@rebelfi/agent-sdk 1.0.1

package/dist/verify/decoders/jupiter.js

@@ -0,0 +1,36 @@
+// Jupiter v6 uses a complex routing format. We do best-effort identification
+// of the top-level instruction type without full decoding.
+// The discriminator structure follows Anchor conventions.
+const KNOWN_TYPES = {
+    'e517cb977ae3ad2a': 'route',
+    'c1209b3341d69c81': 'route_with_token_ledger',
+    '9279c41c15427612': 'shared_accounts_route',
+    '36d7ebfe04130a5b': 'shared_accounts_route_with_token_ledger',
+    'b0d169a89a7d453e': 'exact_out_route',
+    'a6c1780c5e87f5b2': 'shared_accounts_exact_out_route',
+};
+export function decodeJupiter(data, accounts) {
+    if (data.length >= 8) {
+        const discHex = Buffer.from(data.subarray(0, 8)).toString('hex');
+        const typeName = KNOWN_TYPES[discHex];
+        if (typeName) {
+            return {
+                type: typeName,
+                params: {
+                    // We can identify the source and destination token accounts from accounts list
+                    // but full route decoding requires Jupiter-specific Borsh schemas
+                    sourceTokenAccount: accounts[2] ?? null,
+                    destinationTokenAccount: accounts[3] ?? null,
+                    note: 'Jupiter route — full params not decoded, verify input/output token accounts',
+                },
+            };
+        }
+    }
+    return {
+        type: 'unknown_jupiter_instruction',
+        params: {
+            note: 'Unknown Jupiter instruction — discriminator not recognized',
+        },
+    };
+}
+//# sourceMappingURL=jupiter.js.map

package/dist/verify/decoders/jupiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jupiter.js","sourceRoot":"","sources":["../../../src/verify/decoders/jupiter.ts"],"names":[],"mappings":"AAKA,6EAA6E;AAC7E,2DAA2D;AAC3D,0DAA0D;AAC1D,MAAM,WAAW,GAA2B;IAC1C,kBAAkB,EAAE,OAAO;IAC3B,kBAAkB,EAAE,yBAAyB;IAC7C,kBAAkB,EAAE,uBAAuB;IAC3C,kBAAkB,EAAE,yCAAyC;IAC7D,kBAAkB,EAAE,iBAAiB;IACrC,kBAAkB,EAAE,iCAAiC;CACtD,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;IAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,+EAA+E;oBAC/E,kEAAkE;oBAClE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACvC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5C,IAAI,EAAE,6EAA6E;iBACpF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,4DAA4D;SACnE;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/decoders/memo.d.ts

@@ -0,0 +1,5 @@
+export interface MemoDecoded {
+    type: string;
+    params: Record<string, unknown>;
+}
+export declare function decodeMemo(data: Buffer): MemoDecoded;

package/dist/verify/decoders/memo.js

@@ -0,0 +1,9 @@
+export function decodeMemo(data) {
+    return {
+        type: 'memo',
+        params: {
+            text: data.toString('utf-8'),
+        },
+    };
+}
+//# sourceMappingURL=memo.js.map

package/dist/verify/decoders/memo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memo.js","sourceRoot":"","sources":["../../../src/verify/decoders/memo.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC7B;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/decoders/silkysig.d.ts

@@ -0,0 +1,5 @@
+export interface SilkysigDecoded {
+    type: string;
+    params: Record<string, unknown>;
+}
+export declare function decodeSilkysig(data: Buffer, accounts: string[], tokenSymbol: (mint: string) => string, tokenDecimals: (mint: string) => number): SilkysigDecoded | null;

