@rhinestone/shared-configs 1.16.0 → 1.18.0

package/dist/scripts/__tests__/validation.test.js

@@ -1,8 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const bun_test_1 = require("bun:test");
 const validation_1 = require("../validation");
 const index_1 = require("../../src/index");
+const oft_json_1 = __importDefault(require("../../configs/oft.json"));
 const nativeToken = { address: "0x0", symbol: "ETH", decimals: 18 };
 /** A structurally complete entry, so semantic tests don't trip structural checks. */
 function validChain(overrides = {}) {
@@ -147,6 +151,119 @@ function errorsFor(chain) {
         (0, bun_test_1.expect)(result.hasErrors).toBe(false);
     });
 });
+// These replace the "must match <map> in the orchestrator" comments the jsonnet
+// used to carry over four flat chain-id allowlists. A layer advertised without
+// the identifiers that address it is a route offered and then not taken, so the
+// build is the only place left to catch it.
+(0, bun_test_1.describe)("validateChainConfig — settlementConfig", () => {
+    const withLayer = (layer, config) => validChain({
+        settlementLayers: ["RELAY", layer],
+        settlementConfig: config,
+    });
+    bun_test_1.it.each([
+        ["RHINO", "rhino", { chainName: "ETHEREUM" }],
+        ["CCTP", "cctp", { domain: 0 }],
+        ["NEAR", "near", { prefix: "eth" }],
+        ["OFT", "oft", { adapter: "0xadapter", layerZeroEid: 30101 }],
+    ])("accepts %s with its payload", (layer, key, payload) => {
+        (0, bun_test_1.expect)(errorsFor(withLayer(layer, { [key]: payload }))).toEqual([]);
+    });
+    bun_test_1.it.each([
+        ["RHINO", "rhino"],
+        ["CCTP", "cctp"],
+        ["NEAR", "near"],
+        ["OFT", "oft"],
+    ])("rejects %s declared with no payload", (layer, key) => {
+        const errors = errorsFor(withLayer(layer, {}));
+        (0, bun_test_1.expect)(errors).toHaveLength(1);
+        (0, bun_test_1.expect)(errors[0].message).toContain(`settlementConfig.${key} is missing`);
+    });
+    bun_test_1.it.each([
+        ["RHINO", { rhino: {} }, "rhino.chainName"],
+        ["CCTP", { cctp: { domain: "0" } }, "cctp.domain"],
+        ["NEAR", { near: { prefix: "" } }, "near.prefix"],
+        ["OFT", { oft: { adapter: "0xa" } }, "oft.layerZeroEid"],
+    ])("rejects %s whose payload is incomplete", (layer, config, field) => {
+        const errors = errorsFor(withLayer(layer, config));
+        (0, bun_test_1.expect)(errors.some((e) => e.message.includes(field))).toBe(true);
+    });
+    // Domain 0 is Ethereum, so a truthiness check would drop a real route.
+    (0, bun_test_1.it)("accepts CCTP domain 0", () => {
+        (0, bun_test_1.expect)(errorsFor(withLayer("CCTP", { cctp: { domain: 0 } }))).toEqual([]);
+    });
+    // Absent for a destination-only chain, which nothing originates from.
+    (0, bun_test_1.it)("accepts a rhino entry with no bridgeContract", () => {
+        (0, bun_test_1.expect)(errorsFor(withLayer("RHINO", { rhino: { chainName: "SOLANA" } }))).toEqual([]);
+    });
+    (0, bun_test_1.it)("rejects a payload for a layer that is not enabled", () => {
+        const errors = errorsFor(validChain({ settlementConfig: { cctp: { domain: 6 } } }));
+        (0, bun_test_1.expect)(errors).toHaveLength(1);
+        (0, bun_test_1.expect)(errors[0].message).toContain("CCTP is not in settlementLayers");
+    });
+    (0, bun_test_1.it)("rejects an unknown layer key", () => {
+        const errors = errorsFor(validChain({ settlementConfig: { hop: {} } }));
+        (0, bun_test_1.expect)(errors).toHaveLength(1);
+        (0, bun_test_1.expect)(errors[0].message).toContain("unknown layer");
+    });
+    // 1Click's non-EVM ids are NEAR-internal; deriving one produces a string it
+    // rejects, so a missing id throws mid-plan rather than degrading.
