@nodiusxyz/solana-agent-kit 0.0.0-stage → 0.1.1

package/src/internal/transport.ts

@@ -0,0 +1,112 @@
+import { NodiusClient } from "@nodiusxyz/sdk";
+import { Connection } from "@solana/web3.js";
+import { endpoint, rawAmount } from "./config.js";
+export interface Pricing {
+  ok?: boolean;
+  credits_per_usdc: number;
+  sol_usdc: { price: number; age_secs: number } | null;
+  methods: Record<string, any>;
+}
+export function finite(n: unknown): number {
+  if (typeof n !== "number" || !Number.isFinite(n) || n < 0)
+    throw new Error("Invalid live numeric field");
+  return n;
+}
+export function estimateBuy(p: Pricing, lamports: bigint): number {
+  const c = finite(p.credits_per_usdc),
+    q = p.sol_usdc,
+    m = p.methods?.executeSnipe;
+  if (!q || finite(q.age_secs) > 15 || finite(q.price) <= 0 || !m || c <= 0)
+    throw new Error("Fresh authoritative buy pricing unavailable");
+  const v =
+    finite(m.build_fee_credits) +
+    Math.ceil(
+      ((Number(lamports) / 1e9) * q.price * c * finite(m.flow_fee_bps)) / 10000,
+    );
+  if (!Number.isSafeInteger(v) || v <= 0 || !Number.isSafeInteger(c) || c <= 0)
+    throw new Error("Unsafe pricing estimate/rate");
+  return v;
+}
+export function sendFee(p: Pricing): number {
+  const m = p.methods?.sendAndConfirm;
+  const base = finite(m?.base_credits);
+  // landed_credits is the terminal TOTAL, not a surcharge on base_credits.
+  const fee = Math.max(base, finite(m?.landed_credits));
+  if (!Number.isSafeInteger(fee) || fee <= 0)
+    throw new Error("Invalid sendAndConfirm live fee");
+  return fee;
+}
+export class Transport {
+  readonly sdk: NodiusClient;
+  readonly connection: Connection;
+  readonly origin: string;
+  constructor(
+    origin: string,
+    private readonly apiKey?: string,
+  ) {
+    this.origin = endpoint(origin);
+    this.sdk = new NodiusClient(this.origin, {
+      apiKey,
+      autoPay: false,
+      maxRetries: 0,
+      timeout: 10000,
+    });
+    this.connection = new Connection(this.origin + "/rpc", {
+      commitment: "confirmed",
+      httpHeaders: apiKey ? { "X-Api-Key": apiKey } : {},
+      disableRetryOnRateLimit: true,
+      fetch: (url, init) =>
+        fetch(url, {
+          ...init,
+          signal: AbortSignal.timeout(10000),
+          redirect: "error",
+          cache: "no-store",
+        }),
+    });
+  }
+  async pricing(): Promise<Pricing> {
+    const r = await fetch(this.origin + "/pricing", {
+      signal: AbortSignal.timeout(10000),
+      cache: "no-store",
+      redirect: "error",
+    });
+    if (!r.ok) throw new Error("Pricing HTTP failure");
+    const p = (await r.json()) as Pricing;
+    if (p.ok !== true) throw new Error("Invalid pricing response");
+    finite(p.credits_per_usdc);
+    return p;
+  }
+  // The published SDK converts bigint to a JSON STRING, but rpc.rs requires as_u64().
+  // Emit validated digits as an unquoted numeric JSON literal, never through Number.