package/dist/verify/decoders/silkysig.js

@@ -0,0 +1,159 @@
+import { PublicKey } from '@solana/web3.js';
+import { formatUnits } from '../../amount-utils.js';
+// Anchor discriminators: sha256("global:{name}")[0:8]
+const DISCRIMINATORS = {
+    create_account: [99, 20, 130, 119, 196, 235, 131, 149],
+    deposit: [242, 35, 198, 137, 82, 225, 242, 182],
+    transfer_from_account: [9, 168, 230, 150, 118, 31, 189, 73],
+    init_drift_user: [32, 47, 206, 180, 199, 171, 115, 93],
+    add_operator: [149, 142, 187, 68, 33, 250, 87, 105],
+    remove_operator: [84, 183, 126, 251, 137, 150, 214, 134],
+    toggle_pause: [238, 237, 206, 27, 255, 95, 123, 229],
+    close_account: [125, 255, 149, 14, 110, 34, 72, 24],
+};
+function matchDiscriminator(data) {
+    if (data.length < 8)
+        return null;
+    for (const [name, disc] of Object.entries(DISCRIMINATORS)) {
+        if (disc.every((b, i) => data[i] === b))
+            return name;
+    }
+    return null;
+}
+function readU64(buf, offset) {
+    return [buf.readBigUInt64LE(offset), offset + 8];
+}
+function readPubkey(buf, offset) {
+    const key = new PublicKey(buf.subarray(offset, offset + 32)).toBase58();
+    return [key, offset + 32];
+}
+function readOptionU64(buf, offset) {
+    const isSome = buf[offset] === 1;
+    offset += 1;
+    if (!isSome)
+        return [null, offset];
+    const val = buf.readBigUInt64LE(offset);
+    return [val, offset + 8];
+}
+export function decodeSilkysig(data, accounts, tokenSymbol, tokenDecimals) {
+    const name = matchDiscriminator(data);
+    if (!name)
+        return null;
+    let offset = 8;
+    switch (name) {
+        case 'create_account':
+            // Accounts: owner, mint, silk_account, account_token_account, ...
+            return {
+                type: 'create_account',
+                params: {
+                    owner: accounts[0] ?? null,
+                    mint: accounts[1] ?? null,
+                    silkAccount: accounts[2] ?? null,
+                },
+            };
+        case 'deposit': {
+            // Accounts: depositor, silk_account, mint, account_token_account, depositor_token_account, token_program
+            const mint = accounts[2] ?? null;
+            const symbol = mint ? tokenSymbol(mint) : 'unknown';
+            const decimals = mint ? tokenDecimals(mint) : 6;
+            let amount;
+            try {
+                [amount, offset] = readU64(data, offset);
+            }
+            catch {
+                return { type: 'deposit', params: { depositor: accounts[0] } };
+            }
+            const humanAmount = formatUnits(amount, decimals);
+            return {
+                type: 'deposit',
+                params: {
+                    depositor: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                    mint,
+                    amount: amount.toString(),
+                    amountHuman: `${humanAmount} ${symbol}`,
+                },
+            };
+        }
+        case 'transfer_from_account': {
+            // Accounts: signer, silk_account, mint, account_token_account, recipient, recipient_token_account, ...
+            const mint = accounts[2] ?? null;
+            const symbol = mint ? tokenSymbol(mint) : 'unknown';
+            const decimals = mint ? tokenDecimals(mint) : 6;
+            let amount;
+            try {
+                [amount, offset] = readU64(data, offset);
+            }
+            catch {
+                return { type: 'transfer_from_account', params: { signer: accounts[0] } };
+            }
+            const humanAmount = formatUnits(amount, decimals);
+            return {
+                type: 'transfer_from_account',
+                params: {
+                    signer: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                    mint,
+                    recipient: accounts[4] ?? null,
+                    amount: amount.toString(),
+                    amountHuman: `${humanAmount} ${symbol}`,
+                },
+            };
+        }
+        case 'add_operator': {
+            let operator, perTxLimit;
+            try {
+                [operator, offset] = readPubkey(data, offset);
+                [perTxLimit, offset] = readOptionU64(data, offset);
+            }
+            catch {
+                return { type: 'add_operator', params: { owner: accounts[0] } };
+            }
+            return {
+                type: 'add_operator',
+                params: {
+                    owner: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                    operator,
+                    perTxLimit: perTxLimit?.toString() ?? null,
+                },
+            };
+        }
+        case 'remove_operator': {
+            let operator;
+            try {
+                [operator, offset] = readPubkey(data, offset);
+            }
+            catch {
+                return { type: 'remove_operator', params: { owner: accounts[0] } };
+            }
+            return {
+                type: 'remove_operator',
+                params: {
+                    owner: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                    operator,
+                },
+            };
+        }
+        case 'toggle_pause':
+            return {
+                type: 'toggle_pause',
+                params: {
+                    owner: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                },
+            };
+        case 'close_account':
+            return {
+                type: 'close_account',
+                params: {
+                    owner: accounts[0] ?? null,
+                    silkAccount: accounts[1] ?? null,
+                },
+            };
+        default:
+            return { type: name, params: {} };
+    }
+}
+//# sourceMappingURL=silkysig.js.map