+    (0, bun_test_1.it)("rejects a non-EVM NEAR chain whose token has no nearAssetId", () => {
+        const errors = errorsFor(validChain({
+            vmType: "svm",
+            settlementLayers: ["RELAY", "NEAR"],
+            settlementConfig: { near: { prefix: "sol" } },
+            tokens: [{ ...nativeToken, balanceSlot: null, approvalSlot: null }],
+        }));
+        (0, bun_test_1.expect)(errors).toHaveLength(1);
+        (0, bun_test_1.expect)(errors[0].message).toContain("nearAssetId");
+    });
+    (0, bun_test_1.it)("does not require nearAssetId on an EVM NEAR chain", () => {
+        (0, bun_test_1.expect)(errorsFor(validChain({
+            settlementLayers: ["RELAY", "NEAR"],
+            settlementConfig: { near: { prefix: "eth" } },
+        }))).toEqual([]);
+    });
+});
+// The chain block states OFT membership and reads its addresses back out of
+// config/oft.jsonnet, so the one way the two can disagree is an adapter added
+// there whose chain block was never given an `oft` entry — invisible in a diff
+// of either file alone.
+(0, bun_test_1.describe)("validateOftCoverage", () => {
+    (0, bun_test_1.it)("accepts the real generated registry", () => {
+        (0, bun_test_1.expect)((0, validation_1.validateOftCoverage)(index_1.chainRegistry, oft_json_1.default)).toEqual([]);
+    });
+    (0, bun_test_1.it)("reports a chain with an adapter but no OFT layer", () => {
+        const issues = (0, validation_1.validateOftCoverage)({ "1": validChain() }, {
+            USDT0: { adapters: { "1": "0xadapter" } },
+        });
+        (0, bun_test_1.expect)(issues).toHaveLength(1);
+        (0, bun_test_1.expect)(issues[0].message).toContain("declares no OFT layer");
+    });
+    (0, bun_test_1.it)("reports an adapter the chain entry disagrees with", () => {
+        const chain = validChain({
+            settlementLayers: ["RELAY", "OFT"],
+            settlementConfig: { oft: { adapter: "0xstale", layerZeroEid: 30101 } },
+        });
+        const issues = (0, validation_1.validateOftCoverage)({ "1": chain }, {
+            USDT0: { adapters: { "1": "0xadapter" } },
+        });
+        (0, bun_test_1.expect)(issues).toHaveLength(1);
+        (0, bun_test_1.expect)(issues[0].message).toContain("does not match");
+    });
+    // The registry is authored in checksummed hex; the chain block is not.
+    (0, bun_test_1.it)("compares adapters case-insensitively", () => {
+        const chain = validChain({
+            settlementLayers: ["RELAY", "OFT"],
+            settlementConfig: { oft: { adapter: "0xABC", layerZeroEid: 30101 } },
+        });
+        (0, bun_test_1.expect)((0, validation_1.validateOftCoverage)({ "1": chain }, {
+            USDT0: { adapters: { "1": "0xabc" } },
+        })).toEqual([]);
+    });
+    (0, bun_test_1.it)("ignores an OFT chain that is not in the registry", () => {
+        (0, bun_test_1.expect)((0, validation_1.validateOftCoverage)({}, { USDT0: { adapters: { "1": "0xa" } } })).toEqual([]);
+    });
+});
 (0, bun_test_1.describe)("formatValidationIssues", () => {
     (0, bun_test_1.it)("returns empty string for no issues", () => {
         (0, bun_test_1.expect)((0, validation_1.formatValidationIssues)({ issues: [], hasErrors: false })).toBe("");

package/dist/scripts/__tests__/vendor-drift.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/__tests__/vendor-drift.test.js

@@ -0,0 +1,411 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const bun_test_1 = require("bun:test");
+const diff_1 = require("../vendor-drift/diff");
+const identity_1 = require("../vendor-drift/identity");
+const vendors_1 = require("../vendor-drift/vendors");
+const report_1 = require("../vendor-drift/report");
+const codes = (findings) => findings.map((f) => f.code);
+const chain = (over = {}) => ({
+    name: "Test",
+    vmType: "evm",
+    settlementLayers: [],
+    tokens: [],
+    ...over,
+});
+(0, bun_test_1.describe)("diffRhino", () => {
+    const vendor = (over = {}) => ({
+        name: "BASE",
+        networkId: 8453,
+        status: "enabled",
+        contractAddress: "0x2f59e9086ec8130e21bd052065a9e6b2497bb102",
+        ...over,
+    });
+    (0, bun_test_1.test)("flags a chain we claim that the vendor no longer lists", () => {
+        const registry = {
+            "130": chain({ name: "Unichain", settlementLayers: ["RHINO"] }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffRhino)(registry, [vendor()]))).toContain("rhino_chain_dropped");
+    });
+    (0, bun_test_1.test)("a disabled vendor chain does not count as supported", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffRhino)(registry, [vendor({ status: "disabled" })]))).toContain("rhino_chain_disabled");
+    });
+    (0, bun_test_1.test)("a vendor entry with no contract address leaves ours unverified", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ contractAddress: undefined }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("rhino_bridge_contract_unserved");
