno: parsed.seqno, validUntil: parsed.validUntil, walletId: parsed.walletId, signed: parsed.signed };
-    parsed.messages.forEach((m, i) => items.push(describeMessageRelaxed(i, m.message, warnings, ctx)));
+    parsed.messages.forEach((m, i) => items.push(withMode(i, describeMessageRelaxed(i, m.message, warnings, ctx), m.mode, warnings)));
   } else {
     const list = Array.isArray(tx) ? tx : [tx];
     list.forEach((t, i) => {
@@ -684,7 +714,7 @@ function describeTransaction(tx, ctx = {}) {
       } catch {
         warnings.push({ code: "unknown-body", message: "bodyBoc is not a valid BoC", index: i });
       }
-      items.push(describeOne(i, to, BigInt(t.value), body, t.stateInit !== void 0, t.bounceable, warnings, ctx));
+      items.push(withMode(i, describeOne(i, to, BigInt(t.value), body, t.stateInit !== void 0, t.bounceable, warnings, ctx), sendModeOf(t.sendMode), warnings));
     });
   }
   const kinds = new Set(items.map((x) => x.kind));
@@ -790,25 +820,34 @@ var WalletAccountReadOnlyTon = class {
     if (src instanceof Cell4) return loadStateInit(src.beginParse());
     return src;
   }
-  transactionMessage(tx) {
-    const value = big(tx.value);
-    if (value <= 0n) throw new UnsafeTransactionError("zero-value", "TON message value must be positive.");
+  /**
+   * A destination address with the checks every payment gets: workchain 0 or -1, and a friendly
+   * address's test-only flag matching the wallet's network. Used for a native message's `to` and a
+   * jetton transfer's recipient and response destination (round 3, L8).
+   */
+  checkedAddress(to) {
     let address;
     let bounceable = true;
     let testOnly;
-    if (Address4.isFriendly(tx.to)) {
-      const f = Address4.parseFriendly(tx.to);
+    if (Address4.isFriendly(to)) {
+      const f = Address4.parseFriendly(to);
       address = f.address;
       bounceable = f.isBounceable;
       testOnly = f.isTestOnly;
     } else {
-      address = Address4.parse(tx.to);
+      address = Address4.parse(to);
     }
     if (address.workChain !== 0 && address.workChain !== -1) throw new UnsafeTransactionError("exotic-workchain", `Refusing to send to workchain ${address.workChain}.`);
     const testnet = this._config.network === "testnet";
     if (testOnly !== void 0 && testOnly !== testnet) {
       throw new UnsafeTransactionError("network-mismatch", testOnly ? "Test-only address on a mainnet wallet." : "Mainnet address on a testnet wallet.");
     }
+    return { address, bounceable };
+  }
+  transactionMessage(tx) {
+    const value = big(tx.value);
+    if (value <= 0n) throw new UnsafeTransactionError("zero-value", "TON message value must be positive.");
+    const { address, bounceable } = this.checkedAddress(tx.to);
     const body = tx.body instanceof Cell4 ? tx.body : typeof tx.body === "string" ? tx.body === "" ? void 0 : commentCell(tx.body) : tx.bodyBoc ? Cell4.fromBase64(tx.bodyBoc) : void 0;
     const init = this.stateInitOf(tx.stateInit);
     const message = internal({ to: address, value, bounce: tx.bounceable ?? bounceable, ...body ? { body } : {}, ...init ? { init } : {} });
@@ -817,14 +856,15 @@ var WalletAccountReadOnlyTon = class {
   async jettonTransferMessage(o) {
     const amount = big(o.amount);
     if (amount <= 0n) throw new UnsafeTransactionError("zero-value", "Jetton amount must be positive.");
-    const recipient = Address4.parse(o.recipient);
+    const recipient = this.checkedAddress(o.recipient).address;
+    const response = o.responseDestination ? this.checkedAddress(o.responseDestination).address : void 0;
     const jw = await this.getJettonWalletAddress(o.token);
     await this.jettonWalletData(o.token, jw);
     const forwardTonAmount = o.forwardTonAmount !== void 0 ? big(o.forwardTonAmount) : 1n;
     if (o.memo !== void 0 && o.forwardPayload !== void 0) throw new UnsafeTransactionError("memo-and-payload", "Pass either memo or forwardPayload, not both: a jetton transfer carries one forward payload.");
     const payload = o.forwardPayload ?? o.memo;
     const forwardPayload = payload === void 0 ? null : typeof payload === "string" ? commentCell(payload) : payload;
-    const body = beginCell3().storeUint(JETTON_TRANSFER_OP2, 32).storeUint(o.queryId !== void 0 ? BigInt(o.queryId) : randomQueryId(), 64).storeCoins(amount).storeAddress(recipient).storeAddress(o.responseDestination ? Address4.parse(o.responseDestination) : this._address).storeMaybeRef(o.customPayload ?? null).storeCoins(forwardTonAmount).storeMaybeRef(forwardPayload).endCell();
+    const body = beginCell3().storeUint(JETTON_TRANSFER_OP2, 32).storeUint(o.queryId !== void 0 ? BigInt(o.queryId) : randomQueryId(), 64).storeCoins(amount).storeAddress(recipient).storeAddress(response ?? this._address).storeMaybeRef(o.customPayload ?? null).storeCoins(forwardTonAmount).storeMaybeRef(forwardPayload).endCell();
     const attached = o.attachedValue !== void 0 ? big(o.attachedValue) : (this._config.jettonAttachedValue !== void 0 ? big(this._config.jettonAttachedValue) : DEFAULT_JETTON_ATTACHED) + forwardTonAmount;
     return { message: internal({ to: jw, value: attached, bounce: true, body }) };
   }
@@ -1081,7 +1121,22 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
    * Checks → seqno → preflight → signed body. The preflight runs on the
    * zero-signed body (ignore_chksig), so nothing is signed before it passes.