package/dist/verify/decoders/silkysig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"silkysig.js","sourceRoot":"","sources":["../../../src/verify/decoders/silkysig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOpD,sDAAsD;AACtD,MAAM,cAAc,GAA6B;IAC/C,cAAc,EAAS,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC7D,OAAO,EAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC7D,qBAAqB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;IAC3D,eAAe,EAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IAC5D,YAAY,EAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;IAC5D,eAAe,EAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC9D,YAAY,EAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC;IAC7D,aAAa,EAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;CAC5D,CAAC;AAEF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;IAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc;IAC7C,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,MAAc;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAkB,EAClB,WAAqC,EACrC,aAAuC;IAEvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,kEAAkE;YAClE,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC1B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;iBACjC;aACF,CAAC;QAEJ,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yGAAyG;YACzG,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,CAAC;YAC3H,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE;oBACN,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,IAAI;oBACJ,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,WAAW,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE;iBACxC;aACF,CAAC;QACJ,CAAC;QAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,uGAAuG;YACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,CAAC;YACtI,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC3B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,IAAI;oBACJ,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,WAAW,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE;iBACxC;aACF,CAAC;QACJ,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,QAAgB,EAAE,UAAyB,CAAC;YAChD,IAAI,CAAC;gBACH,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9C,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC1B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,QAAQ;oBACR,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC3C;aACF,CAAC;QACJ,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,CAAC;YACpI,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC1B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,KAAK,cAAc;YACjB,OAAO;gBACL,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC1B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;iBACjC;aACF,CAAC;QAEJ,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC1B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;iBACjC;aACF,CAAC;QAEJ;YACE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/verify/decoders/spl-token.d.ts

@@ -0,0 +1,5 @@
+export interface SplTokenDecoded {
+    type: string;
+    params: Record<string, unknown>;
+}
+export declare function decodeSplToken(data: Buffer, accounts: string[], tokenSymbol: (mint: string) => string): SplTokenDecoded | null;