+    });
+    (0, bun_test_1.test)("flags a silently changed bridge contract", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ contractAddress: "0xdeadbeef00000000000000000000000000000000" }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("rhino_bridge_contract_changed");
+    });
+    (0, bun_test_1.test)("case alone is not a bridge contract change", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ contractAddress: "0x2F59E9086EC8130E21BD052065A9E6B2497BB102" }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("rhino_bridge_contract_changed");
+    });
+    (0, bun_test_1.test)("flags a chain the vendor serves that we do not claim", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: [] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [vendor()]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("rhino_chain_available");
+        (0, bun_test_1.expect)(findings.find((f) => f.code === "rhino_chain_available")?.kind).toBe("underclaim");
+    });
+    // Rhino serves every networkId as a string, EVM included, so this is the
+    // shape the scheduled run actually sees.
+    (0, bun_test_1.test)("a string networkId is still compared against the chain id", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ networkId: "999" }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("rhino_network_id_mismatch");
+    });
+    (0, bun_test_1.test)("a matching string networkId is not a mismatch", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["RHINO"] }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ networkId: "8453" }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("rhino_network_id_mismatch");
+    });
+    (0, bun_test_1.test)("a non-numeric networkId is never compared against a chain id", () => {
+        const registry = {
+            "792703809": chain({
+                name: "Solana",
+                vmType: "svm",
+                settlementLayers: ["RHINO"],
+            }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [
+            vendor({ name: "SOLANA", networkId: 900, contractAddress: undefined }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("rhino_network_id_mismatch");
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("rhino_bridge_contract_unknown");
+    });
+    (0, bun_test_1.test)("registry config overrides the baseline bridge contract", () => {
+        const registry = {
+            "8453": chain({
+                name: "Base",
+                settlementLayers: ["RHINO"],
+                settlementLayerConfig: {
+                    RHINO: { chainName: "BASE", bridgeContract: "0xabc" },
+                },
+            }),
+        };
+        const findings = (0, diff_1.diffRhino)(registry, [vendor()]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("rhino_bridge_contract_changed");
+    });
+});
+(0, bun_test_1.describe)("nearAssetId", () => {
+    (0, bun_test_1.test)("derives the omft id from a lowercased EVM address", () => {
+        (0, bun_test_1.expect)((0, diff_1.nearAssetId)("base", 8453, "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913")).toBe("nep141:base-0x833589fcd6edb6e08f4c7c32d4f71b54bda02913.omft.near");
+    });
+    (0, bun_test_1.test)("native sentinels resolve to the bare chain asset", () => {
+        (0, bun_test_1.expect)((0, diff_1.nearAssetId)("base", 8453, "0x0000000000000000000000000000000000000000")).toBe("nep141:base.omft.near");
+    });
+    (0, bun_test_1.test)("non-EVM tokens never fall through to the EVM derivation", () => {
+        (0, bun_test_1.expect)((0, diff_1.nearAssetId)("sol", 792703809, "SomeUnknownMint")).toBeUndefined();
+    });
+});
+(0, bun_test_1.describe)("diffNear", () => {
+    const token = (over = {}) => ({
+        assetId: "nep141:base-0xaaa.omft.near",
+        blockchain: "base",
+        contractAddress: "0xaaa",
+        ...over,
+    });
+    (0, bun_test_1.test)("flags a blockchain slug the vendor dropped", () => {
+        const registry = {
+            "8453": chain({ name: "Base", settlementLayers: ["NEAR"] }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffNear)(registry, [token({ blockchain: "eth" })]))).toContain("near_blockchain_dropped");
+    });
+    (0, bun_test_1.test)("flags a token whose asset id the vendor re-issued", () => {
+        const registry = {
+            "8453": chain({
+                name: "Base",
+                settlementLayers: ["NEAR"],
+                tokens: [{ address: "0xAAA", symbol: "AAA" }],
+            }),
+        };
+        const findings = (0, diff_1.diffNear)(registry, [
+            token({ assetId: "nep245:v2_1.omni.hot.tg:8453_zzz" }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("near_asset_id_changed");
+    });
+    // The authored id is what the consumer sends, so deriving instead would both
+    // report drift on a token already corrected and miss an authored id going
+    // stale — the case this check exists for.
