@oracle-agent/oracle 0.10.0 → 0.11.0

package/src/action-receipts.mjs

@@ -4,17 +4,89 @@
 // sign, broadcast, or fetch. It only records facts supplied by its caller.
 
 import { createHash } from "node:crypto";
+import { wordlists } from "ethers";
 
 export const ACTION_RECEIPT_VERSION = 1;
 
+// Key-name matching was exact-ish and only covered five words, so every wallet
+// export alias (secretKey, seedPhrase, wif, keyMaterial, privKey, xprv, seed,
+// keystore) sailed through. There was also NO value-shape rule, so a raw key or
+// a BIP-39 phrase pasted into a benign field like `memo` was recorded verbatim.
+//
+// Both concerns were already solved in src/address-book.mjs; this module simply
+// did not use the hardened list. Found by the opus lane of the 2026-08-03
+// four-model review, and verified to PERSIST: unknown top-level props are
+// dropped by the schema whitelist, but a secret nested inside a RETAINED field
+// (intent, route, decodedAction) survives into the frozen receipt.
 const SECRET_KEYS = new Set([
   "privatekey",
+  "privkey",
+  "secretkey",
+  "seedphrase",
+  "seed",
   "mnemonic",
+  "passphrase",
+  "password",
+  "keystore",
+  "keymaterial",
+  "wif",
+  "xprv",
+  "xpriv",
   "bearer",
   "authorization",
   "signature",
+  "apikey",
+  "credential",
+]);
+
+// Unambiguous key shapes: WIF, extended private key, BIP-39 word run. These are
+// refused wherever they appear.
+//
+// A bare 64-hex string is deliberately NOT in this list. A raw EVM private key
+// and a bytes32 tx hash are byte-identical, and receipts legitimately carry
+// txHash / orderHash / salt / merkleRoot / nonce. Blanket-refusing 64-hex would
+// break real receipts — an over-tight filter is its own bug. It is instead
+// gated on the field name below.
+const KEY_SHAPED_VALUE = [
+  /\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b/,
+  /\bxprv[0-9A-Za-z]{50,}\b/,
+];
+
+const BIP39_WORD_COUNTS = new Set([12, 15, 18, 21, 24]);
+
+function isBip39EnglishPhrase(value) {
+  const words = String(value).trim().toLowerCase().split(/\s+/).filter(Boolean);
+  return BIP39_WORD_COUNTS.has(words.length) && words.every((word) => wordlists.en.getWordIndex(word) >= 0);
+}
+
+const BARE_32_BYTE_HEX = /^\s*(?:0x)?[0-9a-fA-F]{64}\s*$/;
+
+// Field names whose whole value is EXPECTED to be a 32-byte digest.
+//
+// The trailing `(?:e?s)?` matters: `publicValue` scans array leaves using the
+// PARENT key, so a batched route's `orderHashes` / `proofs` / `commitments`
+// arrives here in its plural form (English pluralizes `hash` as `hashes`).
+// Without it a digest LIST is refused while the exact same digest in singular
+// form is accepted — an over-tight filter that breaks real receipts and blocks
+// no secret (key-SHAPED values are refused by KEY_SHAPED_VALUE / BIP-39
+// regardless of field name).
+const DIGEST_FIELD = /(hash|digest|root|salt|nonce|proof|commitment|sig|id)(?:e?s)?$/i;
+const PROTOCOL_HEX_FIELDS = new Set([
+  "calldata",
+  "data",
+  "publickey",
+  "pubkey",
+  "message",
+  "payload",
+  "input",
+  "extradata",
 ]);
 
+function allows32ByteHex(key) {
+  const normalized = normalizedKey(key);
+  return PROTOCOL_HEX_FIELDS.has(normalized) || DIGEST_FIELD.test(normalized);
+}
+
 export class ActionReceiptSecretError extends Error {
   constructor(path) {
     super(`action receipt refused: secret-bearing field at ${path}`);
@@ -32,23 +104,45 @@ function isSecretKey(key) {
   return [...SECRET_KEYS].some((secret) => normalized.includes(secret));
 }
 