package/dist/verify/decoders/spl-token.js

@@ -0,0 +1,122 @@
+import { formatUnits } from '../../amount-utils.js';
+// SPL Token instruction discriminator is u8 at byte 0
+const IX = {
+    InitializeMint: 0,
+    InitializeAccount: 1,
+    Transfer: 3,
+    Approve: 4,
+    Revoke: 5,
+    MintTo: 7,
+    Burn: 8,
+    CloseAccount: 9,
+    FreezeAccount: 10,
+    ThawAccount: 11,
+    TransferChecked: 12,
+    ApproveChecked: 13,
+    MintToChecked: 14,
+    BurnChecked: 15,
+    SyncNative: 17,
+};
+export function decodeSplToken(data, accounts, tokenSymbol) {
+    if (data.length < 1)
+        return null;
+    const index = data[0];
+    switch (index) {
+        case IX.Transfer: {
+            // [source, destination, authority], amount: u64 at bytes 1-8
+            if (data.length < 9)
+                return null;
+            const amount = data.readBigUInt64LE(1);
+            return {
+                type: 'transfer',
+                params: {
+                    source: accounts[0] ?? null,
+                    destination: accounts[1] ?? null,
+                    authority: accounts[2] ?? null,
+                    amount: amount.toString(),
+                },
+            };
+        }
+        case IX.TransferChecked: {
+            // [source, mint, destination, authority], amount: u64 at bytes 1-8, decimals: u8 at byte 9
+            if (data.length < 10)
+                return null;
+            const amount = data.readBigUInt64LE(1);
+            const decimals = data[9];
+            const mint = accounts[1] ?? null;
+            const symbol = mint ? tokenSymbol(mint) : 'unknown';
+            const humanAmount = mint
+                ? formatUnits(amount, decimals)
+                : amount.toString();
+            return {
+                type: 'transfer_checked',
+                params: {
+                    source: accounts[0] ?? null,
+                    mint,
+                    destination: accounts[2] ?? null,
+                    authority: accounts[3] ?? null,
+                    amount: amount.toString(),
+                    decimals,
+                    amountHuman: `${humanAmount} ${symbol}`,
+                },
+            };
+        }
+        case IX.MintTo:
+        case IX.MintToChecked: {
+            if (data.length < 9)
+                return null;
+            const amount = data.readBigUInt64LE(1);
+            return {
+                type: index === IX.MintTo ? 'mint_to' : 'mint_to_checked',
+                params: {
+                    mint: accounts[0] ?? null,
+                    destination: accounts[1] ?? null,
+                    authority: accounts[2] ?? null,
+                    amount: amount.toString(),
+                },
+            };
+        }
+        case IX.Burn:
+        case IX.BurnChecked: {
+            if (data.length < 9)
+                return null;
+            const amount = data.readBigUInt64LE(1);
+            return {
+                type: index === IX.Burn ? 'burn' : 'burn_checked',
+                params: {
+                    account: accounts[0] ?? null,
+                    mint: accounts[1] ?? null,
+                    authority: accounts[2] ?? null,
+                    amount: amount.toString(),
+                },
+            };
+        }
+        case IX.CloseAccount:
+            return {
+                type: 'close_account',
+                params: {
+                    account: accounts[0] ?? null,
+                    destination: accounts[1] ?? null,
+                    authority: accounts[2] ?? null,
+                },
+            };
+        case IX.InitializeAccount:
+            return {
+                type: 'initialize_account',
+                params: {
+                    account: accounts[0] ?? null,
+                    mint: accounts[1] ?? null,
+                    owner: accounts[2] ?? null,
+                },
+            };
+        case IX.SyncNative:
+            return { type: 'sync_native', params: { account: accounts[0] ?? null } };
+        case IX.FreezeAccount:
+            return { type: 'freeze_account', params: { account: accounts[0] ?? null, mint: accounts[1] ?? null } };
+        case IX.ThawAccount:
+            return { type: 'thaw_account', params: { account: accounts[0] ?? null, mint: accounts[1] ?? null } };
+        default:
+            return { type: `unknown_spl_ix_${index}`, params: {} };
+    }
+}
+//# sourceMappingURL=spl-token.js.map

package/dist/verify/decoders/spl-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spl-token.js","sourceRoot":"","sources":["../../../src/verify/decoders/spl-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOpD,sDAAsD;AACtD,MAAM,EAAE,GAAG;IACT,cAAc,EAAE,CAAC;IACjB,iBAAiB,EAAE,CAAC;IACpB,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,YAAY,EAAE,CAAC;IACf,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,UAAU,EAAE,EAAE;CACN,CAAC;AAEX,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAkB,EAClB,WAAqC;IAErC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjB,6DAA6D;YAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC3B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;YACxB,2FAA2F;YAC3F,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,MAAM,WAAW,GAAG,IAAI;gBACtB,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC3B,IAAI;oBACJ,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,QAAQ;oBACR,WAAW,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE;iBACxC;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;gBACzD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,CAAC;QACb,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YACpB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc;gBACjD,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,YAAY;YAClB,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5B,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;iBAC/B;aACF,CAAC;QACJ,KAAK,EAAE,CAAC,iBAAiB;YACvB,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;iBAC3B;aACF,CAAC;QACJ,KAAK,EAAE,CAAC,UAAU;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3E,KAAK,EAAE,CAAC,aAAa;YACnB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACzG,KAAK,EAAE,CAAC,WAAW;YACjB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACvG;YACE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/verify/decoders/system.d.ts

