@lidofinance/lsv-cli 1.7.0 → 1.9.0

package/dist/tests/utils/arguments-security.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/utils/arguments-security.test.js

@@ -0,0 +1,34 @@
+import { describe, test, expect, vi, beforeEach } from 'vitest';
+import { program } from 'commander';
+import { jsonToRoleAssignment, stringToBigInt, } from '../../utils/arguments.js';
+vi.mock('commander', () => ({ program: { error: vi.fn() } }));
+let programError;
+beforeEach(() => {
+    programError = program.error;
+    vi.clearAllMocks();
+});
+describe('jsonToRoleAssignment structural validation (M3)', () => {
+    test('rejects non-array JSON', () => {
+        expect(() => jsonToRoleAssignment('{"account":"0x1","role":"0x2"}')).toThrow('must be an array');
+    });
+    test('rejects entries missing account field', () => {
+        expect(() => jsonToRoleAssignment('[{"role":"0x2"}]')).toThrow('must contain account and role fields');
+    });
+    test('rejects entries missing role field', () => {
+        expect(() => jsonToRoleAssignment('[{"account":"0x1"}]')).toThrow('must contain account and role fields');
+    });
+    test('rejects null entries', () => {
+        expect(() => jsonToRoleAssignment('[null]')).toThrow('must contain account and role fields');
+    });
+});
+describe('stringToBigInt safe parsing (M5)', () => {
+    test('calls program.error on invalid input', () => {
+        stringToBigInt('not-a-number');
+        expect(programError).toHaveBeenCalledWith(expect.stringContaining('Invalid BigInt value'), expect.objectContaining({ exitCode: 1 }));
+    });
+    test('calls program.error on float input', () => {
+        stringToBigInt('1.5');
+        expect(programError).toHaveBeenCalledWith(expect.stringContaining('Invalid BigInt value'), expect.objectContaining({ exitCode: 1 }));
+    });
+});
+//# sourceMappingURL=arguments-security.test.js.map

package/dist/tests/utils/arguments-security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments-security.test.js","sourceRoot":"","sources":["../../../tests/utils/arguments-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,oBAAoB,EACpB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAElC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9D,IAAI,YAAkB,CAAC;AAEvB,UAAU,CAAC,GAAG,EAAE;IACd,YAAY,GAAG,OAAO,CAAC,KAAwB,CAAC;IAChD,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,CAC1E,kBAAkB,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAC5D,sCAAsC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAC/D,sCAAsC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAClD,sCAAsC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,cAAc,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAC/C,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAC/C,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/arguments.test.js

