@debridge-finance/borderless-validation-sdk 0.0.0-dev-dee2389

package/dist/esm/validations/solana-sign.js

@@ -0,0 +1,168 @@
+import { hexToBytes } from "viem";
+import { ViolationCode, SolanaActionKind, SolanaActionOperation, } from "../types/index.js";
+import { computeSolanaIntentId } from "../helpers/solana-intent-id.js";
+// Validates Sign (Intent) actions within Solana requiredActions
+export function validateSolanaSignActions(actions, basePath, realChainId, quoteMode, intent, envConfig) {
+    const signActions = [];
+    for (let i = 0; i < actions.length; i++) {
+        if (actions[i].type === SolanaActionKind.Sign) {
+            signActions.push({ action: actions[i], index: i });
+        }
+    }
+    // In quote mode, Sign actions may be absent — skip validation
+    if (quoteMode)
+        return [];
+    const violations = [];
+    // HIGH: Exactly one Sign action must be present in execution mode
+    if (signActions.length === 0) {
+        return [{
+                code: ViolationCode.SolanaSignIntentMissing,
+                message: "Sign (Intent) action is required in execution mode",
+                path: `${basePath}.requiredActions`,
+            }];
+    }
+    if (signActions.length > 1) {
+        violations.push({
+            code: ViolationCode.SolanaSignIntentDuplicate,
+            message: `expected exactly 1 Sign action, found ${signActions.length}`,
+            path: `${basePath}.requiredActions`,
+            expected: 1,
+            actual: signActions.length,
+        });
+    }
+    for (const { action, index } of signActions) {
+        const actionPath = `${basePath}.requiredActions[${index}]`;
+        violations.push(...validateSignActionsList(action, actionPath), ...validateSignIntentData(action, actionPath, realChainId, intent, envConfig));
+    }
+    return violations;
+}
+// HIGH: actions[] must contain exactly one element — Intent
+function validateSignActionsList(action, actionPath) {
+    if (action.actions.length !== 1
+        || action.actions[0] !== SolanaActionOperation.Intent) {
+        return [{
+                code: ViolationCode.SolanaSignIntentActionsInvalid,
+                message: "Sign action must have exactly one operation: [Intent]",
+                path: `${actionPath}.actions`,
+                expected: [SolanaActionOperation.Intent],
+                actual: action.actions,
+            }];
+    }
+    return [];
+}
+// CRITICAL: Verify that action.data.data contains the correct intent signature buffer
+function validateSignIntentData(action, actionPath, realChainId, intent, envConfig) {
+    const dataHex = action.data.data;
+    let dataBytes;
+    try {
+        const prefixed = dataHex.startsWith("0x") ? dataHex : `0x${dataHex}`;
+        dataBytes = hexToBytes(prefixed);
+    }
+    catch (error) {
+        return [{
+                code: ViolationCode.SolanaSignIntentDataInvalid,
+                // CRITICAL: action.data.data must be a valid hex string
+                message: "Sign action data.data is not a valid hex string",
+                path: `${actionPath}.data.data`,
+                details: error,
+            }];
+    }
+    return validateSignatureBuffer(dataBytes, actionPath, realChainId, intent, envConfig.solanaSignatureConfig, envConfig.solanaIntentProgram);
+}
+// CRITICAL: Validates the signature buffer structure and intentId
+function validateSignatureBuffer(dataBytes, actionPath, realChainId, intent, config, intentProgram) {
+    // Validate buffer format: prefix + chainId(u32LE) + label + intentId(32 bytes)
+    if (dataBytes.length !== config.expectedBufferLength) {
+        return [{
+                code: ViolationCode.SolanaSignIntentDataInvalid,
+                // CRITICAL: buffer length must match expected format
+                message: "Sign intent buffer has unexpected length"
+                    + ` (expected ${config.expectedBufferLength}, got ${dataBytes.length})`,
+                path: `${actionPath}.data.data`,
+                expected: config.expectedBufferLength,
+                actual: dataBytes.length,
+            }];
+    }
+    // Verify prefix bytes
+    let offset = 0;
+    if (!bytesEqual(dataBytes, offset, config.prefix)) {
+        return [{
+                code: ViolationCode.SolanaSignIntentDataInvalid,
+                // CRITICAL: prefix must match environment
+                message: "Sign intent buffer has invalid prefix",
+                path: `${actionPath}.data.data`,
+            }];
+    }
+    offset += config.prefix.length;
+    // Verify chainId bytes
+    if (!bytesEqual(dataBytes, offset, config.chainIdBytes)) {
+        return [{
+                code: ViolationCode.SolanaSignIntentDataInvalid,
+                // CRITICAL: chainId must match Solana real chain ID
+                message: "Sign intent buffer has invalid chainId",
+                path: `${actionPath}.data.data`,
+            }];
+    }
+    offset += 4;
+    // Verify "intents" label bytes
+    if (!bytesEqual(dataBytes, offset, config.label)) {
+        return [{
+                code: ViolationCode.SolanaSignIntentDataInvalid,
+                // CRITICAL: label must be "intents"
+                message: "Sign intent buffer has invalid label (expected \"intents\")",
+                path: `${actionPath}.data.data`,
+            }];
+    }
+    offset += config.label.length;
+    // Extract intentId from the buffer (last 32 bytes)
+    const bufferIntentId = dataBytes.slice(offset, offset + 32);