+    (0, bun_test_1.test)("an authored nearAssetId is checked, not the derivation", () => {
+        const registry = {
+            "8453": chain({
+                name: "Base",
+                settlementLayers: ["NEAR"],
+                tokens: [
+                    {
+                        address: "0xAAA",
+                        symbol: "AAA",
+                        nearAssetId: "nep245:v2_1.omni.hot.tg:8453_zzz",
+                    },
+                ],
+            }),
+        };
+        const served = [
+            token({ assetId: "nep245:v2_1.omni.hot.tg:8453_zzz" }),
+        ];
+        (0, bun_test_1.expect)(codes((0, diff_1.diffNear)(registry, served))).not.toContain("near_asset_id_changed");
+        // ...and a stale authored id is still caught.
+        const stale = {
+            "8453": chain({
+                name: "Base",
+                settlementLayers: ["NEAR"],
+                tokens: [
+                    { address: "0xAAA", symbol: "AAA", nearAssetId: "nep141:base-old" },
+                ],
+            }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffNear)(stale, served))).toContain("near_asset_id_changed");
+    });
+    (0, bun_test_1.test)("a matching asset id produces nothing", () => {
+        const registry = {
+            "8453": chain({
+                name: "Base",
+                settlementLayers: ["NEAR"],
+                tokens: [{ address: "0xAAA", symbol: "AAA" }],
+            }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffNear)(registry, [token()]))).not.toContain("near_asset_id_changed");
+    });
+    (0, bun_test_1.describe)("per-token coverage", () => {
+        const registryWith = (tokens) => ({
+            "8453": chain({ name: "Base", settlementLayers: ["NEAR"], tokens }),
+        });
+        (0, bun_test_1.test)("a declared token the vendor does not serve is an overclaim", () => {
+            const findings = (0, diff_1.diffNear)(registryWith([
+                { address: "0xAAA", symbol: "AAA", settlementLayers: ["NEAR"] },
+                { address: "0xBBB", symbol: "BBB", settlementLayers: ["NEAR"] },
+            ]), [token()]);
+            const dropped = findings.filter((f) => f.code === "near_token_dropped");
+            (0, bun_test_1.expect)(dropped).toHaveLength(1);
+            (0, bun_test_1.expect)(dropped[0]?.kind).toBe("overclaim");
+            (0, bun_test_1.expect)(dropped[0]?.message).toContain("BBB");
+        });
+        (0, bun_test_1.test)("an undeclared token the vendor does not serve is not reported", () => {
+            // The four this coverage change excludes. Reporting them as overclaims
+            // was the false positive.
+            const findings = (0, diff_1.diffNear)(registryWith([
+                { address: "0xAAA", symbol: "AAA", settlementLayers: ["NEAR"] },
+                { address: "0xBBB", symbol: "BBB", settlementLayers: ["ACROSS"] },
+            ]), [token()]);
+            (0, bun_test_1.expect)(codes(findings)).not.toContain("near_token_dropped");
+            (0, bun_test_1.expect)(codes(findings)).not.toContain("near_token_available");
+        });
+        (0, bun_test_1.test)("an undeclared token the vendor DOES serve is an underclaim", () => {
+            const findings = (0, diff_1.diffNear)(registryWith([
+                { address: "0xAAA", symbol: "AAA", settlementLayers: ["NEAR"] },
+                { address: "0xBBB", symbol: "BBB", settlementLayers: [] },
+            ]), [
+                token(),
+                token({
+                    assetId: "nep141:base-0xbbb.omft.near",
+                    contractAddress: "0xbbb",
+                    symbol: "BBB",
+                }),
+            ]);
+            const available = findings.filter((f) => f.code === "near_token_available");
+            (0, bun_test_1.expect)(available).toHaveLength(1);
+            (0, bun_test_1.expect)(available[0]?.kind).toBe("underclaim");
+            (0, bun_test_1.expect)(available[0]?.severity).toBe("info");
+            (0, bun_test_1.expect)(available[0]?.message).toContain("BBB");
+        });
+        (0, bun_test_1.test)("a native whose asset id went stale is a mismatch, not a drop", () => {
+            // 1Click returns no contractAddress for a gas token, so matching on the
+            // registry's zero-address placeholder has to normalise or every native
+            // reports as unlisted.