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
 import { program } from 'commander';
-import { stringToBigIntArray, stringToBigIntArrayWei, stringToHexArray, jsonToPermit, jsonToRoleAssignment, stringToBigInt, etherToWei, stringToNumber, parseTiers, parseTier, parseDepositArray, stringToAddress, stringTo2dArray, stringToHex, jsonFileToPubkeys, stringToNumberArray, etherToGwei, etherToWeiArray, etherToGweiArray, stringToBoolean, parseDeposit, parseValidatorTopUpArray, stringToHash, } from '../../utils/arguments.js';
+import { stringToBigIntArray, stringToBigIntArrayWei, stringToHexArray, jsonToRoleAssignment, stringToBigInt, etherToWei, stringToNumber, parseDepositArray, stringToAddress, stringTo2dArray, stringToHex, jsonFileToPubkeys, stringToNumberArray, etherToWeiArray, stringToBoolean, parseDeposit, parseValidatorTopUpArray, stringToHash, } from '../../utils/arguments.js';
 const MOCK_HEX_ARRAY = [
     '82f3254f7bf057539113fc6b5971d80958618a9893eea717ab5ad345e083df7fceaf55f48716409d3df5adb4f38c4900',
     '23f3254f7bf057539113fc6b5971d80958618a1234eea717ab5ad345e083df7fceaf55f48716409d3df5adb4f38c4900',
@@ -30,11 +30,6 @@ describe('arguments utils', () => {
         expect(stringToHexArray(MOCK_HEX_ARRAY.join(','))).toEqual(MOCK_HEX_ARRAY.map((hex) => `0x${hex}`));
         expect(stringToHexArray(MOCK_HEX_ARRAY.map((hex) => `0x${hex}`).join(','))).toEqual(MOCK_HEX_ARRAY.map((hex) => `0x${hex}`));
     });
-    test('jsonToPermit', () => {
-        const permit = { value: '1', deadline: '2', v: 1, r: '0x1', s: '0x2' };
-        expect(jsonToPermit(JSON.stringify(permit))).toEqual(permit);
-        expect(() => jsonToPermit('{')).toThrow();
-    });
     test('jsonToRoleAssignment', () => {
         const roles = [{ account: '0x1', role: '0x2' }];
         expect(jsonToRoleAssignment(JSON.stringify(roles))).toEqual(roles);
@@ -79,24 +74,11 @@ describe('arguments utils', () => {
     test('stringToNumberArray', () => {
         expect(stringToNumberArray('1,2,3')).toEqual([1, 2, 3]);
     });
-    test('etherToGwei helpers', () => {
-        expect(etherToGwei('1')).toBe(1000000000n);
+    test('etherToWeiArray', () => {
         expect(etherToWeiArray('1,0.5')).toEqual([
             1000000000000000000n,
             500000000000000000n,
         ]);
-        expect(etherToGweiArray('1,2')).toEqual([1000000000n, 2000000000n]);
-    });
-    test('parseTiers and parseTier', () => {
-        const tier = {
-            shareLimit: '1',
-            reserveRatioBP: '2',
-            forcedRebalanceThresholdBP: '3',
-            treasuryFeeBP: '4',
-        };
-        expect(parseTiers(JSON.stringify([tier]))).toEqual([tier]);
-        expect(parseTier(JSON.stringify(tier))).toEqual(tier);
-        expect(() => parseTiers('[')).toThrow();
     });
     test('parseDepositArray', () => {
         const arr = [

package/dist/tests/utils/arguments.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"arguments.test.js","sourceRoot":"","sources":["../../../tests/utils/arguments.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,cAAc,EACd,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,wBAAwB,EACxB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,MAAM,cAAc,GAAG;IACrB,kGAAkG;IAClG,kGAAkG;CACnG,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9D,IAAI,YAAkB,CAAC;AAEvB,UAAU,CAAC,GAAG,EAAE;IACd,YAAY,GAAG,OAAO,CAAC,KAAwB,CAAC;IAChD,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,oBAAoB;YACpB,oBAAoB;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACxD,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CACxC,CAAC;QAEF,MAAM,CACJ,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACpE,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE;QACxB,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QACvE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAClC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACxC,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,CAAC,GAAG,EAAE,GAAG,CAAC;YACV,CAAC,GAAG,EAAE,GAAG,CAAC;SACX,CAAC,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE;QACvB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,oBAAoB;YACpB,mBAAmB;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,GAAG;YACf,cAAc,EAAE,GAAG;YACnB,0BAA0B,EAAE,GAAG;YAC/B,aAAa,EAAE,GAAG;SACnB,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV;gBACE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;gBACzB,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,CAAC;gBACT,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;aACrC;SACF,CAAC;QACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE;QACxB,MAAM,OAAO,GAAG,YAAY,CAC1B,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACzB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC;YACzC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC;SACV,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YAChC,qBAAqB,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YAC/C,eAAe,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YACzC,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG,wBAAwB,CAClC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAC3D,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,EAAE,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,eAAe,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CACxE,4CAA4C,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACnC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"arguments.test.js","sourceRoot":"","sources":["../../../tests/utils/arguments.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,wBAAwB,EACxB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,MAAM,cAAc,GAAG;IACrB,kGAAkG;IAClG,kGAAkG;CACnG,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9D,IAAI,YAAkB,CAAC;AAEvB,UAAU,CAAC,GAAG,EAAE;IACd,YAAY,GAAG,OAAO,CAAC,KAAwB,CAAC;IAChD,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,oBAAoB;YACpB,oBAAoB;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACxD,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CACxC,CAAC;QAEF,MAAM,CACJ,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACpE,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAClC,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACxC,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,CAAC,GAAG,EAAE,GAAG,CAAC;YACV,CAAC,GAAG,EAAE,GAAG,CAAC;SACX,CAAC,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE;QACvB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,oBAAoB;YACpB,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG;YACV;gBACE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;gBACzB,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,CAAC;gBACT,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;aACrC;SACF,CAAC;QACF,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE;QACxB,MAAM,OAAO,GAAG,YAAY,CAC1B,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACzB,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC;YACzC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC;SACV,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YAChC,qBAAqB,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YAC/C,eAAe,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE;YACzC,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG,wBAAwB,CAClC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAC3D,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,EAAE,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,eAAe,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CACxE,4CAA4C,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACnC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/cache-security.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/utils/cache-security.test.js