+    // Compute expected intentId from intent structure
+    return validateIntentId(bufferIntentId, actionPath, realChainId, intent, intentProgram);
+}
+// CRITICAL: Compute intentId from response intent and compare with buffer
+function validateIntentId(bufferIntentId, actionPath, realChainId, intent, intentProgram) {
+    let computedHex;
+    try {
+        computedHex = computeSolanaIntentId(intent, realChainId, intentProgram);
+    }
+    catch (error) {
+        return [{
+                code: ViolationCode.SolanaSignIntentIdComputeError,
+                // CRITICAL: intentId computation failed
+                message: "failed to compute Solana intentId from intent structure",
+                path: `${actionPath}.data.data`,
+                details: error,
+            }];
+    }
+    // Convert buffer intentId to hex for comparison
+    const bufferHex = "0x" + bytesToHex(bufferIntentId);
+    if (bufferHex !== computedHex) {
+        return [{
+                code: ViolationCode.SolanaSignIntentIdMismatch,
+                // CRITICAL: intentId in sign buffer must match computed intentId
+                message: "Sign intent buffer contains intentId that does not match computed value",
+                path: `${actionPath}.data.data`,
+                expected: computedHex,
+                actual: bufferHex,
+            }];
+    }
+    return [];
+}
+// =============================================
+// Helpers
+// =============================================
+function bytesEqual(data, offset, expected) {
+    for (let i = 0; i < expected.length; i++) {
+        if (data[offset + i] !== expected[i])
+            return false;
+    }
+    return true;
+}
+function bytesToHex(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, "0");
+    }
+    return hex;
+}
+//# sourceMappingURL=solana-sign.js.map

package/dist/esm/validations/solana-sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-sign.js","sourceRoot":"","sources":["../../../src/validations/solana-sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAEH,aAAa,EAEb,gBAAgB,EAChB,qBAAqB,GAGxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAIpE,gEAAgE;AAChE,MAAM,UAAU,yBAAyB,CACrC,OAA+B,EAC/B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,MAAsB,EACtB,SAA4B;IAE5B,MAAM,WAAW,GAAsD,EAAE,CAAC;IAE1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC5C,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,kEAAkE;IAClE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,uBAAuB;gBAC3C,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,GAAG,QAAQ,kBAAkB;aACtC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa,CAAC,yBAAyB;YAC7C,OAAO,EAAE,yCAAyC,WAAW,CAAC,MAAM,EAAE;YACtE,IAAI,EAAE,GAAG,QAAQ,kBAAkB;YACnC,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,WAAW,CAAC,MAAM;SAC7B,CAAC,CAAC;IACP,CAAC;IAED,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,KAAK,GAAG,CAAC;QAE3D,UAAU,CAAC,IAAI,CACX,GAAG,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9C,GAAG,sBAAsB,CACrB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CACrD,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,4DAA4D;AAC5D,SAAS,uBAAuB,CAC5B,MAA4B,EAC5B,UAAkB;IAElB,IACI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;WACxB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,MAAM,EACvD,CAAC;QACC,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,GAAG,UAAU,UAAU;gBAC7B,QAAQ,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,sBAAsB,CAC3B,MAA4B,EAC5B,UAAkB,EAClB,WAAoB,EACpB,MAAsB,EACtB,SAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAEjC,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrE,SAAS,GAAG,UAAU,CAAC,QAAyB,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,wDAAwD;gBACxD,OAAO,EAAE,iDAAiD;gBAC1D,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,OAAO,EAAE,KAAK;aACjB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,uBAAuB,CAC1B,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,mBAAmB,CAC7G,CAAC;AACN,CAAC;AAED,kEAAkE;AAClE,SAAS,uBAAuB,CAC5B,SAAqB,EACrB,UAAkB,EAClB,WAAoB,EACpB,MAAsB,EACtB,MAA6B,EAC7B,aAAqB;IAErB,+EAA+E;IAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,qDAAqD;gBACrD,OAAO,EACH,0CAA0C;sBACxC,cAAc,MAAM,CAAC,oBAAoB,SAAS,SAAS,CAAC,MAAM,GAAG;gBAC3E,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,QAAQ,EAAE,MAAM,CAAC,oBAAoB;gBACrC,MAAM,EAAE,SAAS,CAAC,MAAM;aAC3B,CAAC,CAAC;IACP,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,0CAA0C;gBAC1C,OAAO,EAAE,uCAAuC;gBAChD,IAAI,EAAE,GAAG,UAAU,YAAY;aAClC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAE/B,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,oDAAoD;gBACpD,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE,GAAG,UAAU,YAAY;aAClC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,IAAI,CAAC,CAAC;IAEZ,+BAA+B;IAC/B,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;gBAC/C,oCAAoC;gBACpC,OAAO,EAAE,6DAA6D;gBACtE,IAAI,EAAE,GAAG,UAAU,YAAY;aAClC,CAAC,CAAC;IACP,CAAC;IACD,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;IAE9B,mDAAmD;IACnD,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;IAE5D,kDAAkD;IAClD,OAAO,gBAAgB,CACnB,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CACjE,CAAC;AACN,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CACrB,cAA0B,EAC1B,UAAkB,EAClB,WAAoB,EACpB,MAAsB,EACtB,aAAqB;IAErB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACD,WAAW,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,8BAA8B;gBAClD,wCAAwC;gBACxC,OAAO,EAAE,yDAAyD;gBAClE,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,OAAO,EAAE,KAAK;aACjB,CAAC,CAAC;IACP,CAAC;IAED,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAEpD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,0BAA0B;gBAC9C,iEAAiE;gBACjE,OAAO,EAAE,yEAAyE;gBAClF,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,UAAU;AACV,gDAAgD;AAEhD,SAAS,UAAU,CAAC,IAAgB,EAAE,MAAc,EAAE,QAAoB;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACjC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/esm/validations/solana-transaction.js