-function publicValue(value, path = "$") {
-  if (value == null || typeof value === "string" || typeof value === "boolean") return value;
+/**
+ * Refuse a key-material-shaped VALUE, so a secret pasted into a benign field
+ * name (memo, note, label) cannot be recorded verbatim.
+ *
+ * Bare 64-hex is only refused when the field name is NOT digest-shaped: a raw
+ * EVM private key and a bytes32 hash are byte-identical, and receipts carry
+ * txHash / orderHash / salt / nonce legitimately.
+ */
+function assertNoSecretValue(key, value, path) {
+  if (typeof value !== "string") return;
+  if (KEY_SHAPED_VALUE.some((re) => re.test(value)) || isBip39EnglishPhrase(value)) {
+    throw new ActionReceiptSecretError(path);
+  }
+  if (BARE_32_BYTE_HEX.test(value) && !allows32ByteHex(key)) {
+    throw new ActionReceiptSecretError(path);
+  }
+}
+
+function publicValue(value, path = "$", key = "") {
+  if (value == null || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    assertNoSecretValue(key, value, path);
+    return value;
+  }
   if (typeof value === "number") {
     if (!Number.isFinite(value)) throw new TypeError(`action receipt: non-finite number at ${path}`);
     return value;
   }
   if (typeof value === "bigint") return value.toString();
-  if (Array.isArray(value)) return value.map((item, index) => publicValue(item, `${path}[${index}]`));
+  if (Array.isArray(value)) return value.map((item, index) => publicValue(item, `${path}[${index}]`, key));
   if (typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype) {
     throw new TypeError(`action receipt: JSON-like value required at ${path}`);
   }
 
   const out = {};
-  for (const key of Object.keys(value).sort()) {
-    const childPath = `${path}.${key}`;
-    if (isSecretKey(key)) throw new ActionReceiptSecretError(childPath);
-    if (value[key] !== undefined) out[key] = publicValue(value[key], childPath);
+  for (const childKey of Object.keys(value).sort()) {
+    const childPath = `${path}.${childKey}`;
+    if (isSecretKey(childKey)) throw new ActionReceiptSecretError(childPath);
+    if (value[childKey] !== undefined) out[childKey] = publicValue(value[childKey], childPath, childKey);
   }
   return out;
 }
@@ -58,12 +152,15 @@ export function assertNoReceiptSecrets(value) {
   return publicValue(value);
 }
 
+function canonicalPublicJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalPublicJson).join(",")}]`;
+  return `{${Object.keys(value).map((key) => `${JSON.stringify(key)}:${canonicalPublicJson(value[key])}`).join(",")}}`;
+}
+
 /** Canonical JSON with recursively sorted object keys. */
 export function canonicalReceiptJson(value) {
-  const safe = publicValue(value);
-  if (safe === null || typeof safe !== "object") return JSON.stringify(safe);
-  if (Array.isArray(safe)) return `[${safe.map(canonicalReceiptJson).join(",")}]`;
-  return `{${Object.keys(safe).map((key) => `${JSON.stringify(key)}:${canonicalReceiptJson(safe[key])}`).join(",")}}`;
+  return canonicalPublicJson(publicValue(value));
 }
 
 /** Hash exactly the public receipt fields, excluding the self-referential id. */

package/src/cli/commands/data.mjs

@@ -53,7 +53,9 @@ export default {
       const bin = path.join(ctx.root, "bin", "desk-server.mjs");
       return spawnChild(process.execPath, [bin], { stdio: "inherit", env }, "desk-server");
     }
-    if (verb === "health") return dataFetch("/");
+    // The server serves /health; / intentionally 404s with a route list. This
+    // probed / and so reported the package's own running server as down.
+    if (verb === "health") return dataFetch("/health");
     if (verb === "catalog") return dataFetch("/data/catalog");
     if (verb === "call") {
       const provider = ctx.argv[1];

package/src/cli/commands/doctor.mjs

@@ -21,7 +21,9 @@ function loadExecEnv(p) {
 
 async function probeDataServer(url) {
   try {
-    const res = await fetch(url.replace(/\/$/, "") + "/");
+    // The server serves /health; / intentionally 404s with a route list, so
+    // probing / reported a healthy server as down.
+    const res = await fetch(url.replace(/\/$/, "") + "/health");
     return res.ok;
   } catch {
     return false;
@@ -47,9 +49,17 @@ export default {
 