@@ -0,0 +1,62 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+vi.mock('fs/promises', () => ({
+    default: {
+        readFile: vi.fn(),
+        writeFile: vi.fn(),
+        mkdir: vi.fn(),
+    },
+}));
+vi.mock('../../utils/share-rate.js', () => ({
+    calculateShareRate: vi.fn(),
+}));
+vi.mock('../../utils/rebase-rewards.js', () => ({
+    calculateRebaseReward: vi.fn(),
+}));
+vi.mock('../../utils/logging/index.js', () => ({
+    logInfo: vi.fn(),
+}));
+import fs from 'node:fs/promises';
+import { cache } from '../../utils/cache.js';
+const mockReadFile = fs.readFile;
+beforeEach(() => {
+    vi.clearAllMocks();
+});
+describe('safeJsonParse prototype pollution prevention (M8)', () => {
+    it('should strip __proto__ keys from cached JSON', async () => {
+        const malicious = '{"100": "999", "__proto__": {"polluted": true}}';
+        mockReadFile.mockResolvedValue(malicious);
+        const result = await cache.getShareRate(100);
+        expect(result).toBe(999n);
+        const obj = {};
+        expect(obj.polluted).toBeUndefined();
+    });
+    it('should strip constructor keys from cached JSON', async () => {
+        const malicious = '{"100": "999", "constructor": {"prototype": {"injected": true}}}';
+        mockReadFile.mockResolvedValue(malicious);
+        const result = await cache.getShareRate(100);
+        expect(result).toBe(999n);
+        const obj = {};
+        expect(obj.injected).toBeUndefined();
+    });
+    it('should strip prototype keys from cached JSON', async () => {
+        const malicious = '{"100": "999", "prototype": {"leaked": true}}';
+        mockReadFile.mockResolvedValue(malicious);
+        const result = await cache.getShareRate(100);
+        expect(result).toBe(999n);
+    });
+    it('should strip nested __proto__ keys', async () => {
+        const malicious = '{"100": {"transfer": [], "minted": [], "burned": [], "__proto__": {"bad": true}}}';
+        mockReadFile.mockResolvedValue(malicious);
+        const result = await cache.getIndexedEventsByBlock('0xpool', 100n);
+        expect(result).toBeDefined();
+        expect(result).toHaveProperty('transfer');
+        const obj = {};
+        expect(obj.bad).toBeUndefined();
+    });
+    it('should handle normal JSON without dangerous keys', async () => {
+        mockReadFile.mockResolvedValue(JSON.stringify({ 100: '500' }));
+        const result = await cache.getShareRate(100);
+        expect(result).toBe(500n);
+    });
+});
+//# sourceMappingURL=cache-security.test.js.map

package/dist/tests/utils/cache-security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-security.test.js","sourceRoot":"","sources":["../../../tests/utils/cache-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAa,MAAM,QAAQ,CAAC;AAEzE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE;QACP,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;QACjB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;QAClB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;CACjB,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,MAAM,YAAY,GAAG,EAAE,CAAC,QAAgB,CAAC;AAEzC,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,iDAAiD,CAAC;QACpE,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,EAAS,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,SAAS,GAAG,kEAAkE,CAAC;QACrF,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,EAAS,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,+CAA+C,CAAC;QAClE,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,SAAS,GACb,mFAAmF,CAAC;QACtF,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,EAAS,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/contract-write-stateoverride.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/utils/contract-write-stateoverride.test.js