@@ -0,0 +1,5 @@
+export interface SystemDecoded {
+    type: string;
+    params: Record<string, unknown>;
+}
+export declare function decodeSystem(data: Buffer, accounts: string[]): SystemDecoded | null;

package/dist/verify/decoders/system.js

@@ -0,0 +1,84 @@
+import { PublicKey } from '@solana/web3.js';
+// System Program instruction indices (u32 LE at bytes 0-3)
+const IX = {
+    CreateAccount: 0,
+    Assign: 1,
+    Transfer: 2,
+    CreateAccountWithSeed: 3,
+    AdvanceNonceAccount: 4,
+    WithdrawNonceAccount: 5,
+    InitializeNonceAccount: 6,
+    AuthorizeNonceAccount: 7,
+    Allocate: 8,
+    AllocateWithSeed: 9,
+    AssignWithSeed: 10,
+    TransferWithSeed: 11,
+};
+export function decodeSystem(data, accounts) {
+    if (data.length < 4)
+        return null;
+    const index = data.readUInt32LE(0);
+    switch (index) {
+        case IX.Transfer: {
+            if (data.length < 12)
+                return null;
+            const lamports = data.readBigUInt64LE(4);
+            return {
+                type: 'transfer',
+                params: {
+                    from: accounts[0] ?? null,
+                    to: accounts[1] ?? null,
+                    lamports: lamports.toString(),
+                    sol: (Number(lamports) / 1e9).toFixed(9).replace(/\.?0+$/, ''),
+                },
+            };
+        }
+        case IX.CreateAccount: {
+            if (data.length < 52)
+                return null;
+            const lamports = data.readBigUInt64LE(4);
+            const space = data.readBigUInt64LE(12);
+            const programId = new PublicKey(data.subarray(20, 52)).toBase58();
+            return {
+                type: 'create_account',
+                params: {
+                    from: accounts[0] ?? null,
+                    newAccount: accounts[1] ?? null,
+                    lamports: lamports.toString(),
+                    sol: (Number(lamports) / 1e9).toFixed(9).replace(/\.?0+$/, ''),
+                    space: space.toString(),
+                    owner: programId,
+                },
+            };
+        }
+        case IX.Assign: {
+            if (data.length < 36)
+                return null;
+            const programId = new PublicKey(data.subarray(4, 36)).toBase58();
+            return {
+                type: 'assign',
+                params: {
+                    account: accounts[0] ?? null,
+                    owner: programId,
+                },
+            };
+        }
+        case IX.Allocate: {
+            if (data.length < 12)
+                return null;
+            const space = data.readBigUInt64LE(4);
+            return {
+                type: 'allocate',
+                params: {
+                    account: accounts[0] ?? null,
+                    space: space.toString(),
+                },
+            };
+        }
+        case IX.AdvanceNonceAccount:
+            return { type: 'advance_nonce_account', params: { nonce: accounts[0] ?? null } };
+        default:
+            return { type: `unknown_system_ix_${index}`, params: {} };
+    }
+}
+//# sourceMappingURL=system.js.map

package/dist/verify/decoders/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/verify/decoders/system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAO5C,2DAA2D;AAC3D,MAAM,EAAE,GAAG;IACT,aAAa,EAAE,CAAC;IAChB,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,qBAAqB,EAAE,CAAC;IACxB,mBAAmB,EAAE,CAAC;IACtB,oBAAoB,EAAE,CAAC;IACvB,sBAAsB,EAAE,CAAC;IACzB,qBAAqB,EAAE,CAAC;IACxB,QAAQ,EAAE,CAAC;IACX,gBAAgB,EAAE,CAAC;IACnB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,EAAE;CACZ,CAAC;AAEX,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,QAAkB;IAElB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEnC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;oBAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;iBAC/D;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAClE,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBACzB,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;oBAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC9D,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACvB,KAAK,EAAE,SAAS;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACf,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjE,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5B,KAAK,EAAE,SAAS;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;oBAC5B,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;iBACxB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC,mBAAmB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACnF;YACE,OAAO,EAAE,IAAI,EAAE,qBAAqB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/verify/flags.d.ts