+            const findings = (0, diff_1.diffNear)({
+                "8453": chain({
+                    name: "Base",
+                    settlementLayers: ["NEAR"],
+                    tokens: [
+                        {
+                            address: "0x0000000000000000000000000000000000000000",
+                            symbol: "ETH",
+                            settlementLayers: ["NEAR"],
+                            nearAssetId: "nep141:base.omft.near",
+                        },
+                    ],
+                }),
+            }, [
+                token({
+                    assetId: "nep245:v2_1.omni.hot.tg:8453_native",
+                    contractAddress: undefined,
+                    symbol: "ETH",
+                }),
+            ]);
+            (0, bun_test_1.expect)(codes(findings)).toContain("near_asset_id_changed");
+            (0, bun_test_1.expect)(codes(findings)).not.toContain("near_token_dropped");
+            (0, bun_test_1.expect)(findings[0]?.message).toContain("nep245:v2_1.omni.hot.tg:8453_native");
+        });
+        (0, bun_test_1.test)("an undeclared native the vendor serves is still an underclaim", () => {
+            const findings = (0, diff_1.diffNear)({
+                "8453": chain({
+                    name: "Base",
+                    settlementLayers: ["NEAR"],
+                    tokens: [
+                        { address: "0xAAA", symbol: "AAA", settlementLayers: ["NEAR"] },
+                        {
+                            address: "0x0000000000000000000000000000000000000000",
+                            symbol: "ETH",
+                            settlementLayers: [],
+                        },
+                    ],
+                }),
+            }, [
+                token(),
+                token({
+                    assetId: "nep141:base.omft.near",
+                    contractAddress: undefined,
+                    symbol: "ETH",
+                }),
+            ]);
+            (0, bun_test_1.expect)(codes(findings)).toContain("near_token_available");
+        });
+        (0, bun_test_1.test)("a registry declaring NEAR on no token checks every token", () => {
+            // Pre-field artifact: the consumer advertises the whole chain, so every
+            // token is still a claim.
+            const findings = (0, diff_1.diffNear)(registryWith([
+                { address: "0xAAA", symbol: "AAA" },
+                { address: "0xBBB", symbol: "BBB" },
+            ]), [token()]);
+            (0, bun_test_1.expect)(codes(findings)).toContain("near_token_dropped");
+            (0, bun_test_1.expect)(codes(findings)).not.toContain("near_token_available");
+        });
+    });
+});
+(0, bun_test_1.describe)("diffCctp", () => {
+    const registry = {
+        "8453": chain({
+            name: "Base",
+            network: "mainnet",
+            settlementLayers: ["CCTP"],
+        }),
+        "57073": chain({ name: "Ink", network: "mainnet", settlementLayers: [] }),
+    };
+    const probe = (over) => ({
+        chainId: 8453,
+        reachable: true,
+        messenger: identity_1.CCTP_CONTRACTS.mainnet.tokenMessenger,
+        deployed: true,
+        transmitter: identity_1.CCTP_CONTRACTS.mainnet.messageTransmitter,
+        domain: 6,
+        ...over,
+    });
+    (0, bun_test_1.test)("a deployment on a chain we do not claim is an addition", () => {
+        const findings = (0, diff_1.diffCctp)(registry, [probe({ chainId: 57073, domain: 21 })]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("cctp_chain_available");
+    });
+    (0, bun_test_1.test)("a domain that disagrees with ours is drift", () => {
+        const findings = (0, diff_1.diffCctp)(registry, [probe({ domain: 99 })]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("cctp_domain_mismatch");