@@ -0,0 +1,234 @@
+import { ViolationCode, SolanaActionKind, SolanaActionOperation, } from "../types/index.js";
+import { addressEquals } from "../helpers/address.js";
+import { decodeSolanaVersionedTransaction } from "../helpers/solana-transaction-decode.js";
+import { resolveInstructions, isClassicApprove, isCustomApprove, isSystemTransfer, isSyncNative, isCreateAtaIdempotent, isComputeBudget, isMemo, } from "../helpers/solana-instruction.js";
+import { COMPUTE_BUDGET_PROGRAM, SPL_NATIVE_MINT, } from "../whitelists/solana/programs.js";
+import { validateSolanaBudgetInstructions } from "./solana-op-budget.js";
+import { validateSolanaWrapInstructions } from "./solana-op-wrap.js";
+const ALLOWED_TX_ACTIONS = new Set([
+    SolanaActionOperation.Wrap,
+    SolanaActionOperation.Budget,
+]);
+// Validates Transaction actions (AA=false)
+export function validateSolanaTransactionActions(actions, basePath, realChainId, quoteMode, srcChainAuthorityAddress, request, trades, envConfig) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        if (actions[i].type !== SolanaActionKind.Transaction)
+            continue;
+        const action = actions[i];
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        violations.push(...validateActionsList(action, actionPath), ...validateWrapRequiresNativeToken(action, actionPath, trades, realChainId));
+        const decoded = decodeTransaction(action, actionPath);
+        if (!decoded.ok) {
+            violations.push(...decoded.violations);
+            continue;
+        }
+        const accountKeys = getStaticAccountKeys(decoded.transaction);
+        const resolved = resolveInstructions(decoded.transaction.message.compiledInstructions, accountKeys);
+        violations.push(...validateTransactionFeePayer(decoded.transaction, actionPath, realChainId, quoteMode, srcChainAuthorityAddress), ...validateTransactionComputeBudget(decoded.transaction, actionPath), ...validateAllowedInstructions(decoded.transaction, actionPath, envConfig.solanaTransactionAllowedPrograms, ViolationCode.SolanaTransactionForbiddenInstruction, "Transaction"), ...validateSolanaBudgetInstructions(action, resolved, actionPath, request, trades, realChainId, quoteMode, srcChainAuthorityAddress, envConfig), ...validateSolanaWrapInstructions(action, resolved, actionPath, trades, realChainId, quoteMode, srcChainAuthorityAddress), ...validateNoUnclassifiedInstructions(resolved, actionPath, buildClassifiers(envConfig.solanaIntentProgram, isComputeBudget)));
+    }
+    return violations;
+}
+// Validates SignTransaction actions (AA=true)
+export function validateSolanaSignTransactionActions(actions, basePath, realChainId, quoteMode, srcChainAuthorityAddress, request, trades, envConfig) {
+    const violations = [];
+    for (let i = 0; i < actions.length; i++) {
+        if (actions[i].type !== SolanaActionKind.SignTransaction)
+            continue;
+        const action = actions[i];
+        const actionPath = `${basePath}.requiredActions[${i}]`;
+        violations.push(...validateActionsList(action, actionPath), ...validateWrapRequiresNativeToken(action, actionPath, trades, realChainId));
+        const decoded = decodeTransaction(action, actionPath);
+        if (!decoded.ok) {
+            violations.push(...decoded.violations);
+            continue;
+        }
+        const accountKeys = getStaticAccountKeys(decoded.transaction);
+        const resolved = resolveInstructions(decoded.transaction.message.compiledInstructions, accountKeys);
+        violations.push(...validateSignTransactionFeePayer(decoded.transaction, actionPath, realChainId, quoteMode, srcChainAuthorityAddress), ...validateAllowedInstructions(decoded.transaction, actionPath, envConfig.solanaSignTransactionAllowedPrograms, ViolationCode.SolanaSignTransactionForbiddenInstruction, "SignTransaction"), ...validateSolanaBudgetInstructions(action, resolved, actionPath, request, trades, realChainId, quoteMode, srcChainAuthorityAddress, envConfig), ...validateSolanaWrapInstructions(action, resolved, actionPath, trades, realChainId, quoteMode, srcChainAuthorityAddress), ...validateNoUnclassifiedInstructions(resolved, actionPath, buildClassifiers(envConfig.solanaIntentProgram, isMemo)));
+    }
+    return violations;
+}
+// =============================================
+// Common validations for Transaction and SignTransaction
+// =============================================
+// HIGH: actions[] must only contain Wrap, Budget
+function validateActionsList(action, actionPath) {
+    const invalid = action.actions.filter(a => !ALLOWED_TX_ACTIONS.has(a));
+    if (invalid.length === 0)
+        return [];
+    return [{
+            code: ViolationCode.SolanaTransactionActionsInvalid,
+            message: `actions[] contains disallowed operations: ${invalid.join(", ")}`,
+            path: `${actionPath}.actions`,
+            expected: [...ALLOWED_TX_ACTIONS],
+            actual: action.actions,
+        }];
+}