     const execEnvPath = ctx.paths.oracleExecEnvPath();
     const envFile = loadExecEnv(execEnvPath);
+    // `oracle init --apply` writes ORACLE_ROUTE_ATTESTATION_SECRET (see
+    // bin/oracle-init.mjs), but doctor checked only ORACLE_ATTESTATION_SECRET
+    // and ORACLE_STAMP_HMAC_SECRET — so it told the user to rerun an init step
+    // that could never satisfy the check.
     const att =
+      process.env.ORACLE_ROUTE_ATTESTATION_SECRET ||
+      process.env.MAD_ROUTE_ATTESTATION_SECRET ||
       process.env.ORACLE_ATTESTATION_SECRET ||
       process.env.ORACLE_STAMP_HMAC_SECRET ||
+      envFile.ORACLE_ROUTE_ATTESTATION_SECRET ||
+      envFile.MAD_ROUTE_ATTESTATION_SECRET ||
       envFile.ORACLE_ATTESTATION_SECRET ||
       envFile.ORACLE_STAMP_HMAC_SECRET;
     push("attestation_secret", att ? "ok" : "warn", att ? "present" : "missing",

package/src/data/catalog.mjs

@@ -1,8 +1,13 @@
 // Provider catalog — DATA plane registry. Wallet keys never live here.
 
+import { UNI_V3_CHAINS } from "./providers/uniswap-v3.mjs";
+import { UNI_V4_CHAINS } from "./providers/uniswap-v4.mjs";
+
 /** @typedef {{ id: string, venue: string, chainIds: number[], auth: 'none'|'apiKey'|'agentKey', ops: string[], baseEnv?: string[], description?: string }} ProviderMeta */
 
 const REGISTRY = new Map();
+const UNI_V3_CHAIN_IDS = Object.keys(UNI_V3_CHAINS).map(Number);
+const UNI_V4_CHAIN_IDS = Object.keys(UNI_V4_CHAINS).map(Number);
 const BUILTIN_PROVIDER_IDS = new Set();
 let BUILTINS_LOCKED = false;
 
@@ -211,9 +216,9 @@ registerProvider({
   venue: "solana-dex",
   chainIds: [],
   auth: "none",
-  ops: ["health", "quote", "prepare"],
+  ops: ["health", "venues", "quote", "prepare"],
   execution: "prepare",
-  baseEnv: ["JUPITER_SWAP_API_URL"],
+  baseEnv: ["JUPITER_SWAP_API_URL", "SOLANA_RPC_URL"],
   description: "Jupiter Swap API v1 quote + unsigned user-signature swap transaction preparation",
 });
 
@@ -304,7 +309,7 @@ registerProvider({
 registerProvider({
   id: "uniswap-v3",
   venue: "dex",
-  chainIds: [1, 8453, 42161],
+  chainIds: UNI_V3_CHAIN_IDS,
   auth: "none",
   ops: ["health", "quote", "prepare", "quotePath", "ethUsdc", "chains"],
   execution: "prepare",
@@ -312,8 +317,34 @@ registerProvider({
     "ETH_RPC_URL",
     "BASE_RPC_URL",
     "ARBITRUM_RPC_URL",
+    "OPTIMISM_RPC_URL",
+    "BSC_RPC_URL",
+    "POLYGON_RPC_URL",
+    "AVALANCHE_RPC_URL",
+    "RH_CHAIN_RPC",
+  ],
+  description: "Uniswap V3 QuoterV2 exact-in quotes via eth_call across official deployments plus Robinhood Chain, no key",
+});
+
+registerProvider({
+  id: "uniswap-v4",
+  venue: "dex",
+  chainIds: UNI_V4_CHAIN_IDS,
+  auth: "none",
+  ops: ["health", "quote", "chains"],
+  execution: "read-only",
+  baseEnv: [
+    "ETH_RPC_URL",
+    "BASE_RPC_URL",
+    "ARBITRUM_RPC_URL",
+    "OPTIMISM_RPC_URL",
+    "BSC_RPC_URL",
+    "POLYGON_RPC_URL",
+    "AVALANCHE_RPC_URL",
+    "RH_CHAIN_RPC",
   ],
-  description: "Uniswap V3 QuoterV2 exact-in quotes via eth_call (ETH/Base/Arb, no key)",
+  description:
+    "Uniswap V4 Quoter exact-in quotes via eth_call across official deployments plus Robinhood Chain. Quote-only until Universal Router prepare is classified.",
 });
 