@@ -0,0 +1,135 @@
+/**
+ * End-to-end regression test for the balanceAwareTransport fix.
+ *
+ * Verifies that stateOverride is injected into eth_estimateGas even when the
+ * call originates from contract.write[method]() — the path that bypassed the
+ * old client.extend() override due to viem's bound-method closure bug.
+ *
+ * Uses real viem (createWalletClient, getContract, writeContract) with a mock
+ * at the fetch level so we can inspect the exact JSON-RPC payload sent to the
+ * node without needing a live chain.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { createWalletClient, getContract, parseAbi } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { balanceAwareTransport } from '../../providers/wallet.js';
+const MAX_UINT256_HEX = '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
+const TEST_PRIVATE_KEY = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
+const MOCK_CHAIN = {
+    id: 1337,
+    name: 'mocknet',
+    nativeCurrency: { name: 'ETH', symbol: 'ETH', decimals: 18 },
+    rpcUrls: { default: { http: ['http://localhost:8545'] } },
+};
+const CONTRACT_ADDRESS = '0x5FbDB2315678afecb367f032d93F642f64180aa3';
+const RECIPIENT = '0x70997970C51812dc3A010C7d01b50e0d17dc79C8';
+const ERC20_ABI = parseAbi([
+    'function transfer(address to, uint256 amount) returns (bool)',
+]);
+// Helpers -------------------------------------------------------------------
+const jsonRpc = (id, result) => Response.json({ jsonrpc: '2.0', id, result }, { headers: { 'Content-Type': 'application/json' } });
+/**
+ * Builds a fetch mock that answers every RPC call viem makes during
+ * contract.write (chainId, nonce, fee estimation, gas estimation, sendTx).
+ *
+ * The capturedEstimateGasCalls array is populated with the full JSON-RPC
+ * body of every eth_estimateGas request so the test can assert on it.
+ */
+const buildFetchMock = (capturedEstimateGasCalls) => vi.fn(async (_url, init) => {
+    const body = JSON.parse(init?.body ?? '{}');
+    const { id, method } = body;
+    switch (method) {
+        case 'eth_chainId': {
+            return jsonRpc(id, `0x${MOCK_CHAIN.id.toString(16)}`);
+        }
+        case 'eth_getTransactionCount': {
+            return jsonRpc(id, '0x0');
+        }
+        // EIP-1559 fee history used by prepareTransactionRequest
+        case 'eth_feeHistory': {
+            return jsonRpc(id, {
+                baseFeePerGas: ['0x1', '0x1'],
+                gasUsedRatio: [0.5],
+                reward: [['0x1']],
+                oldestBlock: '0x1',
+            });
+        }
+        case 'eth_getBlockByNumber': {
+            return jsonRpc(id, {
+                baseFeePerGas: '0x1',
+                number: '0x1',
+                hash: `0x${'a'.repeat(64)}`,
+                transactions: [],
+            });
+        }
+        case 'eth_maxPriorityFeePerGas': {
+            return jsonRpc(id, '0x1');
+        }
+        case 'eth_estimateGas': {
+            capturedEstimateGasCalls.push(body);
+            return jsonRpc(id, '0x5208');
+        }
+        case 'eth_sendRawTransaction': {
+            return jsonRpc(id, `0x${'b'.repeat(64)}`);
+        }
+        default: {
+            return jsonRpc(id, null);
+        }
+    }
+});
+// Tests ---------------------------------------------------------------------
+describe('contract.write — stateOverride injected via balanceAwareTransport', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('eth_estimateGas called by contract.write includes stateOverride for the sender', async () => {
+        const capturedEstimateGasCalls = [];
+        vi.spyOn(globalThis, 'fetch').mockImplementation(buildFetchMock(capturedEstimateGasCalls));
+        const account = privateKeyToAccount(TEST_PRIVATE_KEY);
+        const client = createWalletClient({
+            account,
+            chain: MOCK_CHAIN,
+            transport: balanceAwareTransport('http://localhost:8545'),
+        });
+        const contract = getContract({
+            client,
+            abi: ERC20_ABI,
+            address: CONTRACT_ADDRESS,
+        });
+        // This is the exact path that was broken: viem's bound writeContract →
+        // sendTransaction → prepareTransactionRequest → estimateGas never reached
+        // the client.extend() override. With transport-level interception it works.
+        await contract.write.transfer([RECIPIENT, 100n]);
+        expect(capturedEstimateGasCalls).toHaveLength(1);
+        const estimateGasParams = capturedEstimateGasCalls[0].params;
+        // params[0] = tx object, params[1] = blockTag, params[2] = stateOverride
+        expect(estimateGasParams).toHaveLength(3);
+        expect(estimateGasParams[2]).toMatchObject({
+            [account.address]: { balance: MAX_UINT256_HEX },
+        });
+    });
+    it('walletClient.sendTransaction also injects stateOverride (non-contract path)', async () => {
+        const capturedEstimateGasCalls = [];
+        vi.spyOn(globalThis, 'fetch').mockImplementation(buildFetchMock(capturedEstimateGasCalls));
+        const account = privateKeyToAccount(TEST_PRIVATE_KEY);
+        const client = createWalletClient({
+            account,
+            chain: MOCK_CHAIN,
+            transport: balanceAwareTransport('http://localhost:8545'),
+        });
+        await client.sendTransaction({
+            to: RECIPIENT,
+            value: 0n,
+        });
+        expect(capturedEstimateGasCalls).toHaveLength(1);
+        const estimateGasParams = capturedEstimateGasCalls[0].params;
+        expect(estimateGasParams).toHaveLength(3);
+        expect(estimateGasParams[2]).toMatchObject({
+            [account.address]: { balance: MAX_UINT256_HEX },
+        });
+    });
+});
+//# sourceMappingURL=contract-write-stateoverride.test.js.map