+// HIGH: If actions[] contains Wrap, at least one trade must use native SOL
+function validateWrapRequiresNativeToken(action, actionPath, trades, realChainId) {
+    if (!action.actions.includes(SolanaActionOperation.Wrap))
+        return [];
+    const hasNativeTrade = trades.some(trade => addressEquals(realChainId, trade.srcChainTokenIn, SPL_NATIVE_MINT));
+    if (hasNativeTrade)
+        return [];
+    return [{
+            code: ViolationCode.SolanaWrapNotForNativeToken,
+            message: "Wrap operation present but no trade uses native SOL as srcChainTokenIn",
+            path: `${actionPath}.actions`,
+            actual: trades.map(t => t.srcChainTokenIn),
+        }];
+}
+// CRITICAL: Decode and validate VersionedTransaction(MessageV0)
+function decodeTransaction(action, actionPath) {
+    return decodeSolanaVersionedTransaction(action.data.data, `${actionPath}.data.data`, ViolationCode.SolanaTransactionDecodeError, ViolationCode.SolanaTransactionVersionInvalid);
+}
+// =============================================
+// Transaction-specific (AA=false)
+// =============================================
+// HIGH (execution mode): feePayer must equal srcChainAuthorityAddress
+function validateTransactionFeePayer(transaction, actionPath, realChainId, quoteMode, srcChainAuthorityAddress) {
+    // NO NEED (quote): feePayer is a placeholder
+    if (quoteMode || !srcChainAuthorityAddress)
+        return [];
+    const feePayer = getFeePayer(transaction);
+    if (!feePayer)
+        return [];
+    if (!addressEquals(realChainId, feePayer, srcChainAuthorityAddress)) {
+        return [{
+                code: ViolationCode.SolanaTransactionFeePayerMismatch,
+                message: "Transaction feePayer must equal request.trades[].srcChainAuthorityAddress",
+                path: `${actionPath}.data.data`,
+                expected: srcChainAuthorityAddress,
+                actual: feePayer,
+            }];
+    }
+    return [];
+}
+// HIGH: compiledInstructions[] must contain at least 2 ComputeBudget instructions at the beginning
+function validateTransactionComputeBudget(transaction, actionPath) {
+    const instructions = transaction.message.compiledInstructions;
+    const accountKeys = getStaticAccountKeys(transaction);
+    let computeBudgetCount = 0;
+    for (let i = 0; i < instructions.length; i++) {
+        const programId = accountKeys[instructions[i].programIdIndex];
+        if (!programId)
+            break;
+        if (programId === COMPUTE_BUDGET_PROGRAM) {
+            computeBudgetCount++;
+        }
+        else {
+            break; // ComputeBudget instructions must be at the beginning
+        }
+    }
+    if (computeBudgetCount < 2) {
+        return [{
+                code: ViolationCode.SolanaTransactionComputeBudgetMissing,
+                message: "Transaction must have at least 2 ComputeBudget instructions at the beginning",
+                path: `${actionPath}.data.data`,
+                expected: 2,
+                actual: computeBudgetCount,
+            }];
+    }
+    return [];
+}
+// CRITICAL: no instructions from disallowed programs
+function validateAllowedInstructions(transaction, actionPath, allowedPrograms, violationCode, label) {
+    const accountKeys = getStaticAccountKeys(transaction);
+    const violations = [];
+    for (const ix of transaction.message.compiledInstructions) {
+        const programId = resolveProgramId(accountKeys, ix.programIdIndex);
+        if (programId === undefined) {
+            // CRITICAL: program ID resolved via Address Lookup Table — forbidden
+            violations.push({
+                code: violationCode,
+                message: "instruction references program via Address Lookup Table"
+                    + ` (index ${ix.programIdIndex}), forbidden in ${label}`,
+                path: `${actionPath}.data.data`,
+                actual: ix.programIdIndex,
+            });
+            continue;
+        }
+        if (!allowedPrograms.has(programId)) {
+            violations.push({
+                code: violationCode,
+                // CRITICAL: forbidden instruction program
+                message: `${label} contains instruction from disallowed program: ${programId}`,
+                path: `${actionPath}.data.data`,
+                actual: programId,
+            });
+        }
+    }
+    return violations;
+}
+// =============================================
+// SignTransaction-specific (AA=true)
+// =============================================
+// CRITICAL (execution mode): feePayer must NOT be the user
+function validateSignTransactionFeePayer(transaction, actionPath, realChainId, quoteMode, srcChainAuthorityAddress) {
+    // NO NEED (quote): feePayer is a placeholder
+    if (quoteMode || !srcChainAuthorityAddress)
+        return [];
+    const feePayer = getFeePayer(transaction);
+    if (!feePayer)
+        return [];
+    if (addressEquals(realChainId, feePayer, srcChainAuthorityAddress)) {
+        return [{
+                code: ViolationCode.SolanaSignTransactionFeePayerIsUser,
+                // CRITICAL: feePayer must NOT be the user
+                message: "SignTransaction feePayer must NOT be the user"
+                    + " (request.trades[].srcChainAuthorityAddress)",
+                path: `${actionPath}.data.data`,
+                actual: feePayer,
+            }];
+    }
+    return [];
+}
+// Builds classifiers for validateNoUnclassifiedInstructions.