@@ -0,0 +1,3 @@
+import type { InstructionAnalysis, RiskFlag } from './index.js';
+export declare function applyGlobalFlags(instructions: InstructionAnalysis[], feePayer: string, knownAddresses: Set<string>): RiskFlag[];
+export declare function applyTokenTransferFlags(instructions: InstructionAnalysis[], intentAddresses: Set<string>): RiskFlag[];

package/dist/verify/flags.js

@@ -0,0 +1,83 @@
+// Known program IDs that are safe to receive SOL from System Program transfers
+// (e.g. rent payments, account creation). Transfers to these are not flagged.
+const KNOWN_SAFE_PROGRAMS = new Set([
+    '11111111111111111111111111111111', // System Program itself
+    'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA', // SPL Token
+    'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJe1bC5', // ATA
+    'ComputeBudget111111111111111111111111111111', // Compute Budget
+    'MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr', // Memo
+    'HANDu9uNdnraNbcueGfXhd3UPu6BXfQroKAsSxFhPXEQ', // Handshake
+    'SiLKos3MCFggwLsjSeuRiCdcs2MLoJNwq59XwTvEwcS', // Silkysig
+    'JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4', // Jupiter v6
+    'SysvarRent111111111111111111111111111111111', // Sysvar Rent
+    'SysvarC1ock11111111111111111111111111111111', // Sysvar Clock
+]);
+export function applyGlobalFlags(instructions, feePayer, knownAddresses) {
+    const flags = [];
+    // Collect all addresses involved in the transaction (for context)
+    const txAddresses = new Set([feePayer, ...knownAddresses]);
+    for (const ix of instructions) {
+        if (ix.programId)
+            txAddresses.add(ix.programId);
+    }
+    for (const ix of instructions) {
+        // Rule: UNKNOWN_PROGRAM
+        if (!ix.known) {
+            flags.push({
+                severity: 'error',
+                code: 'UNKNOWN_PROGRAM',
+                message: `Instruction ${ix.index} calls unknown program ${ix.programId} — this instruction cannot be verified.`,
+                instructionIndex: ix.index,
+            });
+        }
+        // Rule: UNEXPECTED_SOL_DRAIN
+        // A System Program transfer to an address that isn't the fee payer, a new account
+        // being created, or a known safe program is suspicious.
+        if (ix.programId === '11111111111111111111111111111111' &&
+            ix.type === 'transfer' &&
+            ix.params) {
+            const to = ix.params['to'];
+            if (to && !txAddresses.has(to) && !KNOWN_SAFE_PROGRAMS.has(to)) {
+                flags.push({
+                    severity: 'error',
+                    code: 'UNEXPECTED_SOL_DRAIN',
+                    message: `Instruction ${ix.index} transfers SOL to unrecognized address ${to} — potential drain.`,
+                    instructionIndex: ix.index,
+                });
+            }
+        }
+        // Rule: LARGE_COMPUTE_BUDGET
+        if (ix.programId === 'ComputeBudget111111111111111111111111111111' &&
+            ix.type === 'set_compute_unit_price') {
+            flags.push({
+                severity: 'info',
+                code: 'LARGE_COMPUTE_BUDGET',
+                message: `Instruction ${ix.index} sets a priority fee (${ix.params['microLamports']} microLamports/CU).`,
+                instructionIndex: ix.index,
+            });
+        }
+    }
+    return flags;
+}
+export function applyTokenTransferFlags(instructions, intentAddresses) {
+    const flags = [];
+    for (const ix of instructions) {
+        // Rule: UNEXPECTED_TOKEN_TRANSFER
+        // SPL Token transfer/transfer_checked where the destination isn't in the intent's known addresses
+        if (ix.programId === 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA' &&
+            (ix.type === 'transfer' || ix.type === 'transfer_checked') &&
+            ix.params) {
+            const destination = ix.params['destination'];
+            if (destination && intentAddresses.size > 0 && !intentAddresses.has(destination)) {
+                flags.push({
+                    severity: 'warning',
+                    code: 'UNEXPECTED_TOKEN_TRANSFER',
+                    message: `Instruction ${ix.index} transfers tokens to ${destination}, which is not part of the requested intent.`,
+                    instructionIndex: ix.index,
+                });
+            }
+        }
+    }
+    return flags;
+}
+//# sourceMappingURL=flags.js.map