+    });
+    (0, bun_test_1.test)("an unrelated contract at the messenger address is not a new chain", () => {
+        const findings = (0, diff_1.diffCctp)(registry, [
+            probe({
+                chainId: 57073,
+                transmitter: "0x1111111111111111111111111111111111111111",
+            }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("cctp_transmitter_changed");
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("cctp_chain_available");
+    });
+    (0, bun_test_1.test)("an unreadable transmitter is unconfirmed, not a new chain", () => {
+        const findings = (0, diff_1.diffCctp)(registry, [
+            probe({ chainId: 57073, transmitter: undefined }),
+        ]);
+        (0, bun_test_1.expect)(codes(findings)).toContain("cctp_transmitter_unreadable");
+        (0, bun_test_1.expect)(codes(findings)).not.toContain("cctp_chain_available");
+        (0, bun_test_1.expect)(findings.every((f) => f.severity !== "drift")).toBe(true);
+    });
+    (0, bun_test_1.test)("an unreachable chain is a warning, never drift", () => {
+        const findings = (0, diff_1.diffCctp)(registry, [
+            { chainId: 8453, reachable: false, error: "timeout" },
+        ]);
+        (0, bun_test_1.expect)(findings.every((f) => f.severity !== "drift")).toBe(true);
+    });
+    (0, bun_test_1.test)("a claimed chain that was never probed is reported, not assumed fine", () => {
+        (0, bun_test_1.expect)(codes((0, diff_1.diffCctp)(registry, []))).toContain("cctp_not_probed");
+    });
+});
+(0, bun_test_1.describe)("diffRegistryConsistency", () => {
+    (0, bun_test_1.test)("flags a chain claiming a layer with no per-layer config", () => {
+        const registry = {
+            "1868": chain({ name: "Soneium", settlementLayers: ["CCTP"] }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffRegistryConsistency)(registry))).toContain("layer_claimed_without_config");
+    });
+    (0, bun_test_1.test)("flags per-layer config on a chain that does not claim the layer", () => {
+        const registry = {
+            "999": chain({ name: "HyperEVM", settlementLayers: [] }),
+        };
+        (0, bun_test_1.expect)(codes((0, diff_1.diffRegistryConsistency)(registry))).toContain("layer_config_without_claim");
+    });
+});
+(0, bun_test_1.describe)("rpcCandidates", () => {
+    const providers = {
+        Alchemy: {
+            chain_mapping: { "8453": "base-mainnet" },
+            url_template: "https://{{chain_param}}.g.alchemy.com/v2/${ALCHEMY_API_KEY}",
+        },
+    };
+    const registry = {
+        "8453": chain({ name: "Base", publicRpcUrl: "https://mainnet.base.org" }),
+    };
+    (0, bun_test_1.test)("expands a provider template from the environment", () => {
+        (0, bun_test_1.expect)((0, vendors_1.rpcCandidates)(8453, registry, providers, { ALCHEMY_API_KEY: "k" })[0]).toBe("https://base-mainnet.g.alchemy.com/v2/k");
+    });
+    (0, bun_test_1.test)("drops a template whose key is unset rather than calling it keyless", () => {
+        (0, bun_test_1.expect)((0, vendors_1.rpcCandidates)(8453, registry, providers, {})).toEqual([
+            "https://mainnet.base.org",
+        ]);
+    });
+    (0, bun_test_1.test)("an explicit override wins outright", () => {
+        (0, bun_test_1.expect)((0, vendors_1.rpcCandidates)(8453, registry, providers, {
+            ALCHEMY_API_KEY: "k",
+            VENDOR_DRIFT_RPC_8453: "http://localhost:8545",
+        })).toEqual(["http://localhost:8545"]);
+    });
+});
+(0, bun_test_1.describe)("formatMarkdown", () => {
+    // The workflow always exits green, so the summary headline is the only
+    // signal. A clean tick after an unreachable vendor reports a check we did
+    // not perform.