package/dist/tests/utils/contract-write-stateoverride.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-write-stateoverride.test.js","sourceRoot":"","sources":["../../../tests/utils/contract-write-stateoverride.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAc,MAAM,MAAM,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,eAAe,GACnB,oEAAoE,CAAC;AAEvE,MAAM,gBAAgB,GACpB,oEAAoE,CAAC;AAEvE,MAAM,UAAU,GAAU;IACxB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,SAAS;IACf,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE;CAC1D,CAAC;AAEF,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AACtE,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,SAAS,GAAG,QAAQ,CAAC;IACzB,8DAA8D;CAC/D,CAAC,CAAC;AAEH,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAAe,EAAE,EAAE,CAC9C,QAAQ,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAC9B,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACpD,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,wBAAmC,EAAE,EAAE,CAC7D,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,IAAkB,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAE,IAAI,EAAE,IAAe,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,CAAC,EAAE,EAAE;gBACjB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;gBAC7B,YAAY,EAAE,CAAC,GAAG,CAAC;gBACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACjB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC,EAAE,EAAE;gBACjB,aAAa,EAAE,KAAK;gBACpB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;gBAC3B,YAAY,EAAE,EAAE;aACjB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,0BAA0B,CAAC,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAE9E,QAAQ,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACjF,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,wBAAwB,GAAU,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAC9C,cAAc,CAAC,wBAAwB,CAAiB,CACzD,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,qBAAqB,CAAC,uBAAuB,CAAC;SAC1D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,WAAW,CAAC;YAC3B,MAAM;YACN,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QAEH,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,wBAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,yEAAyE;QACzE,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,wBAAwB,GAAU,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAC9C,cAAc,CAAC,wBAAwB,CAAiB,CACzD,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,qBAAqB,CAAC,uBAAuB,CAAC;SAC1D,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,CAAC;YAC3B,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,wBAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/data-validators.test.js