package/dist/verify/flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.js","sourceRoot":"","sources":["../../src/verify/flags.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,kCAAkC,EAAa,wBAAwB;IACvE,6CAA6C,EAAE,YAAY;IAC3D,8CAA8C,EAAE,MAAM;IACtD,6CAA6C,EAAE,iBAAiB;IAChE,6CAA6C,EAAE,OAAO;IACtD,8CAA8C,EAAE,YAAY;IAC5D,6CAA6C,EAAG,WAAW;IAC3D,6CAA6C,EAAG,aAAa;IAC7D,6CAA6C,EAAK,cAAc;IAChE,6CAA6C,EAAK,eAAe;CAClE,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAC9B,YAAmC,EACnC,QAAgB,EAChB,cAA2B;IAE3B,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,wBAAwB;QACxB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,eAAe,EAAE,CAAC,KAAK,0BAA0B,EAAE,CAAC,SAAS,yCAAyC;gBAC/G,gBAAgB,EAAE,EAAE,CAAC,KAAK;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,kFAAkF;QAClF,wDAAwD;QACxD,IACE,EAAE,CAAC,SAAS,KAAK,kCAAkC;YACnD,EAAE,CAAC,IAAI,KAAK,UAAU;YACtB,EAAE,CAAC,MAAM,EACT,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAkB,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,eAAe,EAAE,CAAC,KAAK,0CAA0C,EAAE,qBAAqB;oBACjG,gBAAgB,EAAE,EAAE,CAAC,KAAK;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IACE,EAAE,CAAC,SAAS,KAAK,6CAA6C;YAC9D,EAAE,CAAC,IAAI,KAAK,wBAAwB,EACpC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,eAAe,EAAE,CAAC,KAAK,yBAAyB,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,qBAAqB;gBACxG,gBAAgB,EAAE,EAAE,CAAC,KAAK;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,YAAmC,EACnC,eAA4B;IAE5B,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,kCAAkC;QAClC,kGAAkG;QAClG,IACE,EAAE,CAAC,SAAS,KAAK,6CAA6C;YAC9D,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC;YAC1D,EAAE,CAAC,MAAM,EACT,CAAC;YACD,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAkB,CAAC;YAC9D,IAAI,WAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjF,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,eAAe,EAAE,CAAC,KAAK,wBAAwB,WAAW,8CAA8C;oBACjH,gBAAgB,EAAE,EAAE,CAAC,KAAK;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/verify/index.d.ts

@@ -0,0 +1,75 @@
+import { Connection } from '@solana/web3.js';
+export interface RiskFlag {
+    severity: 'info' | 'warning' | 'error';
+    code: string;
+    message: string;
+    instructionIndex?: number;
+}
+export interface InstructionAnalysis {
+    index: number;
+    programId: string;
+    programName: string | null;
+    type: string | null;
+    known: boolean;
+    params: Record<string, unknown>;
+    flags: RiskFlag[];
+}
+export interface TransactionAnalysis {
+    feePayer: string;
+    instructions: InstructionAnalysis[];
+    flags: RiskFlag[];
+    summary: string;
+}
+type TokenSelector = {
+    token: string;
+    tokenAddress?: never;
+} | {
+    token?: never;
+    tokenAddress: string;
+};
+export type Intent = ({
+    type: 'create_transfer';
+    sender: string;
+    recipient: string;
+    amount: string;
+    memo?: string;
+} & TokenSelector) | {
+    type: 'claim_transfer';
+    claimer: string;
+    transferPda: string;
+} | {
+    type: 'cancel_transfer';
+    canceller: string;
+    transferPda: string;
+} | ({
+    type: 'transfer_from_account';
+    owner: string;
+    recipient: string;
+    amount: string;
+} & TokenSelector) | ({
+    type: 'deposit';
+    owner: string;
+    amount: string;
+} & TokenSelector);
+export interface VerifyResult {
+    verified: boolean;
+    discrepancies: string[];
+    analysis: TransactionAnalysis;
+}
+export interface AnalyzeOptions {
+    connection?: Connection;
+    /** Override the bundled registry. Merged with the bundled one — custom entries win. */
+    config?: {
+        programs?: Record<string, {
+            name: string;
+            decoder: string;
+        }>;
+        tokens?: Record<string, {
+            symbol: string;
+            decimals: number;
+        }>;
+    };
+}
+export declare function analyzeTransaction(txBase64: string, opts?: AnalyzeOptions): Promise<TransactionAnalysis>;
+export declare function verifyIntent(txBase64: string, intent: Intent, opts?: AnalyzeOptions): Promise<VerifyResult>;
+export {};