 registerProvider({
@@ -503,7 +534,7 @@ registerProvider({
 registerProvider({
   id: "odos",
   venue: "dex",
-  chainIds: [1, 10, 56, 137, 8453, 42161, 43114],
+  chainIds: [1, 10, 56, 137, 8453, 42161, 43114, 4663],
   auth: "none",
   ops: ["health", "chains", "quote", "prepare"],
   // Tier is the honest signal here: the API returns HTTP 410 Gone as of
@@ -532,7 +563,7 @@ registerProvider({
 registerProvider({
   id: "paraswap",
   venue: "dex",
-  chainIds: [1, 10, 56, 137, 8453, 42161, 43114],
+  chainIds: [1, 10, 56, 137, 8453, 42161, 43114, 4663],
   auth: "none",
   ops: ["health", "tokens", "price", "quote", "prepare"],
   execution: "prepare",
@@ -543,7 +574,7 @@ registerProvider({
 registerProvider({
   id: "rfq",
   venue: "intent-rfq",
-  chainIds: [1, 10, 56, 137, 8453, 42161, 43114],
+  chainIds: [1, 10, 56, 137, 8453, 42161, 43114, 4663],
   auth: "none",
   ops: ["health", "intent", "quote"],
   execution: "prepare",

package/src/data/desk-data.mjs

@@ -15,6 +15,7 @@ import * as llama from "./providers/defillama.mjs";
 import * as lifi from "./providers/lifi.mjs";
 import * as dxs from "./providers/dexscreener.mjs";
 import * as uni from "./providers/uniswap-v3.mjs";
+import * as univ4 from "./providers/uniswap-v4.mjs";
 import * as aerodrome from "./providers/aerodrome.mjs";
 import * as zerox from "./providers/zerox.mjs";
 import * as bridges from "./providers/bridges.mjs";
@@ -144,6 +145,7 @@ const OPS = {
   },
   jupiter: {
     health: (o) => jupiter.jupiterHealth(o),
+    venues: (o, a = {}) => jupiter.jupiterVenues(a, o),
     quote: (o, a = {}) => jupiter.jupiterQuote(a, o),
     prepare: (o, a = {}) => jupiter.jupiterPrepareSwap(a, o),
   },
@@ -176,6 +178,11 @@ const OPS = {
     ethUsdc: (o, a = {}) => uni.uniV3EthUsdc(a, o),
     chains: () => uni.uniV3Chains(),
   },
+  "uniswap-v4": {
+    health: (o, a = {}) => univ4.uniV4Health({ ...o, chainId: a.chainId ?? 8453 }),
+    quote: (o, a = {}) => univ4.uniV4QuoteExactIn(a, o),
+    chains: () => univ4.uniV4Chains(),
+  },
   aerodrome: {
     health: (o, a = {}) => aerodrome.aerodromeHealth({ ...o, chainId: a.chainId ?? 8453 }),
     quote: (o, a = {}) => aerodrome.aerodromeQuoteExactIn(a, o),
@@ -665,6 +672,11 @@ export const data = {
     ethUsdc: (a, o) => dataCall("uniswap-v3", "ethUsdc", a || {}, o),
     chains: (o) => dataCall("uniswap-v3", "chains", {}, o),
   },
+  univ4: {
+    health: (a, o) => dataCall("uniswap-v4", "health", a || {}, o),
+    quote: (a, o) => dataCall("uniswap-v4", "quote", a || {}, o),
+    chains: (o) => dataCall("uniswap-v4", "chains", {}, o),
+  },
   bridges: {
     across: (a, o) => dataCall("across", "suggestedFees", a || {}, o),
     hop: (a, o) => dataCall("hop", "quote", a || {}, o),

package/src/data/providers/evm-rpc.mjs

@@ -61,25 +61,28 @@ export function resolveRpcUrl(chainId, { rpcUrl, env = process.env } = {}) {
  * @param {any[]} [params]
  */
 