+  async sell(
+    mint: string,
+    amount: string,
+    slippage: number,
+    priority: number,
+  ): Promise<any> {
+    rawAmount(amount);
+    const params = JSON.stringify({
+      mint,
+      slippage_bps: slippage,
+      priority_fee_micro_lamports: priority,
+    });
+    const body = `{"jsonrpc":"2.0","id":1,"method":"executeSell","params":[${params.slice(0, -1)},"token_amount":${amount}}]}`;
+    const r = await fetch(this.origin + "/rpc", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...(this.apiKey ? { "X-Api-Key": this.apiKey } : {}),
+      },
+      body,
+      signal: AbortSignal.timeout(10000),
+      redirect: "error",
+    });
+    if (!r.ok)
+      throw new Error("Sell build HTTP failure (charge may be uncertain)");
+    const v = (await r.json()) as any;
+    if (v.error)
+      throw new Error("Sell builder rejected; consult account ledger");
+    if (!v.result) throw new Error("Malformed sell build result");
+    return v.result;
+  }
+}

package/src/internal/v2-policy.ts

@@ -0,0 +1,315 @@
+import {
+  PublicKey,
+  VersionedTransaction,
+  TransactionMessage,
+  TransactionInstruction,
+  ComputeBudgetProgram,
+  SystemProgram,
+} from "@solana/web3.js";
+
+const PUMP = new PublicKey("6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P");
+const FEE = new PublicKey("pfeeUxB6jkeY1Hxd7CsFCAjcbHA9rWtchMGdZ6VojVZ");
+const ATA = new PublicKey("ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL");
+const TOKEN = new PublicKey("TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA");
+const TOKEN22 = new PublicKey("TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb");
+const WSOL = new PublicKey("So11111111111111111111111111111111111111112");
+const SYSTEM = SystemProgram.programId;
+const pda = (program: PublicKey, seed: string, ...keys: PublicKey[]) =>
+  PublicKey.findProgramAddressSync(
+    [Buffer.from(seed), ...keys.map((k) => k.toBuffer())],
+    program,
+  )[0];
+const ata = (owner: PublicKey, mint: PublicKey, token: PublicKey) =>
+  PublicKey.findProgramAddressSync(
+    [owner.toBuffer(), token.toBuffer(), mint.toBuffer()],
+    ATA,
+  )[0];
+function requirePolicy(ok: boolean, reason: string): asserts ok {
+  if (!ok) throw new Error("V2 policy: " + reason);
+}
+export interface V2Policy {
+  side: "buy" | "sell";
+  mint: PublicKey;
+  maxSol: bigint;
+  amountRaw?: bigint;
+  maxPriority: bigint;
+  maxPriorityLamports?: bigint;
+  requestedPriority?: bigint;
+  reportedCost: bigint;
+  tokensOut?: bigint;
+}
+/** Offline instruction policy only. Never signs, mutates or fetches account state. */
+export function verifyV2(
+  tx: VersionedTransaction,
+  wallet: PublicKey,
+  p: V2Policy,
+): {
+  tradeCost: bigint;
+  ataCount: number;
+  instructions: any[];
+  limitations: string;
+} {
+  requirePolicy(p.side === "buy" || p.side === "sell", "unknown side");
+  requirePolicy(p.maxPriority >= 0n && p.maxSol >= 0n, "negative budget");
+  const m = tx.message;
+  requirePolicy(
+    m.version === 0 && m.addressTableLookups.length === 0,
+    "requires v0 without ALTs",
+  );
+  requirePolicy(
+    m.header.numRequiredSignatures === 1 &&
+      m.staticAccountKeys[0]?.equals(wallet) &&
+      m.isAccountWritable(0),
+    "payer/signer mismatch",
+  );
+  requirePolicy(
+    tx.signatures.length <= 1 &&
+      tx.signatures.every((s) => s.length === 64 && s.every((b) => b === 0)),
+    "must be unsigned",
+  );
+  // Account for the one 64-byte signing placeholder even when builder omits it.