+// `leadClassifier` is isComputeBudget for Transaction, isMemo for SignTransaction.
+function buildClassifiers(intentProgram, leadClassifier) {
+    return [
+        leadClassifier,
+        isClassicApprove,
+        (ix) => isCustomApprove(ix, intentProgram),
+        isSystemTransfer,
+        isSyncNative,
+        isCreateAtaIdempotent,
+    ];
+}
+// CRITICAL: every instruction from an allowed program must be recognized by at least one classifier.
+function validateNoUnclassifiedInstructions(resolved, actionPath, classifiers) {
+    const violations = [];
+    for (let i = 0; i < resolved.length; i++) {
+        const ix = resolved[i];
+        const classified = classifiers.some(classify => classify(ix));
+        if (!classified) {
+            violations.push({
+                code: ViolationCode.SolanaUnclassifiedInstruction,
+                message: `instruction [${i}] from program ${ix.programId}`
+                    + " was not recognized by any validator",
+                path: `${actionPath}.data.data`,
+                actual: ix.programId,
+            });
+        }
+    }
+    return violations;
+}
+// =============================================
+// Helpers
+// =============================================
+function getFeePayer(transaction) {
+    const keys = transaction.message.staticAccountKeys;
+    if (keys.length === 0)
+        return undefined;
+    return keys[0].toBase58();
+}
+function getStaticAccountKeys(transaction) {
+    return transaction.message.staticAccountKeys.map((key) => key.toBase58());
+}
+// Returns the program ID string if it is in staticAccountKeys,
+// or undefined if the index points beyond (Address Lookup Table).
+function resolveProgramId(staticAccountKeys, programIdIndex) {
+    return staticAccountKeys[programIdIndex];
+}
+//# sourceMappingURL=solana-transaction.js.map

package/dist/esm/validations/solana-transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-transaction.js","sourceRoot":"","sources":["../../../src/validations/solana-transaction.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,aAAa,EAIb,gBAAgB,EAChB,qBAAqB,GAExB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAEH,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,MAAM,GACT,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACH,sBAAsB,EACtB,eAAe,GAClB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACvC,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC/B,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,UAAU,gCAAgC,CAC5C,OAA+B,EAC/B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,wBAA4C,EAC5C,OAA8B,EAC9B,MAAsB,EACtB,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,WAAW;YAAE,SAAS;QAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QAEvD,UAAU,CAAC,IAAI,CACX,GAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1C,GAAG,+BAA+B,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAC9E,CAAC;QAEF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAChC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAChD,WAAW,CACd,CAAC;QAEF,UAAU,CAAC,IAAI,CACX,GAAG,2BAA2B,CAC1B,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACpF,EACD,GAAG,gCAAgC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EACpE,GAAG,2BAA2B,CAC1B,OAAO,CAAC,WAAW,EACnB,UAAU,EACV,SAAS,CAAC,gCAAgC,EAC1C,aAAa,CAAC,qCAAqC,EACnD,aAAa,CAChB,EACD,GAAG,gCAAgC,CAC/B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAC7C,WAAW,EAAE,SAAS,EAAE,wBAAwB,EAAE,SAAS,CAC9D,EACD,GAAG,8BAA8B,CAC7B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACzF,EACD,GAAG,kCAAkC,CACjC,QAAQ,EACR,UAAU,EACV,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CACnE,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,oCAAoC,CAChD,OAA+B,EAC/B,QAAgB,EAChB,WAAoB,EACpB,SAAkB,EAClB,wBAA4C,EAC5C,OAA8B,EAC9B,MAAsB,EACtB,SAA4B;IAE5B,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,eAAe;YAAE,SAAS;QAEnE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,QAAQ,oBAAoB,CAAC,GAAG,CAAC;QAEvD,UAAU,CAAC,IAAI,CACX,GAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1C,GAAG,+BAA+B,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAC9E,CAAC;QAEF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACvC,SAAS;QACb,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAChC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAChD,WAAW,CACd,CAAC;QAEF,UAAU,CAAC,IAAI,CACX,GAAG,+BAA+B,CAC9B,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACpF,EACD,GAAG,2BAA2B,CAC1B,OAAO,CAAC,WAAW,EACnB,UAAU,EACV,SAAS,CAAC,oCAAoC,EAC9C,aAAa,CAAC,yCAAyC,EACvD,iBAAiB,CACpB,EACD,GAAG,gCAAgC,CAC/B,MAAM,EACN,QAAQ,EACR,UAAU,EACV,OAAO,EACP,MAAM,EACN,WAAW,EACX,SAAS,EACT,wBAAwB,EACxB,SAAS,CACZ,EACD,GAAG,8BAA8B,CAC7B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,CACzF,EACD,GAAG,kCAAkC,CACjC,QAAQ,EACR,UAAU,EACV,gBAAgB,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAC1D,CACJ,CAAC;IACN,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,yDAAyD;AACzD,gDAAgD;AAEhD,iDAAiD;AACjD,SAAS,mBAAmB,CACxB,MAA4B,EAC5B,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,OAAO,CAAC;YACJ,IAAI,EAAE,aAAa,CAAC,+BAA+B;YACnD,OAAO,EAAE,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1E,IAAI,EAAE,GAAG,UAAU,UAAU;YAC7B,QAAQ,EAAE,CAAC,GAAG,kBAAkB,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,OAAO;SACzB,CAAC,CAAC;AACP,CAAC;AAED,2EAA2E;AAC3E,SAAS,+BAA+B,CACpC,MAA4B,EAC5B,UAAkB,EAClB,MAAsB,EACtB,WAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAC9B,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,eAAe,CAAC,CAC9E,CAAC;IAEF,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO,CAAC;YACJ,IAAI,EAAE,aAAa,CAAC,2BAA2B;YAC/C,OAAO,EAAE,wEAAwE;YACjF,IAAI,EAAE,GAAG,UAAU,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;AACP,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CACtB,MAA4B,EAC5B,UAAkB;IAElB,OAAO,gCAAgC,CACnC,MAAM,CAAC,IAAI,CAAC,IAAI,EAChB,GAAG,UAAU,YAAY,EACzB,aAAa,CAAC,4BAA4B,EAC1C,aAAa,CAAC,+BAA+B,CAChD,CAAC;AACN,CAAC;AAED,gDAAgD;AAChD,kCAAkC;AAClC,gDAAgD;AAEhD,sEAAsE;AACtE,SAAS,2BAA2B,CAChC,WAAiC,EACjC,UAAkB,EAClB,WAAoB,EACpB,SAAkB,EAClB,wBAA4C;IAE5C,6CAA6C;IAC7C,IAAI,SAAS,IAAI,CAAC,wBAAwB;QAAE,OAAO,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,iCAAiC;gBACrD,OAAO,EAAE,2EAA2E;gBACpF,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,QAAQ;aACnB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,SAAS,gCAAgC,CACrC,WAAiC,EACjC,UAAkB;IAElB,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC9D,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS;YAAE,MAAM;QAEtB,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;YACvC,kBAAkB,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,sDAAsD;QACjE,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,qCAAqC;gBACzD,OAAO,EACH,8EAA8E;gBAClF,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,kBAAkB;aAC7B,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAED,qDAAqD;AACrD,SAAS,2BAA2B,CAChC,WAAiC,EACjC,UAAkB,EAClB,eAAoC,EACpC,aAA4B,EAC5B,KAAa;IAEb,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,qEAAqE;YACrE,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,OAAO,EACH,yDAAyD;sBACvD,WAAW,EAAE,CAAC,cAAc,mBAAmB,KAAK,EAAE;gBAC5D,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,MAAM,EAAE,EAAE,CAAC,cAAc;aAC5B,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,0CAA0C;gBAC1C,OAAO,EAAE,GAAG,KAAK,kDAAkD,SAAS,EAAE;gBAC9E,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,qCAAqC;AACrC,gDAAgD;AAEhD,2DAA2D;AAC3D,SAAS,+BAA+B,CACpC,WAAiC,EACjC,UAAkB,EAClB,WAAoB,EACpB,SAAkB,EAClB,wBAA4C;IAE5C,6CAA6C;IAC7C,IAAI,SAAS,IAAI,CAAC,wBAAwB;QAAE,OAAO,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC;gBACJ,IAAI,EAAE,aAAa,CAAC,mCAAmC;gBACvD,0CAA0C;gBAC1C,OAAO,EACH,+CAA+C;sBAC7C,8CAA8C;gBACpD,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,MAAM,EAAE,QAAQ;aACnB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,CAAC;AACd,CAAC;AAQD,6DAA6D;AAC7D,mFAAmF;AACnF,SAAS,gBAAgB,CACrB,aAAqB,EACrB,cAAqC;IAErC,OAAO;QACH,cAAc;QACd,gBAAgB;QAChB,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,aAAa,CAAC;QAC1C,gBAAgB;QAChB,YAAY;QACZ,qBAAqB;KACxB,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,SAAS,kCAAkC,CACvC,QAA+B,EAC/B,UAAkB,EAClB,WAAoC;IAEpC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9D,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,6BAA6B;gBACjD,OAAO,EACH,gBAAgB,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE;sBAC/C,sCAAsC;gBAC5C,IAAI,EAAE,GAAG,UAAU,YAAY;gBAC/B,MAAM,EAAE,EAAE,CAAC,SAAS;aACvB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gDAAgD;AAChD,UAAU;AACV,gDAAgD;AAEhD,SAAS,WAAW,CAAC,WAAiC;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAiC;IAC3D,OAAO,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAC5C,CAAC,GAAc,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CACrC,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,kEAAkE;AAClE,SAAS,gBAAgB,CACrB,iBAA2B,EAC3B,cAAsB;IAEtB,OAAO,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC"}

package/dist/esm/validations/trade-grouping.js

@@ -0,0 +1,161 @@
+import { ViolationCode, } from "../types/index.js";
+import { resolveChainId } from "../whitelists/subscription-to-chain-id.js";
+import { addressEquals } from "../helpers/address.js";
+// Groups request trades to match them later with response intents.