    */
+  /**
+   * Refuse send modes that drain the wallet — 128 (the whole remaining balance) and 32 (the account
+   * destroyed once empty) — unless `allowDrainingTransactions`. Checked locally, before any seqno or
+   * emulation, so it holds with `simulate: false` too (round 3, M11); the emulation check stays.
+   */
+  assertNoDrain(modes) {
+    if (this._config.allowDrainingTransactions === true) return;
+    const found = modes.flatMap(drainModes);
+    if (found.length) throw new UnsafeTransactionError("drain", `Refusing a message with send mode ${found.includes("carries-all-balance") ? "128 (it carries the whole remaining balance)" : "32 (it destroys the wallet account once empty)"}; set allowDrainingTransactions to override.`);
+  }
+  /** The send modes of a prebuilt V5R1 body; an unreadable body is left to the emulation and the node. */
+  bodyModes(body) {
+    return parseV5R1Body(body)?.messages.map((m) => m.mode) ?? [];
+  }
   async signMessages(messages, limit, op) {
+    this.assertNoDrain(messages.map((m) => sendModeOf(m.mode)));
     const want = messages.reduce((sum, m) => sum + (m.message.info.type === "internal" ? m.message.info.value.coins : 0n), 0n);
     if (want > 0n) {
       const balance = await this.getBalance();
@@ -1113,6 +1168,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   /** Sign without broadcasting. Returns the external-message BODY as base64 BoC (pass it back to sendTransaction as a Cell). */
   async signTransaction(tx, options = {}) {
     if (tx instanceof Cell5) {
+      this.assertNoDrain(this.bodyModes(tx));
       await this.preflight(tx, feeLimit(this._config.transactionMaxFee, options), "transaction");
       return tx.toBoc().toString("base64");
     }
@@ -1122,12 +1178,19 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   async broadcast(body) {
     const rpc = this.requireRpc("send transactions");
     const init = await this.initIfNeeded();
-    await rpc.sendBoc(v5r1ExternalMessage(this._address, body, init));
-    return body.hash().toString("hex");
+    const hash = body.hash().toString("hex");
+    try {
+      await rpc.sendBoc(v5r1ExternalMessage(this._address, body, init));
+    } catch (e) {
+      if (isAnsweredRefusal(e)) throw e;
+      throw new BroadcastUnknownError(hash, e);
+    }
+    return hash;
   }
   /** Sign and broadcast; `hash` is the body hash (hex) — resolve it with getTransactionReceipt. */
   async sendTransaction(tx, options = {}) {
     this.requireRpc("send transactions");
+    if (tx instanceof Cell5) this.assertNoDrain(this.bodyModes(tx));
     const { body, fee } = tx instanceof Cell5 ? { body: tx, fee: await this.preflight(tx, feeLimit(this._config.transactionMaxFee, options), "transaction") } : await this.signMessages(this.toMessages(tx), feeLimit(this._config.transactionMaxFee, options), "transaction");
     return { hash: await this.broadcast(body), fee };
   }
@@ -1151,7 +1214,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
 
 // src/manager.ts
 import { LocalSigner as LocalSigner2, SignerError as SignerError2, WalletManager, isSeedSigner, zeroize } from "@anywalletkit/core";
-import { mnemonicToPrivateKey } from "@ton/crypto";
+import { mnemonicToPrivateKey, mnemonicValidate } from "@ton/crypto";
 var TON_BASE_PATH = "m/44'/607'";
 var TON_MNEMONIC_PATH = "ton-mnemonic";
 var WalletManagerTon = class _WalletManagerTon extends WalletManager {
@@ -1166,6 +1229,7 @@ var WalletManagerTon = class _WalletManagerTon extends WalletManager {
   static async fromTonMnemonic(words, config = {}) {
     const list = (Array.isArray(words) ? words : words.trim().split(/\s+/)).map((w) => w.toLowerCase());
     if (list.length !== 24) throw new Error("A TON mnemonic has 24 words.");
+    if (!await mnemonicValidate(list)) throw new Error("Not a valid TON mnemonic: check the words (a typo would open a different, empty wallet).");
     const pair = await mnemonicToPrivateKey(list);
     const privateKey = new Uint8Array(pair.secretKey.subarray(0, 32));
     const publicKey = new Uint8Array(pair.publicKey);
@@ -1232,6 +1296,7 @@ var WalletManagerTon = class _WalletManagerTon extends WalletManager {
 // src/index.ts
 installBufferGlobal();
 export {
+  BroadcastUnknownError,
   CAIP2,
   DEFAULT_SEND_MODE,
   DEFAULT_TONAPI,
@@ -1265,6 +1330,7 @@ export {
   emulateViaTonapi,
   encodeCursor as encodeHistoryCursor,
   installBufferGlobal,
+  isAnsweredRefusal,
   mapActions as mapTonapiActions,
   mapTonapiEvent,
   mapToncenterTransaction,