-/** Prepare-only: write/settle JSON-RPC methods are hard-refused even on deep import. */
-const EVM_WRITE_RPC = new Set([
-  "eth_sendTransaction",
-  "eth_sendRawTransaction",
-  "eth_sign",
-  "eth_signTransaction",
-  "eth_signTypedData",
-  "eth_signTypedData_v4",
-  "personal_sign",
-]);
+// `rpcCall` is the raw public transport exposed by the data facade. It must be
+// an allowlist, not a partial write denylist: every unrecognized method is
+// unsafe to forward because vendors add write namespaces (`wallet_send*`,
+// `pm_sendUserOperation`, `mev_sendBundle`) faster than a denylist stays fresh.
+//
+// Canonical JSON-RPC method names are ASCII lowercase + underscores. Reject
+// whitespace, separator tricks, and Unicode homoglyphs rather than normalizing
+// them into a different network request.
+const EVM_READ_RPC = /^(?:eth_(?:call|blocknumber|chainid|get[a-z0-9]+|feehistory|gasprice|maxpriorityfeepergas|syncing|protocolversion|estimategas|createaccesslist)|net_(?:version|listening|peercount)|web3_(?:clientversion|sha3))$/;
+
+function readRpcMethod(method) {
+  const raw = String(method || "");
+  const probe = raw.toLowerCase();
+  if (raw !== raw.trim() || !/^[a-zA-Z0-9_]+$/.test(raw) || !EVM_READ_RPC.test(probe)) {
+    throw new Error(`evm-rpc: ${raw} refused — @oracle-agent/oracle is prepare-only (read RPC only; no broadcast/sign)`);
+  }
+  return probe;
+}
 
 export async function rpcCall(chainId, method, params = [], opts = {}) {
   const methodName = String(method || "");
-  if (EVM_WRITE_RPC.has(methodName) || /send|sign/i.test(methodName) && !/^eth_get|^eth_call|^eth_block|^eth_chain|^eth_fee|^eth_gas|^eth_max|^eth_sync|^net_|^web3_/.test(methodName)) {
-    // allowlist is positive for common reads; anything send/sign-shaped dies.
-    if (EVM_WRITE_RPC.has(methodName) || methodName.startsWith("eth_send") || methodName.includes("sign")) {
-      throw new Error(`evm-rpc: ${methodName} refused — @oracle-agent/oracle is prepare-only (no broadcast/sign)`);
-    }
-  }
+  readRpcMethod(methodName);
   const url = resolveRpcUrl(chainId, opts);
   if (!url) {
     throw new Error(