+//
+// Quote mode: groups by srcChainId only (addresses are placeholders).
+//
+// Execution mode: groups by (srcChainId, srcChainAuthorityAddress).
+//
+// NOTE: the API may further split a group into multiple intents based on
+// fields like intent.executionMetadata, intent.dlnMetadata,
+// intent.externalCallHash, etc. that are not present in the request, so one
+// group can correspond to one or more response intents.
+export function groupTrades(trades, quoteMode) {
+    const map = new Map();
+    const violations = [];
+    // Track already-reported unknown subscriptionIds to avoid duplicate violations
+    const reportedUnknown = new Set();
+    for (let i = 0; i < trades.length; i++) {
+        const trade = trades[i];
+        const realChainId = resolveChainId(trade.srcChainId);
+        if (realChainId === undefined) {
+            if (!reportedUnknown.has(trade.srcChainId)) {
+                reportedUnknown.add(trade.srcChainId);
+                // CRITICAL: unknown subscriptionId — cannot validate this trade
+                violations.push({
+                    code: ViolationCode.UnknownSubscriptionId,
+                    message: `srcChainId=${trade.srcChainId} is not a known subscriptionId`,
+                    path: `request.trades[${i}].srcChainId`,
+                    actual: trade.srcChainId,
+                });
+            }
+            continue;
+        }
+        const key = quoteMode
+            ? String(trade.srcChainId)
+            : `${trade.srcChainId}:${trade.srcChainAuthorityAddress ?? ""}`;
+        let group = map.get(key);
+        if (!group) {
+            group = {
+                srcChainId: trade.srcChainId,
+                srcChainAuthorityAddress: quoteMode ? undefined : trade.srcChainAuthorityAddress,
+                realChainId,
+                tradeIndices: [],
+                trades: [],
+            };
+            map.set(key, group);
+        }
+        group.tradeIndices.push(i);
+        group.trades.push(trade);
+    }
+    return { groups: Array.from(map.values()), violations };
+}
+// Matches each response intent to its trade group.
+//
+// Quote mode: matches by intentChainId == group.srcChainId.
+//
+// Execution mode: additionally requires intentOwner == group.srcChainAuthorityAddress
+// (case-insensitive).
+//
+// Multiple intents may match the same group. An intent that matches no group
+// produces a violation.
+export function matchIntentsToGroups(intents, groups, quoteMode) {
+    const contexts = [];
+    const violations = [];
+    for (let i = 0; i < intents.length; i++) {
+        const intentPayload = intents[i];
+        const intent = intentPayload.intent;
+        const matched = groups.find(g => {
+            if (g.srcChainId !== intent.intentChainId)
+                return false;
+            if (!quoteMode && g.srcChainAuthorityAddress !== undefined) {
+                return addressEquals(g.realChainId, g.srcChainAuthorityAddress, intent.intentOwner);
+            }
+            return true;
+        });
+        if (matched) {
+            contexts.push({
+                intentIndex: i,
+                intentPayload,
+                tradeGroup: matched,
+            });
+        }
+        else {
+            violations.push({
+                code: ViolationCode.IntentNotMatchedToTradeGroup,
+                message: `intent[${i}] (intentId=${intent.intentId}) does not match any trade group`,
+                path: `response.intents[${i}]`,
+                expected: undefined,
+                actual: intent,
+            });
+        }
+    }
+    violations.push(...validateGroupCoverage(groups, contexts));
+    violations.push(...validateIntentDifferentiation(contexts));
+    return { contexts, violations };
+}
+// CRITICAL: every trade group must have at least one matching intent.
+function validateGroupCoverage(groups, contexts) {
+    const coveredGroups = new Set(contexts.map(ctx => ctx.tradeGroup));
+    const violations = [];
+    for (const group of groups) {
+        if (!coveredGroups.has(group)) {
+            const tradeList = group.tradeIndices.join(", ");
+            violations.push({
+                code: ViolationCode.TradeGroupHasNoIntent,
+                message: `trade group (srcChainId=${group.srcChainId},`
+                    + ` authority=${group.srcChainAuthorityAddress ?? "quote"})`
+                    + ` has no matching intent`
+                    + ` (request trades: [${tradeList}])`,
+                path: "response.intents",
+                expected: group,
+            });
+        }
+    }
+    return violations;
+}
+// CRITICAL: intents matched to the same trade group must differ
+// in at least one of: externalCallHash, dlnMetadata, executionMetadata.