@@ -1,6 +1,26 @@
 import { describe, expect, test } from 'vitest';
-import { validateConfig, isValidUrl, transformAddressesToArray, validateAddressesMap, validateAddressMap, } from '../../utils/data-validators.js';
+import { assertSafeUrl, validateConfig, transformAddressesToArray, validateAddressesMap, validateAddressMap, } from '../../utils/data-validators.js';
 describe('data-validators', () => {
+    describe('assertSafeUrl', () => {
+        test('passes for http URL', () => {
+            expect(() => assertSafeUrl('http://example.com', 'url')).not.toThrow();
+        });
+        test('passes for https URL', () => {
+            expect(() => assertSafeUrl('https://example.com/path?q=1', 'url')).not.toThrow();
+        });
+        test('throws for invalid URL', () => {
+            expect(() => assertSafeUrl('not-a-url', 'callback URL')).toThrow('callback URL: invalid URL: not-a-url');
+        });
+        test('throws for ftp scheme', () => {
+            expect(() => assertSafeUrl('ftp://example.com', 'url')).toThrow('unsupported URL scheme "ftp:" (only http/https allowed)');
+        });
+        test('throws for file scheme', () => {
+            expect(() => assertSafeUrl('file:///etc/passwd', 'url')).toThrow('unsupported URL scheme "file:" (only http/https allowed)');
+        });
+        test('includes label in error message', () => {
+            expect(() => assertSafeUrl('ftp://example.com', 'my label')).toThrow('my label:');
+        });
+    });
     test('validateConfig detects NaN', () => {
         const errors = validateConfig({ CHAIN_ID: Number.NaN, DEPLOYED: 'true' });
         expect(errors).toHaveProperty('CHAIN_ID');
@@ -9,10 +29,6 @@ describe('data-validators', () => {
         const errors = validateConfig({ CHAIN_ID: 1, DEPLOYED: 'true' });
         expect(errors).toEqual({});
     });
-    test('isValidUrl works', () => {
-        expect(isValidUrl('https://example.com')).toBe(true);
-        expect(isValidUrl('not a url')).toBe(false);
-    });
     test('transformAddressesToArray', () => {
         const role1 = '0x0000000000000000000000000000000000000001';
         const role2 = '0x0000000000000000000000000000000000000002';

package/dist/tests/utils/data-validators.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-validators.test.js","sourceRoot":"","sources":["../../../tests/utils/data-validators.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAExC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAE3D,MAAM,KAAK,GAAqB;YAC9B;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC;QACF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,CAAC,EAAE;gBACP,4CAA4C;gBAC5C,4CAA4C;aAC7C;YACD,CAAC,KAAK,CAAC,EAAE,CAAC,4CAA4C,CAAC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,IAAI,EAAE,CAAC,4CAA4C,EAAE,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"data-validators.test.js","sourceRoot":"","sources":["../../../tests/utils/data-validators.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAExC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,8BAA8B,EAAE,KAAK,CAAC,CACrD,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAC9D,sCAAsC,CACvC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAC7D,yDAAyD,CAC1D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAC9D,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAClE,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAE3D,MAAM,KAAK,GAAqB;YAC9B;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC;QACF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,CAAC,EAAE;gBACP,4CAA4C;gBAC5C,4CAA4C;aAC7C;YACD,CAAC,KAAK,CAAC,EAAE,CAAC,4CAA4C,CAAC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,IAAI,EAAE,CAAC,4CAA4C,EAAE,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/deployed-security.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/utils/deployed-security.test.js