package/src/data/providers/jupiter-venues.mjs

@@ -0,0 +1,119 @@
+// Solana venue labels routed through the Jupiter aggregator provider.
+//
+// Preserved as source data on 2026-08-03: this roster previously existed only
+// as markup in the splash page, so deleting that markup silently deleted the
+// evidence behind the README/site claim. Data belongs in src/, not in a
+// presentation layer that a redesign can drop.
+//
+// 101 program labels resolving to 98 unique venue brands: Aldrin/Aldrin V2,
+// Orca V1/Orca V2, and SolFi/SolFi V2 are version variants of one venue.
+
+export const JUPITER_VENUE_LABELS = Object.freeze([
+  "1DEX",
+  "Aldrin",
+  "Aldrin V2",
+  "AlphaQ",
+  "Aquifer",
+  "BinaryFi",
+  "BisonFi",
+  "BisonFi Predict",
+  "Bonkswap",
+  "Boop.fun",
+  "Byreal",
+  "Carrot",
+  "Crema",
+  "Cropper",
+  "customizable",
+  "DefiTuna",
+  "Denali",
+  "Deriverse",
+  "DexLab",
+  "Dynamic Bonding Curve",
+  "Flint",
+  "Flux",
+  "FluxBeam",
+  "GatorSwap",
+  "Gavel",
+  "GoonFi V2",
+  "GooseFX GAMMA",
+  "Guacswap",
+  "Hadron",
+  "Heaven",
+  "Helium Network",
+  "Huma",
+  "HumidiFi",
+  "Hylo Exchange",
+  "Hylo Stability Pool",
+  "Invariant",
+  "Jupiter Lend Earn",
+  "JupiterRfqV2",
+  "JupLend AMM",
+  "Kipseli",
+  "LemmingsFi",
+  "Manifest",
+  "Mercurial",
+  "MetaDAO",
+  "Meteora",
+  "Meteora DAMM v2",
+  "Meteora DLMM",
+  "Metric",
+  "Moonit",
+  "more chains",
+  "M Swap",
+  "Obric V2",
+  "Obsidian",
+  "Omnipair",
+  "OpenBook V2",
+  "Orca V1",
+  "Orca V2",
+  "PancakeSwap",
+  "Penguin",
+  "Perena",
+  "Perena Star",
+  "Perps",
+  "Phoenix",
+  "protocol builder",
+  "Pump.fun",
+  "Pump.fun Amm",
+  "Quantum",
+  "Raydium",
+  "Raydium CLMM",
+  "Raydium CP",
+  "Raydium Launchlab",
+  "Riptide",
+  "RunnerRodeo",
+  "Saber",
+  "Saber (Decimals)",
+  "Sanctum",
+  "Sanctum Infinity",
+  "Saros",
+  "Saros DLMM",
+  "Scale Amm",
+  "Scale Vmm",
+  "Scorch",
+  "Solayer",
+  "SolFi",
+  "SolFi V2",
+  "Stabble CLMM",
+  "Stabble Stable Swap",
+  "Stabble Weighted Swap",
+  "StepN",
+  "TaurusFi",
+  "TesseraV",
+  "Token Swap",
+  "Trends",
+  "VaultLiquidUnstake",
+  "Virtuals",
+  "Voltr",
+  "WhaleStreet",
+  "Whirlpool",
+  "Woofi",
+  "XOrca",
+  "ZeroFi"
+]);
+
+/** Unique venue brands, collapsing version variants. */
+export function uniqueVenueBrands() {
+  const norm = (s) => s.toLowerCase().replace(/\s+v[0-9]+$/, "").replace(/[^a-z0-9]/g, "");
+  return new Set(JUPITER_VENUE_LABELS.map(norm));
+}

package/src/data/providers/jupiter.mjs

@@ -4,6 +4,7 @@
 import { httpJson } from "../http.mjs";
 import { solanaPubkey } from "./solana-rpc.mjs";
 import { stampPrepared } from "../../prepare-envelope.mjs";
+import { assertNoSignedMaterial } from "./signed-material-guard.mjs";
 
 export const JUPITER_SWAP_API = "https://lite-api.jup.ag/swap/v1";
 export const SOL_MINT = "So11111111111111111111111111111111111111112";
@@ -65,6 +66,131 @@ function solanaGuard(quote = {}, { quotedAtMs = Date.now(), ttlMs = DEFAULT_QUOT
   };
 }
 