+    (0, bun_test_1.test)("a run with skipped checks never claims agreement", () => {
+        const md = (0, report_1.formatMarkdown)([], ["Rhino /bridge/configs unreachable"]);
+        (0, bun_test_1.expect)(md).not.toContain(":white_check_mark:");
+        (0, bun_test_1.expect)(md).toContain("not run");
+        (0, bun_test_1.expect)(md).toContain("Rhino /bridge/configs unreachable");
+    });
+    (0, bun_test_1.test)("a fully covered clean run still reports agreement", () => {
+        (0, bun_test_1.expect)((0, report_1.formatMarkdown)([], [])).toContain(":white_check_mark:");
+    });
+});

package/dist/scripts/generate.js

@@ -89,7 +89,7 @@ function renderChains(chainRegistry, mainnets, testnets) {
     }
     return [
         "// Auto-generated by scripts/generate.ts. Do not edit manually.",
-        'import type { ChainNetwork, ChainStack, PegGroup, ProviderName, SettlementLayer, SupportedChain, SwapQuoter, SwapQuoterConfig, VmType } from "./types";',
+        'import type { ChainNetwork, ChainStack, PegGroup, ProviderName, SettlementConfig, SettlementLayer, SupportedChain, SwapQuoter, SwapQuoterConfig, VmType } from "./types";',
         "",
         "interface Token {",
         "  /** EVM: 0x-prefixed hex. SVM: base58 SPL mint. TVM: base58 (T-prefixed). */",
@@ -102,6 +102,11 @@ function renderChains(chainRegistry, mainnets, testnets) {
         "  approvalSlot: number | null;",
         "  /** Bridge layers that can carry this token on this chain, when known. */",
         "  settlementLayers?: SettlementLayer[];",
+        "  /** Rhino's own symbol for this token, where it differs from ours. */",
+        "  rhinoSymbol?: string;",
+        "  /** NEAR 1Click asset id, for tokens whose id 1Click does not derive from",
+        "   *  the on-chain address (non-EVM chains). */",
+        "  nearAssetId?: string;",
         "  unpriced?: boolean;",
         "}",
         "",
@@ -150,6 +155,10 @@ function renderChains(chainRegistry, mainnets, testnets) {
         "  wrappedNativeToken: NativeToken;",
         "  tokens: Token[];",
         "  settlementLayers: SettlementLayer[];",
+        "  /** Per-vendor addressing for the enabled layers that need it (Rhino chain",
+        "   *  name, CCTP domain, NEAR prefix, OFT adapter). Third-party addresses —",
+        "   *  never the contracts block, which is read as Rhinestone-deployed. */",
+        "  settlementConfig?: SettlementConfig;",
         "  providers: ProviderName[];",
         "  swapQuoters: SwapQuoter[];",
         "  swapQuoterConfig?: Partial<Record<SwapQuoter, SwapQuoterConfig>>;",
@@ -412,6 +421,10 @@ async function generate() {
     // to insist on. A chain added without one would otherwise reach production as
     // a blank tile, which nothing anywhere reports.
     const iconSlugIssues = (0, validation_1.validateChainIconSlugs)(classifiedChains);
+    // The one check that needs both files: a chain block declares OFT membership
+    // and reads its addresses back out of the OFT registry, so only an adapter
+    // added there without the matching chain entry can drift.
+    const oftCoverageIssues = (0, validation_1.validateOftCoverage)(classifiedChains, output.oft);
     const classificationIssues = [
         ...networkIssues,
         ...stackIssues,
@@ -419,6 +432,7 @@ async function generate() {
         ...explorerIssues,
         ...publicRpcUrlIssues,
         ...iconSlugIssues,
+        ...oftCoverageIssues,
     ];
     await (0, promises_1.writeFile)(node_path_1.default.join(configsDir, "chains.json"), `${JSON.stringify(classifiedChains, null, 2)}\n`);
     await (0, promises_1.writeFile)(node_path_1.default.join(configsDir, "mainnets.json"), `${JSON.stringify(output.mainnets, null, 2)}\n`);

package/dist/scripts/validation.d.ts

@@ -215,6 +215,16 @@ export declare function classifyChainStacks(chains: ChainRegistry, networks: {
  * - Single-layer fragility: chains with exactly one settlement layer (warning)
  */
 export declare function validateChainConfig(chains: ChainRegistry): ValidationResult;
+/**
+ * Insists that every chain the OFT registry deploys on declares OFT.
+ *
+ * The chain block states the membership and reads the adapter and endpoint id
+ * back out of config/oft.jsonnet, so the two can only disagree one way: a
+ * deployment added to the OFT registry whose chain block was never given an
+ * `oft` entry. That chain silently stops advertising OFT, which is invisible in
+ * a diff of either file on its own — this is the check that sees both.
+ */
+export declare function validateOftCoverage(chains: ChainRegistry, oft: Record<string, unknown>): ValidationIssue[];
 /**
  * Formats validation issues for console output.
  *