+// Duplicate intents within a group indicate an API bug or MITM attack.
+function validateIntentDifferentiation(contexts) {
+    const byGroup = new Map();
+    for (const ctx of contexts) {
+        const list = byGroup.get(ctx.tradeGroup) ?? [];
+        list.push(ctx);
+        byGroup.set(ctx.tradeGroup, list);
+    }
+    const violations = [];
+    for (const [, groupContexts] of byGroup) {
+        if (groupContexts.length <= 1)
+            continue;
+        const seen = new Map();
+        for (const ctx of groupContexts) {
+            const key = intentDifferentiationKey(ctx.intentPayload.intent);
+            const firstIndex = seen.get(key);
+            if (firstIndex !== undefined) {
+                violations.push({
+                    code: ViolationCode.DuplicateIntentsInTradeGroup,
+                    message: `intents[${firstIndex}] and intents[${ctx.intentIndex}]`
+                        + ` are in the same trade group but do not differ`
+                        + ` in externalCallHash, dlnMetadata, or`
+                        + ` executionMetadata`,
+                    path: `response.intents[${ctx.intentIndex}]`,
+                    actual: ctx.intentPayload.intent,
+                });
+            }
+            else {
+                seen.set(key, ctx.intentIndex);
+            }
+        }
+    }
+    return violations;
+}
+function intentDifferentiationKey(intent) {
+    return [
+        intent.externalCallHash ?? "",
+        intent.dlnMetadata ?? "",
+        intent.executionMetadata ?? "",
+    ].join("|");
+}
+//# sourceMappingURL=trade-grouping.js.map

package/dist/esm/validations/trade-grouping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trade-grouping.js","sourceRoot":"","sources":["../../../src/validations/trade-grouping.ts"],"names":[],"mappings":"AAAA,OAAO,EAMH,aAAa,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAgBnD,mEAAmE;AACnE,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,4DAA4D;AAC5D,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,UAAU,WAAW,CACvB,MAAsB,EACtB,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,+EAA+E;IAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtC,gEAAgE;gBAChE,UAAU,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa,CAAC,qBAAqB;oBACzC,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,gCAAgC;oBACvE,IAAI,EAAE,kBAAkB,CAAC,cAAc;oBACvC,MAAM,EAAE,KAAK,CAAC,UAAU;iBAC3B,CAAC,CAAC;YACP,CAAC;YACD,SAAS;QACb,CAAC;QAED,MAAM,GAAG,GAAG,SAAS;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,EAAE,CAAC;QAEpE,IAAI,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,GAAG;gBACJ,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB;gBAChF,WAAW;gBACX,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;aACb,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC;AAED,mDAAmD;AACnD,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,sFAAsF;AACtF,sBAAsB;AACtB,EAAE;AACF,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,UAAU,oBAAoB,CAChC,OAAgC,EAChC,MAAoB,EACpB,SAAkB;IAElB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC5B,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YACxD,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,aAAa,CAChB,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,wBAAwB,EAC1B,MAAM,CAAC,WAAW,CACrB,CAAC;YACN,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACV,WAAW,EAAE,CAAC;gBACd,aAAa;gBACb,UAAU,EAAE,OAAO;aACtB,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,4BAA4B;gBAChD,OAAO,EAAE,UAAU,CAAC,eAAe,MAAM,CAAC,QAAQ,kCAAkC;gBACpF,IAAI,EAAE,oBAAoB,CAAC,GAAG;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5D,UAAU,CAAC,IAAI,CAAC,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,SAAS,qBAAqB,CAC1B,MAAoB,EACpB,QAAyB;IAEzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,qBAAqB;gBACzC,OAAO,EACH,2BAA2B,KAAK,CAAC,UAAU,GAAG;sBAC5C,cAAc,KAAK,CAAC,wBAAwB,IAAI,OAAO,GAAG;sBAC1D,yBAAyB;sBACzB,sBAAsB,SAAS,IAAI;gBACzC,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,KAAK;aAClB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gEAAgE;AAChE,wEAAwE;AACxE,uEAAuE;AACvE,SAAS,6BAA6B,CAClC,QAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC;YAAE,SAAS;QAExC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa,CAAC,4BAA4B;oBAChD,OAAO,EACH,WAAW,UAAU,iBAAiB,GAAG,CAAC,WAAW,GAAG;0BACtD,gDAAgD;0BAChD,uCAAuC;0BACvC,oBAAoB;oBAC1B,IAAI,EAAE,oBAAoB,GAAG,CAAC,WAAW,GAAG;oBAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,MAAM;iBACnC,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAsB;IACpD,OAAO;QACH,MAAM,CAAC,gBAAgB,IAAI,EAAE;QAC7B,MAAM,CAAC,WAAW,IAAI,EAAE;QACxB,MAAM,CAAC,iBAAiB,IAAI,EAAE;KACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC"}