+// Known BPF loaders. A program is only real if it is BOTH executable AND owned
+// by one of these. `executable: true` alone is claimable by any account, so
+// checking it in isolation is not proof.
+const SOLANA_LOADERS = new Set([
+  "BPFLoaderUpgradeab1e11111111111111111111111",
+  "BPFLoader2111111111111111111111111111111111",
+  "BPFLoader1111111111111111111111111111111111",
+]);
+
+const B58_ALPHA = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+
+function isSolanaPubkey(s) {
+  if (typeof s !== "string" || !s.length) return false;
+  let num = 0n;
+  for (const ch of s) {
+    const v = B58_ALPHA.indexOf(ch);
+    if (v < 0) return false;
+    num = num * 58n + BigInt(v);
+  }
+  let hex = num.toString(16);
+  if (hex.length % 2) hex = "0" + hex;
+  let bytes = hex.length / 2;
+  for (const ch of s) {
+    if (ch === "1") bytes++;
+    else break;
+  }
+  return bytes === 32;
+}
+
+export async function jupiterVenues(args = {}, opts = {}) {
+  const rpcUrl = args.rpc || opts.solanaRpc || process.env.SOLANA_RPC || "https://api.mainnet-beta.solana.com";
+  const fetchImpl = opts.fetchImpl || fetch;
+
+  const res = await fetchImpl(`${JUPITER_SWAP_API}/program-id-to-label`, {
+    signal: AbortSignal.timeout(Number(opts.timeoutMs) || 15_000),
+  });
+  if (!res.ok) throw new Error(`jupiter venue map failed: HTTP ${res.status}`);
+  const labelMap = await res.json();
+
+  const entries = Object.entries(labelMap);
+  const wellFormed = entries.filter(([id]) => isSolanaPubkey(id));
+  const verified = [];
+  const unresolved = entries
+    .filter(([id]) => !isSolanaPubkey(id))
+    .map(([id, label]) => ({ programId: id, label, reason: "malformed program id" }));
+
+  if (args.verify === false) {
+    return {
+      source: `${JUPITER_SWAP_API}/program-id-to-label`,
+      verified: wellFormed.map(([programId, label]) => ({ programId, label })),
+      unresolved,
+      verifiedOnChain: false,
+      totals: { fromRouterMap: entries.length, verified: wellFormed.length },
+    };
+  }
+
+  const call = async (body) => {
+    const r = await fetchImpl(rpcUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(Number(opts.timeoutMs) || 20_000),
+    });
+    const j = await r.json();
+    if (j.error) throw new Error(j.error.message);
+    return j.result;
+  };
+
+  for (let i = 0; i < wellFormed.length; i += 90) {
+    const chunk = wellFormed.slice(i, i + 90);
+    let out = null;
+    for (let attempt = 0; attempt < 3 && !out; attempt++) {
+      try {
+        out = await call({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "getMultipleAccounts",
+          params: [chunk.map(([id]) => id), { encoding: "base64", dataSlice: { offset: 0, length: 0 } }],
+        });
+      } catch {
+        await new Promise((r) => setTimeout(r, 2000 * (attempt + 1)));
+      }
+    }
+    if (!out) {
+      for (const [programId, label] of chunk) {
+        unresolved.push({ programId, label, reason: "rpc batch failed after 3 attempts" });
+      }
+      continue;
+    }
+    out.value.forEach((acc, k) => {
+      const [programId, label] = chunk[k];
+      if (acc && acc.executable === true && SOLANA_LOADERS.has(acc.owner)) {
+        verified.push({ programId, label, owner: acc.owner });
+      } else {
+        unresolved.push({
+          programId,
+          label,
+          reason: !acc ? "account not found" : acc.executable !== true ? "not executable" : `unknown owner ${acc.owner}`,
+        });
+      }
+    });
+    if (i + 90 < wellFormed.length) await new Promise((r) => setTimeout(r, 700));
+  }
+
+  const brands = new Set(
+    verified.map((v) => v.label.replace(/\s+(CLMM|CP|V\d+|Launchlab|DLMM|Pools?)$/i, "").trim())
+  );
+
+  return {
+    source: `${JUPITER_SWAP_API}/program-id-to-label`,
+    rpc: rpcUrl,
+    verifiedOnChain: true,
+    verifiedAt: new Date().toISOString(),
+    totals: {
+      fromRouterMap: entries.length,
+      verified: verified.length,
+      unresolved: unresolved.length,
+      distinctLabels: new Set(verified.map((v) => v.label)).size,
+      distinctBrands: brands.size,
+    },
+    verified: verified.sort((a, b) => a.label.localeCompare(b.label)),
+    unresolved,
+  };
+}
+
 export async function jupiterHealth(opts = {}) {
   try {
     const q = await jupiterQuote({ inputMint: SOL_MINT, outputMint: USDC_MINT, amount: "1000000", slippageBps: 50 }, opts);
@@ -142,6 +268,12 @@ export async function jupiterPrepareSwap(args = {}, opts = {}) {
   });
   const swapTransaction = base64Tx(response?.swapTransaction);
 
+  // Refuse pre-signed material by PRESENCE. The primary `swapTransaction` field
+  // stays unsigned, but the full upstream body was echoed as `raw` and
+  // hash-bound into the envelope, so a hostile endpoint could smuggle a signed
+  // sibling that downstream tooling might select instead.
+  assertNoSignedMaterial("jupiter", response);
+
   // Bind the returned transaction to the quote it claims to implement. A
   // compromised or impersonated endpoint can return any bytes while Oracle
   // stamps the optimistic quote on top; the user signs the bytes, not the