@@ -0,0 +1,51 @@
+import { describe, test, expect, vi, beforeEach } from 'vitest';
+const mockEnvs = vi.hoisted(() => {
+    return {};
+});
+// Mock envs to control DEPLOYED value
+vi.mock('../../configs/envs.js', () => ({
+    envs: new Proxy(mockEnvs, {
+        get: (_target, prop) => mockEnvs[prop],
+    }),
+}));
+// Mock fs calls so we don't hit actual filesystem
+vi.mock('node:fs', async (importOriginal) => {
+    const actual = (await importOriginal());
+    return {
+        ...actual,
+        lstatSync: vi.fn(() => ({ isFile: () => true })),
+        readFileSync: vi.fn(() => '{"networkId": 1}'),
+    };
+});
+import { importDeployFile } from '../../configs/deployed.js';
+beforeEach(() => {
+    vi.clearAllMocks();
+    // Clear all keys from mockEnvs
+    for (const key of Object.keys(mockEnvs)) {
+        delete mockEnvs[key];
+    }
+});
+describe('path traversal prevention (H4)', () => {
+    test('rejects path traversal with ../', () => {
+        mockEnvs.DEPLOYED = '../../etc/passwd';
+        expect(() => importDeployFile()).toThrow('Path traversal detected');
+    });
+    test('rejects path traversal with absolute path escape', () => {
+        mockEnvs.DEPLOYED = '../../../etc/shadow';
+        expect(() => importDeployFile()).toThrow('Path traversal detected');
+    });
+    test('allows valid filename in configs dir', () => {
+        mockEnvs.DEPLOYED = 'deployed-hoodi-vaults.json';
+        const result = importDeployFile();
+        expect(result).toEqual({ networkId: 1 });
+    });
+    test('allows subdirectory within configs', () => {
+        mockEnvs.DEPLOYED = 'subdir/deployed.json';
+        const result = importDeployFile();
+        expect(result).toEqual({ networkId: 1 });
+    });
+    test('throws when DEPLOYED is not set', () => {
+        expect(() => importDeployFile()).toThrow('Deployed contracts file is not set');
+    });
+});
+//# sourceMappingURL=deployed-security.test.js.map

package/dist/tests/utils/deployed-security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployed-security.test.js","sourceRoot":"","sources":["../../../tests/utils/deployed-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEhE,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IAC/B,OAAO,EAAwC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,sCAAsC;AACtC,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE;QACxB,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAc,CAAC;KACjD,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,kDAAkD;AAClD,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAQ,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,QAAQ,CAAC,QAAQ,GAAG,kBAAkB,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,QAAQ,CAAC,QAAQ,GAAG,qBAAqB,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,QAAQ,CAAC,QAAQ,GAAG,4BAA4B,CAAC;QACjD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,sBAAsB,CAAC;QAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CACtC,oCAAoC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/get-confirmations.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/utils/get-confirmations.test.js

@@ -0,0 +1,40 @@
+import { describe, test, expect, beforeEach, afterEach } from 'vitest';
+import { getConfirmations } from '../../utils/transactions/utils.js';
+describe('getConfirmations (H5)', () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        delete process.env.CONFIRMATIONS;
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    test('returns default (3) when CONFIRMATIONS not set', () => {
+        expect(getConfirmations()).toBe(3);
+    });
+    test('returns parsed integer when valid', () => {
+        process.env.CONFIRMATIONS = '5';
+        expect(getConfirmations()).toBe(5);
+    });
+    test('returns 1 when set to minimum', () => {
+        process.env.CONFIRMATIONS = '1';
+        expect(getConfirmations()).toBe(1);
+    });
+    test('rejects 0 confirmations (reorg attack vector)', () => {
+        process.env.CONFIRMATIONS = '0';
+        expect(() => getConfirmations()).toThrow('must be an integer >= 1');
+    });
+    test('rejects negative confirmations', () => {
+        process.env.CONFIRMATIONS = '-1';
+        expect(() => getConfirmations()).toThrow('must be an integer >= 1');
+    });
+    test('rejects non-integer confirmations', () => {
+        process.env.CONFIRMATIONS = '2.5';
+        expect(() => getConfirmations()).toThrow('must be an integer >= 1');
+    });
+    test('rejects non-numeric confirmations', () => {
+        process.env.CONFIRMATIONS = 'abc';
+        expect(() => getConfirmations()).toThrow('must be an integer >= 1');
+    });
+});
+//# sourceMappingURL=get-confirmations.test.js.map

package/dist/tests/utils/get-confirmations.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-confirmations.test.js","sourceRoot":"","sources":["../../../tests/utils/get-confirmations.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAEhC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/utils/ipfs-security.test.d.ts

@@ -0,0 +1 @@
+export {};