+  requirePolicy(
+    1 + 64 + m.serialize().length <= 1232,
+    "signed envelope exceeds packet size",
+  );
+  const instructions = TransactionMessage.decompile(m).instructions;
+  const buy = p.side === "buy";
+  requirePolicy(
+    buy
+      ? instructions.length === 8
+      : instructions.length === 3 || instructions.length === 4,
+    "unexpected instruction sequence",
+  );
+  let price = 0n,
+    limit = 0n;
+  for (let i = 0; i < 2; i++) {
+    const ix = instructions[i],
+      d = Buffer.from(ix.data);
+    requirePolicy(
+      ix.programId.equals(ComputeBudgetProgram.programId) &&
+        ix.keys.length === 0,
+      "compute program/accounts",
+    );
+    if (i === 0) {
+      requirePolicy(
+        d.length === 9 && d[0] === 3,
+        "canonical compute price required first",
+      );
+      price = d.readBigUInt64LE(1);
+      requirePolicy(price <= p.maxPriority, "CU price exceeds explicit cap");
+    } else {
+      requirePolicy(
+        (d.length === 5 || d.length === 9) && d[0] === 2,
+        "canonical compute limit required second",
+      );
+      requirePolicy(
+        d.length === 5 || d.readUInt32LE(5) === 0,
+        "legacy CU high bytes nonzero",
+      );
+      limit = BigInt(d.readUInt32LE(1));
+      requirePolicy(
+        limit >= 1n && limit <= 1400000n,
+        "CU limit outside runtime bounds",
+      );
+    }
+  }
+  if (p.requestedPriority !== undefined)
+    requirePolicy(
+      price === p.requestedPriority,
+      "priority price differs from explicit request",
+    );
+  if (p.maxPriorityLamports !== undefined)
+    requirePolicy(
+      p.maxPriorityLamports >= 0n &&
+        (price * limit + 999999n) / 1000000n <= p.maxPriorityLamports,
+      "total priority fee exceeds lamport cap",
+    );
+  const trade = instructions[buy ? 7 : 2],
+    d = Buffer.from(trade.data);
+  requirePolicy(
+    trade.programId.equals(PUMP) && trade.keys.length === (buy ? 27 : 26),
+    "one Pump trade layout required",
+  );
+  requirePolicy(
+    d.length === 24 &&
+      d
+        .subarray(0, 8)
+        .equals(
+          Buffer.from(buy ? "b817ee6167c5d33d" : "5df6823ce7e940b2", "hex"),
+        ),
+    "trade discriminator/payload",
+  );
+  const quantity = d.readBigUInt64LE(8),
+    bound = d.readBigUInt64LE(16);
+  requirePolicy(
+    quantity > 0n && bound > 0n && bound === p.reportedCost,
+    "zero or reported trade bound mismatch",
+  );
+  if (buy)
+    requirePolicy(
+      quantity === p.tokensOut && bound <= p.maxSol,
+      "buy tokensOut/trade cap mismatch",
+    );
+  else
+    requirePolicy(quantity === p.amountRaw, "sell exact raw quantity mismatch");
+  const k = trade.keys;
+  const baseToken = k[3].pubkey;
+  requirePolicy(
+    baseToken.equals(TOKEN) || baseToken.equals(TOKEN22),
+    "unsupported base token program",
+  );
+  const curve = pda(PUMP, "bonding-curve", p.mint),
+    userVolume = pda(PUMP, "user_volume_accumulator", wallet);
+  const baseAta = ata(wallet, p.mint, baseToken),
+    wsolAta = ata(wallet, WSOL, TOKEN);
+  const volumeIndex = buy ? 20 : 19,
+    feeIndex = buy ? 22 : 21;
+  const expected = new Map<number, PublicKey>([
+    [0, pda(PUMP, "global")],
+    [1, p.mint],
+    [2, WSOL],
+    [3, baseToken],
+    [4, TOKEN],
+    [5, ATA],
+    [7, ata(k[6].pubkey, WSOL, TOKEN)],
+    [9, ata(k[8].pubkey, WSOL, TOKEN)],
+    [10, curve],
+    [11, ata(curve, p.mint, baseToken)],
+    [12, ata(curve, WSOL, TOKEN)],
+    [13, wallet],
+    [14, baseAta],
+    [15, wsolAta],
+    [17, ata(k[16].pubkey, WSOL, TOKEN)],
+    [18, pda(FEE, "sharing-config", p.mint)],
+    [volumeIndex, userVolume],
+    [volumeIndex + 1, ata(userVolume, WSOL, TOKEN)],
+    // Source execute_snipe.rs: ["fee_config", pump_program_id] under pfee.
+    [feeIndex, pda(FEE, "fee_config", PUMP)],
+    [feeIndex + 1, FEE],
+    [feeIndex + 2, SYSTEM],
+    [feeIndex + 3, pda(PUMP, "__event_authority")],
+    [feeIndex + 4, PUMP],
+  ]);
+  if (buy) expected.set(19, pda(PUMP, "global_volume_accumulator"));
+  for (const [i, address] of expected)
+    requirePolicy(
+      k[i].pubkey.equals(address),
+      "trade account/PDA mismatch at " + i,
+    );
+  const readonly = new Set([
+    0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    18,
+    feeIndex,
+    feeIndex + 1,
+    feeIndex + 2,
+    feeIndex + 3,
+    feeIndex + 4,
+  ]);
+  k.forEach((key, i) =>
+    requirePolicy(
+      key.isSigner === (i === 13) && key.isWritable === !readonly.has(i),
+      "trade privilege mismatch at " + i,
+    ),
+  );
+  // Privileges are message-global: wallet aliases in ATA/close authority positions
+  // are also writable signers. Exact comparison rejects elevation of fixed programs.
+  function keys(
+    ix: TransactionInstruction,
+    addresses: PublicKey[],
+    writable: boolean[],
+    signer: boolean[],
+  ) {
+    requirePolicy(
+      ix.keys.length === addresses.length &&
+        ix.keys.every(
+          (key, i) =>
+            key.pubkey.equals(addresses[i]) &&
+            key.isWritable === writable[i] &&
+            key.isSigner === signer[i],
+        ),
+      "auxiliary accounts/privileges",
+    );
+  }
+  function create(
+    ix: TransactionInstruction,
+    mint: PublicKey,
+    token: PublicKey,
+    address: PublicKey,
+  ) {
+    requirePolicy(
+      ix.programId.equals(ATA) && ix.data.length === 1 && ix.data[0] === 1,
+      "idempotent ATA required",
+    );
+    keys(
+      ix,
+      [wallet, address, wallet, mint, SYSTEM, token],
+      [true, true, true, false, false, false],
+      [true, false, true, false, false, false],
+    );
+  }
+  function close(
+    ix: TransactionInstruction,
+    token: PublicKey,
+    address: PublicKey,
+  ) {
+    requirePolicy(
+      ix.programId.equals(token) && ix.data.length === 1 && ix.data[0] === 9,
+      "exact token close required",
+    );
+    keys(
+      ix,
+      [address, wallet, wallet],
+      [true, true, true],
+      [false, true, true],
+    );
+  }
+  if (buy) {
+    // This current server order was simulated successfully; closing after buy is
+    // NOT equivalent in that test. This order is not a funding-lock proof.
+    create(instructions[2], WSOL, TOKEN, wsolAta);
+    const transfer = instructions[3],
+      td = Buffer.from(transfer.data);
+    requirePolicy(
+      transfer.programId.equals(SYSTEM) &&
+        td.length === 12 &&
+        td.readUInt32LE(0) === 2,
+      "exact System transfer required",
+    );
+    keys(transfer, [wallet, wsolAta], [true, true], [true, false]);
+    requirePolicy(
+      td.readBigUInt64LE(4) <= bound,
+      "funding exceeds decoded buy bound",
+    );
+    const sync = instructions[4];
+    requirePolicy(
+      sync.programId.equals(TOKEN) &&
+        sync.data.length === 1 &&
+        sync.data[0] === 17,
+      "exact SyncNative required",
+    );
+    keys(sync, [wsolAta], [true], [false]);
+    close(instructions[5], TOKEN, wsolAta);
+    create(instructions[6], p.mint, baseToken, baseAta);
+  } else if (instructions.length === 4)
+    close(instructions[3], baseToken, baseAta);
+  return {
+    tradeCost: buy ? bound : 0n,
+    ataCount: buy ? 2 : 0,
+    instructions: instructions.map((ix) => ({
+      program: ix.programId.toBase58(),
+      accounts: ix.keys.map((k) => ({
+        address: k.pubkey.toBase58(),
+        writable: k.isWritable,
+        signer: k.isSigner,
+      })),
+      data_hex: Buffer.from(ix.data).toString("hex"),
+    })),
+    limitations:
+      "Partial offline policy, not a complete protocol safety proof. Dynamic fee recipients and creator vault are trusted builder/state inputs; only their associated WSOL derivations are checked. Account ownership/state, dynamic fees, rent, inventory/full-sell eligibility and program/CPI behavior are not proven. Buy maxSol is a trade cap, not an aggregate CPI-fee/rent/network-spend cap; the observed pre-buy refund does not lock funds. Caller must separately bound exact message fees/rent and require explicit --ack-incomplete-policy consent before signing.",
+  };
+}